Privacy Policy

Controller and scope

The controller for this website is Maik Batzel, MaikB. Photography, Pfeifferhannsstraße 14, 01307 Dresden, Germany. Contact: booking@maikbatzel.com or +49 (162) 3255997.

This policy covers visiting the website, contacting me, submitting photoshoot enquiries and the optional Google Analytics and Mapbox services. Processing is governed in particular by the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Website operation and server logs

Accessing the website involves processing connection information such as your IP address, requested pages and files, access time, browser and operating system, and where applicable the referring page. Hosting systems may record this information in server logs.

Processing serves website delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is secure and reliable website operation. Technical hosting providers may receive this data. Logs should only be retained while required for these purposes; specific security incidents may require longer retention for investigation.

Processing, recipients and retention

I process personal data to handle your requests, prepare and carry out photoshoots, operate the website securely and, with your consent, provide the optional services described below. Hosting, database and email providers may support technical delivery. Where providers process data on instructions, the requirements of Article 28 GDPR apply.

Enquiry and correspondence data are deleted when their purpose no longer applies, unless statutory retention obligations or evidence necessary to establish, exercise or defend legal claims require further retention. Contractual and tax-related records, where applicable, are subject to the relevant statutory retention periods. Specific storage arrangements are explained below.

This website does not make solely automated decisions with legal or similarly significant effects. Calendar availability and price calculations do not replace personal confirmation of a photoshoot.

Contact by email, telephone and contact form

When you contact me by email or telephone, I process your contact details and message to answer your enquiry and address follow-up questions. Enquiries about a photoshoot or possible collaboration are processed under Article 6(1)(b) GDPR as pre-contractual measures. Other correspondence is processed under Article 6(1)(f) GDPR; my legitimate interest is responding to communications addressed to me.

The “Say Hello” contact form requests your name, email address and message. It currently does not submit these entries directly to the website server. Selecting “Prepare email” passes them to your email application. I receive the message only when you send it there. Your own email provider processes data under its own privacy terms. Incoming emails are stored in my mailbox for handling your enquiry.

Providing information is voluntary; without sufficient contact details I may be unable to reply. Contacting me does not subscribe you to advertising or a newsletter. The purpose-based and statutory retention criteria above apply.

“Request your photo shoot” form

Submitting the photoshoot form transfers your information to the website server and stores it in the booking database. This includes your name and email address, preferred date, shooting location, image count and extras, and, if supplied, shooting categories, Instagram name and notes. Language, enquiry reference, processing status, timestamps and the associated price calculation are also stored.

Processing serves checking, calculating, coordinating and handling your non-binding enquiry under Article 6(1)(b) GDPR. Required information is needed to process the request; additional information is voluntary. Please include only information relevant to your enquiry in free-text fields.

Public calendar responses contain only dates and availability status. Names, email addresses, messages and other enquiry details are not published through these responses. The application does not pass your form contents to Google Analytics or Mapbox.

Requests are temporarily counted to prevent abuse. When operated behind an appropriately configured trusted proxy, an IP-derived identifier may be used in memory for this purpose. The counting window is 15 minutes. The legal basis is Article 6(1)(f) GDPR, with the legitimate interest of protecting the form against automated misuse. The general retention criteria above apply to enquiry records.

Cookies, browser storage and consent

Your language selection is stored in the maikbatzel-language cookie for up to one year and in local browser storage under maikbatzel-language. Your Analytics preference is stored under maikbatzel-analytics-consent. Local storage has no built-in expiry and remains until deleted in your browser. If local storage is unavailable, the Analytics preference is held only for the current visit.

These records serve your chosen language and privacy preferences. Where strictly necessary for these purposes, storage and access rely on section 25(2)(2) TDDDG; associated personal data processing relies on Article 6(1)(f) GDPR. Optional analytics and mapping services are activated separately and only with your respective consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.

You can change or withdraw your Analytics consent at any time in Cookie settings, effective for the future. Mapbox has a separate activation on the contact page and is not enabled by “Accept all” in the Analytics dialog. You can also delete cookies and local storage in your browser.

Google Analytics 4

With your consent, I use Google Analytics 4 to analyse website usage statistically. The provider for the European region is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC and other technical providers may also process data, particularly in the USA. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. This website does not load Analytics without consent.

Data may include page views, usage and session information, browser and device details, approximate location and pseudonymous identifiers. IP addresses are processed for communication and approximate geolocation; according to Google, individual IP addresses of EU users are not logged or stored in Analytics. This does not mean that all analytics data are anonymous.

This integration disables Google Signals and advertising personalisation signals. Manually transmitted page views omit URL query strings and fragment identifiers. The application does not transmit names, email addresses or messages from the forms as Analytics content.

Analytics may use cookies including _ga and _ga_…. Google states a default lifetime of two years; browser restrictions or settings can shorten the actual lifetime. Retention of user- and event-level data at Google depends on the Analytics property's deletion and retention settings and differs from cookie lifetime. Standard properties allow two or 14 months; aggregated reports are not subject to these periods in the same way.

Transfers outside the European Economic Area are subject to Articles 44 et seq. GDPR. Information about Google’s contractual privacy and transfer arrangements is available in its Data Processing Terms. Further information: Google Privacy Policy and Analytics data retention.

You can withdraw consent at any time in Cookie settings. The website then disables Analytics collection and deletes accessible Analytics cookies. Withdrawal does not affect the lawfulness of previous processing.

Mapbox on the contact page

The optional map uses Mapbox GL JS by Mapbox, Inc., USA, to display the location in Dresden. A connection to Mapbox is established only after you select “Load map”. Consent to the processing described there is voluntary; you can contact me without enabling the map. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG.

Loading the map allows Mapbox to process IP addresses, browser and device information, requested map data, usage data and identifiers for service delivery, billing and security. The map module may use local storage and browser caches for these purposes. The map uses predefined coordinates; this website does not request your device’s GPS location through the map.

Data may be processed in the USA. Mapbox describes safeguards for international transfers, including contractual guarantees, in its Data Processing Addendum. According to Mapbox, IP addresses are generally retained for 30 days; security, fraud or abuse investigations may require longer retention. Details: Mapbox Privacy Policy and Privacy FAQ.

You can withdraw your activation at any time by selecting “Disable map” on the contact page, effective for the future. This removes the map. Activation is not stored permanently; reloading the page requires activating the map again. This does not retrospectively delete data already transmitted. The external location link opens another provider only when you select it.

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You may withdraw consent at any time, effective for the future (Article 7(3)). Contact me using the details above to exercise your rights.

Where processing relies on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR. I will then stop processing the affected data unless overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims require otherwise.

You may also lodge a complaint with a supervisory authority under Article 77 GDPR, particularly where you live or work or where the suspected infringement occurred. In Saxony, you can contact the Saxon Data Protection and Transparency Commissioner.