Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Sos Marharian & Yaroslava Khadzhynova
Photographers / Videographers
Billstedter Mühlenweg 50
22117 Hamburg
Germany

Phone: +49 (0) 160 274 12 74
Email: marharianstudio@gmail.com

We are not legally required to appoint a data protection officer, as the conditions of Section 38 BDSG do not apply. For any privacy-related questions, please use the contact details above.

2. Legal bases for processing

We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR (consent) — for analytics and marketing cookies and related processing. You give this consent via our cookie banner and may withdraw it at any time with effect for the future.
• Art. 6(1)(b) GDPR (contract / pre-contractual measures) — when you send us an enquiry in order to receive a quote or initiate a booking.
• Art. 6(1)(f) GDPR (legitimate interest) — for the technically secure operation and delivery of the website.

Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion. Commercial and tax retention periods may extend to ten years.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes data on our behalf; we have concluded a Data Processing Addendum with the provider.

When you access the website, information transmitted by your browser is collected automatically. This includes in particular:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Volume of data transferred and notification of successful retrieval
• Browser type, browser version and operating system
• Referrer URL (the previously visited page)

This processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering the website, ensuring system security and defending against attacks. This data is not merged with other data sources.

The website is secured by TLS encryption (HTTPS). Transmission between your browser and our server is encrypted.

4. Cookies and consent

Our website uses cookies and comparable technologies (localStorage). Cookies are small text files stored on your device.

Technically necessary storage

Certain information is required for the site to function and is stored without consent: your language selection (DE/EN) and your choice in the cookie banner itself. The legal basis is Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

Cookies requiring consent

All analytics and marketing technologies are loaded only after your explicit consent. Prior to consent, all corresponding storage access is disabled by default (denied) via Google Consent Mode v2.

You can change or withdraw your choice at any time using the “Cookie Settings” link in the footer of every page. Withdrawal takes effect for the future; the lawfulness of processing carried out up to that point remains unaffected.

You may also delete or block cookies in your browser settings. In that case, some functions of this website may not be fully available.

5. Analytics and advertising

The following services are used exclusively with your consent under Art. 6(1)(a) GDPR and are loaded through Google Tag Manager.

Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is an administrative tool that does not itself collect personal data for analytics purposes, but controls the loading of the services listed below. When it loads, your IP address is transmitted to Google.

Google Analytics 4

Provider: Google Ireland Limited. We use Google Analytics for statistical evaluation of website usage. Data collected includes pages viewed, time on site, approximate location, device type and the source of the visit. Your IP address is truncated by Google and is not merged with other Google data. Retention of event data is limited to the period provided by Google.

Google Ads conversion tracking

Provider: Google Ireland Limited. If you reached our website via one of our ads, Google sets a cookie to determine whether certain actions took place (for example, submitting an enquiry). This information is used to measure and optimise our advertising campaigns. We do not receive any information that would allow us to identify users personally.

Meta Pixel and Conversions API

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The Meta Pixel allows us to measure the effectiveness of our advertising on Facebook and Instagram and to show relevant ads to visitors of this website.

In addition, we transmit events to Meta server-side via the Conversions API. Information you provided in our enquiry form (email address and, where applicable, phone number) is irreversibly encrypted using SHA-256 hashing before transmission. Meta does not receive this data in plain text. The purpose is matching against existing user accounts in order to attribute advertising results. Pixel cookies, your IP address and browser identifier are also transmitted.

The browser event and the server event are matched via a shared identifier, so no duplicate counting occurs. This processing likewise takes place only with your consent.

Further information: Meta Privacy Policy and Google Privacy Policy.

6. Contacting us and enquiry forms

Our website provides forms through which you can send us an enquiry. The data collected consists of the details you enter — depending on the form, this may include your name, email address, phone or WhatsApp number, Instagram profile, the service requested, the date and location of your project, and your message.

Technical delivery is handled by the service Web3Forms (Nexinvent Technologies). The provider processes the form data solely for the purpose of forwarding it to our email inbox and does not store the contents permanently.

The legal basis is Art. 6(1)(b) GDPR, as the processing serves to answer your enquiry and to initiate a possible booking. We retain your details until your enquiry has been dealt with and no statutory retention obligations remain.

If you contact us by email, phone or WhatsApp, we process the resulting data likewise for the purpose of handling your request. Please note that WhatsApp is operated by Meta Platforms Ireland Limited and that data is transmitted to this provider when you open the link.

7. Third-party services

Google Fonts

To display typefaces consistently, we embed fonts provided by Google. When a page is loaded, your browser retrieves the required fonts from servers operated by Google Ireland Limited. Your IP address is transmitted to Google in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the consistent and appealing presentation of our content.

Cloudflare R2

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The videos shown on this website are delivered from Cloudflare servers. Your IP address is transmitted to the provider when they are retrieved. The legal basis is Art. 6(1)(f) GDPR — legitimate interest in fast and reliable delivery of large media files.

jsDelivr

For individual features (the date picker in the enquiry form), we load program libraries via the jsDelivr content delivery network (Prospect One, Kraków, Poland). Your IP address is transmitted to the provider in this case as well. The legal basis is Art. 6(1)(f) GDPR.

Links to social networks

Our website contains links to our Instagram profile. These are simple links, not embedded content. No data is transmitted to the provider until you actively click the link.

8. Data transfers to the USA

Some of the services we use have parent companies based in the United States. Transfers of personal data to the USA can therefore not be ruled out.

For such transfers we rely on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework of 10 July 2023, where the respective provider is certified under it, and additionally on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Please note that the level of data protection in the USA does not fully correspond to the European standard. In particular, US authorities may under certain conditions access personal data without EU data subjects having equally effective legal remedies available. Where services are used on the basis of your consent, the transfer additionally takes place pursuant to Art. 49(1)(a) GDPR.

9. Your rights

You have the right at any time:

• to request information about the personal data we process about you (Art. 15 GDPR)
• to request rectification of inaccurate data (Art. 16 GDPR)
• to request erasure of your data, provided no statutory retention obligations prevent it (Art. 17 GDPR)
• to request restriction of processing (Art. 18 GDPR)
• to receive your data in a structured, commonly used format or have it transferred — data portability (Art. 20 GDPR)
• to object to processing based on legitimate interests (Art. 21 GDPR)
• to withdraw consent at any time (Art. 7(3) GDPR)

An informal message to marharianstudio@gmail.com is sufficient to exercise these rights.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 7th floor
20459 Hamburg, Germany
datenschutz-hamburg.de

Changes to this privacy policy

We update this privacy policy whenever changes to the services we use or to the legal situation make it necessary. The version published on this page applies in each case.

This English text is provided for convenience. In the event of any discrepancy, the German version shall prevail.