Privacy

This page tells you which personal data is processed when you visit laurahartung.de, why that happens and which rights you have. I keep data processing deliberately small: no cookies, no advertising, and visitor statistics only with your consent.

This English version is a convenience translation. The German version is authoritative.

1. Controller

I am the controller responsible for data processing on this website:

Laura Hartung
Fotografin & Künstlerin
Rathausstraße 60
21423 Winsen (Luhe)
Germany
Email: email@laurahartung.de
Phone: +49 157 5 6922227

2. Hosting and processing on my behalf

The website is technically operated and maintained by the agency webAION (owner Ronni Wordel, Teichweg 1, 21481 Lauenburg, Germany). The server is located in a data centre run by dogado GmbH (Antonio-Segni-Straße 11, 44263 Dortmund, Germany) in Germany.

webAION processes personal data solely on my behalf and on my instructions (processor under Art. 28 GDPR). dogado GmbH is involved as a sub-processor. The legal basis for using these service providers is my legitimate interest in running the website securely and reliably (Art. 6(1)(f) GDPR).

3. Server logs

Every time you open a page, your browser sends technically necessary data to the server. The server logs contain: your IP address, date and time, the address requested, the status code, the amount of data transferred, the page you came from (referrer), and your browser and operating system (user agent).

I need this data to deliver the website, find errors and fend off attacks. The legal basis is my legitimate interest in operating and securing the website (Art. 6(1)(f) GDPR). The logs are rotated daily. Your full IP address stays in them for one day at most. After that it is shortened and thereby anonymised. After 7 days the logs are deleted. I do not combine them with other data.

4. Contact and inquiry form

When you write to me using the form on the contact page, I process your name, your email address and your message. Where available, the chosen category, a selected package and your inquiry list from the shop are added. Name, email address and message are required, because otherwise I cannot reply. Everything else is optional.

The web server does not store your inquiry in a database. It passes it straight to the automation server run by webAION, which sits on the same server in Germany and does not store your inquiry. From there it is sent to my mailbox as an email, TLS-secured, via a sending mailbox that webAION holds with goneo Internet GmbH (Dresdener Straße 18, 32423 Minden, Germany). My mailbox is hosted by STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany), which processes my emails on my behalf.

The form protects itself against spam with its own means, without a captcha and without third-party services: a hidden field, a minimum fill-in time and a limit on inquiries per IP address. For this limit the server counts inquiries per IP address over a 10-minute window and keeps the IP address in memory for a short time. It does not write it to a file or database. The form's log only records technical events and contains none of the content of your inquiry. The legal basis is my legitimate interest in a working mailbox (Art. 6(1)(f) GDPR).

The legal basis for handling your inquiry is Art. 6(1)(b) GDPR if it is about a shooting, a bodypainting or a purchase (steps prior to entering into a contract). In all other cases it is my legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

I delete inquiries that do not lead to a booking once your request has been dealt with and no follow-up questions are to be expected. If a booking comes about, the statutory retention periods of six to ten years apply (§ 147 of the German Fiscal Code, AO).

5. Contact via WhatsApp, email and phone

The WhatsApp link on this website is a plain link. As long as you do not click it, no data goes to WhatsApp.

If you write to me on WhatsApp, you are using a service of WhatsApp Ireland Limited (Dublin, Ireland), which belongs to the Meta group. WhatsApp itself is the controller for the data processing within its service. Message contents are end-to-end encrypted. WhatsApp does, however, process metadata, for example who writes to whom and when, and may transfer data to the USA and to other countries outside the EU. You can find details in the WhatsApp privacy policy. I myself see your phone number, your profile name and your messages.

WhatsApp is a voluntary channel. If you prefer not to use it, you can reach me just as well by email or through the form.

If you send me an email or call me, I process the details you share with me, for example name, email address, phone number and your request. Emails are kept in my mailbox with the provider named in section 4. For the legal bases and retention, the same applies on all three channels as for the form.

6. Links to Instagram and Facebook

In the footer you will find links to my profiles on Instagram and Facebook. These are plain links, not embedded plugins. As long as you do not click, no data goes to these services. Only when you follow a link does the respective service learn about your visit there. Both services are provided by Meta Platforms Ireland Limited (Dublin, Ireland). The privacy notices of Instagram and Facebook apply there.

7. Local storage in your browser

This website sets no cookies. For three functions it places small entries in your browser's storage (web storage). These entries stay on your device, are not sent to the server automatically and contain no identifier that could be used to recognise you.

• lh-age-confirmed-18: the note that you have confirmed being of legal age in the Bodypainting and Sensual sections or for the art prints in the shop (localStorage). It only contains the time of your confirmation and makes sure the prompt does not reappear on every page view. It is valid for 30 days, after that I ask again.
• lh-inquiry-list: your inquiry list from the shop with motif, size, material, price and quantity (localStorage). It is only created once you add a motif to the list. It is only transmitted to me when you submit the inquiry form. After that it is deleted from your browser.
• lh-consent: your decision on whether you accepted or declined the visitor statistics, including the time (localStorage). This keeps the prompt from reappearing on every page view. The decision is valid for 12 months, after that I ask again.

These entries are strictly necessary to provide a function you have explicitly requested. Under § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) no consent is required for this. Where personal data is processed in the course of this, the legal basis is Art. 6(1)(f) GDPR. You can delete the entries at any time in your browser settings (clear site data).

8. Audience measurement

With your consent I use Umami to count which pages are visited and how often. Umami is open-source statistics software. It does not run at a third-party provider but is self-hosted on a server in Germany that webAION operates on my behalf (section 2). Umami sets no cookies.

The following is recorded: the page viewed, the time, the referring page, browser, operating system, device type, screen size, language and the country derived from the IP address. The IP address itself is not stored. To tell visits apart, Umami creates a hash value from the IP address, the browser identifier and a random value that changes regularly. This is a pseudonym from which neither your name nor your IP address can be read. If your browser sends the “Do Not Track” signal, Umami does not count your visit.

The statistics script is only loaded after you have agreed in the notice at the bottom of the page. The legal basis is your consent under § 25 (1) TDDDG and Art. 6(1)(a) GDPR. Declining has no disadvantage for you whatsoever. You can withdraw your consent at any time with effect for the future: via the “Privacy settings” link in the footer of every page. After you withdraw, the page reloads and the statistics script is no longer loaded.

I delete the statistics data as soon as I no longer need it for evaluation. That is the case after 24 months at the latest.I do not use advertising networks or any further analytics or tracking tools.

9. Fonts and external content

The fonts of this website (Cormorant and Inter) are served from its own server. Loading the pages creates no connection to Google Fonts or other third parties. The website does not embed any other third-party content either: no maps, no videos, no social media plugins.

10. Photos on this website

I only show photos in which people are recognisable if the people shown have consented to publication on this website; for children, their legal guardians (Art. 6(1)(a) GDPR, § 22 KUG, the German Art Copyright Act). If you appear in a picture and no longer want that, you can withdraw your consent at any time with effect for the future. A short message to email@laurahartung.de is enough. I will then take the picture off the website as quickly as possible.

11. Client reviews

On some pages I show excerpts from public Google reviews of my work, together with the name under which the review was published on Google, or an abbreviation of it. The details come from my publicly visible business profile on Google. The legal basis is my legitimate interest in showing genuine feedback to people who are interested (Art. 6(1)(f) GDPR). If you no longer want to see your review here, a short message is enough and I will remove it.

12. Recipients

Your data only goes to the service providers I need to run the website:

• webAION: operation and maintenance of the website (processor)
• dogado GmbH: data centre in Germany (sub-processor)
• STRATO GmbH: my email mailbox
• goneo Internet GmbH: sending mailbox used by webAION for form inquiries (sub-processor)

Beyond that I only pass on personal data if you have consented or if I am legally obliged to do so.

13. Retention at a glance

• Server logs: 7 days, the full IP address for one day at most
• Inquiries without a booking: until your request has been dealt with
• Inquiries with a booking: six to ten years under the statutory retention periods (§ 147 AO)
• Entries in your browser: depends on the entry, details in section 7
• Visitor statistics: until I no longer need the data (24 months at most)
• Photos and client reviews: until you withdraw consent or object

14. No transfers to third countries

The website itself does not transfer any personal data to countries outside the EU and the European Economic Area. The server is located in Germany, and my email provider is based in Germany. If you use WhatsApp or follow the links to Instagram and Facebook, the notes in sections 5 and 6 apply.

15. Your rights

You have the following rights towards me:

• Access to the data I hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

To exercise a right, an informal message to email@laurahartung.de is enough.

Withdrawing consent (Art. 7(3) GDPR)

You can withdraw any consent you have given me at any time with effect for the future. This applies, for example, to the publication of photos and the visitor statistics. Whatever happened up to the withdrawal remains lawful.

Right to lodge a complaint (Art. 77 GDPR)

You can lodge a complaint with a data protection supervisory authority, for example where you live. The authority responsible for me is:

State Commissioner for Data Protection of Lower Saxony
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
www.lfd.niedersachsen.de

16. Security

The website is delivered exclusively in encrypted form via HTTPS (SSL/TLS). You can tell by the padlock symbol and by https:// in your browser's address bar. Forwarding your form inquiry to my mailbox is TLS-secured as well.

17. Version and changes

Last updated: September 2026. I update this policy when the website or the legal situation changes. The version published here applies.