Cookie Policy
Last updated: 21 July 2026
Your photography shop will also need separate documents for the Impressum, terms and conditions, shipping, returns and the EU right of withdrawal.
1. Overview
This Privacy Policy explains how personal data is collected, used and protected when you visit [INSERT WEBSITE DOMAIN], contact me, purchase photographic work or otherwise interact with this website.
Personal data means any information relating to an identified or identifiable natural person, such as a name, email address, postal address, IP address or order information.
I process personal data in accordance with the General Data Protection Regulation—the GDPR—the German Federal Data Protection Act and the German Telecommunications Digital Services Data Protection Act, where applicable.
2. Data controller
The controller responsible for the processing of personal data through this website is:
Ruan Manoel Martins Barbosa
Artist, filmmaker and photographer
[INSERT POSTAL OR BUSINESS ADDRESS]
Augsburg, Germany
Email: [INSERT CONTACT EMAIL]
Website: [INSERT WEBSITE DOMAIN]
A data protection officer has not been appointed because there is currently no legal requirement to appoint one.
3. Legal bases for processing
Depending on the circumstances, personal data is processed on one or more of the following legal bases:
Consent, under Article 6(1)(a) GDPR, when you consent to optional cookies, analytics, embedded media or marketing communications.
Contractual necessity, under Article 6(1)(b) GDPR, when processing is necessary to answer a project enquiry, prepare an offer, fulfil an order or perform a contract.
Legal obligation, under Article 6(1)(c) GDPR, when information must be retained or disclosed for tax, accounting or other legal purposes.
Legitimate interests, under Article 6(1)(f) GDPR, when processing is necessary to operate, secure and improve the website, communicate with visitors or establish and defend legal claims.
Where processing is based on consent, consent may be withdrawn at any time with effect for the future.
4. Website hosting and Squarespace
This website is created and hosted using Squarespace.
When you visit the website, Squarespace may process technical information necessary to display, operate and protect the website. This information may include:
Your IP address
Browser type and browser version
Device and operating-system information
Language and regional settings
The pages you visit
The page that referred you to this website
The date and time of access
Information about errors, security events and website performance
Squarespace processes certain information on my behalf as a service provider and data processor. Squarespace may also process limited information independently for its own security, legal and service-related purposes.
The processing required to operate and secure the website is based on Article 6(1)(f) GDPR. My legitimate interest is the secure, reliable and technically functional presentation of my artistic work and services.
More information is available in Squarespace’s Privacy Policy and Data Processing Addendum.
5. International data transfers
Squarespace is an international service provider. As a result, personal data may be processed in countries outside the European Economic Area, including the United States.
Where required, Squarespace states that international transfers are protected through recognised safeguards, which may include adequacy decisions, the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
When another service provider transfers personal data outside the European Economic Area, the safeguards used by that provider will be described in its own privacy policy.
6. Server log data
Technical server information may be recorded automatically when you access this website. This processing is necessary to:
Deliver the website to your device
Detect and prevent attacks, fraud and misuse
Investigate technical problems
Maintain the security and stability of the website
Server information is not combined with other information for the purpose of identifying individual visitors unless this is necessary to investigate a security incident or comply with a legal obligation.
The legal basis is Article 6(1)(f) GDPR.
7. Cookies and similar technologies
This website uses cookies and similar technologies. Cookies are small pieces of information stored on or accessed from your device.
Necessary cookies
Necessary cookies support essential website functions, including:
Secure website delivery
Navigation
Shopping-cart functions
Checkout functions
Cookie-consent preferences
Customer-account functions, where enabled
Fraud prevention and website security
These technologies are used where they are technically necessary to provide a service requested by the visitor. They cannot always be disabled through the website.
The legal basis for related personal-data processing is Article 6(1)(f) GDPR. The storage of or access to information on your device is based on Section 25(2) TDDDG where the technology is strictly necessary.
Optional cookies
Analytics, performance, advertising or other optional cookies are used only after you provide consent through the cookie banner.
The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You can reject optional cookies or withdraw your consent at any time through the website’s cookie settings. Withdrawing consent does not affect processing that took place lawfully before withdrawal.
8. Squarespace Analytics
Subject to your cookie choice, this website may use Squarespace Analytics to understand how visitors use the website.
Analytics information may include:
Browser, network and device information
IP address
Approximate geographic location
Traffic source
Pages visited
Clicks and internal links
Searches
Scrolling activity
Date, time and duration of visits
Shopping-cart and checkout activity
This information helps me understand which artistic projects, photographs and services visitors are interested in and how the website can be improved.
Squarespace Analytics is used only after consent where consent is legally required. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
9. Contact enquiries
You may contact me by email or through a contact form on this website.
When you submit an enquiry, I may process:
Your name
Email address
Telephone number, where provided
Company or organisation
Project information
Dates, locations and budget information
Files or links you provide
The content of your message
Subsequent correspondence
This information is used to respond to your enquiry, discuss a potential artistic commission or service and manage the resulting professional relationship.
Where your message concerns a possible contract, the legal basis is Article 6(1)(b) GDPR. For general enquiries, the legal basis is Article 6(1)(f) GDPR.
Contact-form submissions may be processed and stored through Squarespace and may also be delivered to my email provider.
Enquiry information is normally deleted when it is no longer required, unless it becomes part of a contractual relationship or must be retained for legal purposes.
10. Purchasing photographs and other work
When you purchase a photograph, print, digital product or other item through this website, I process information necessary to complete the order.
This may include:
Your name
Billing address
Delivery address
Email address
Telephone number
Products purchased
Order value
Payment status
Delivery method
Customer messages
Refunds, returns or complaints
Tax and invoice information
The information is processed to confirm and fulfil your order, provide customer support, arrange delivery, process returns and comply with accounting and tax obligations.
Processing for order fulfilment is based on Article 6(1)(b) GDPR. Information retained to comply with tax and accounting requirements is processed under Article 6(1)(c) GDPR.
Squarespace receives the information necessary to provide the online shop, checkout and order-management functions.
11. Payment processing
Payments are processed by the payment provider selected during checkout. I do not normally receive your complete card number or security code.
The payment provider may process information such as:
Your name
Billing address
Email address
Payment amount
Payment method
Transaction identifiers
Device and security information
Information required for fraud prevention
The processing is necessary to complete your purchase under Article 6(1)(b) GDPR. Fraud-prevention processing may also be based on legitimate interests under Article 6(1)(f) GDPR.
Keep only the payment provider you use:
Squarespace Payments
Where Squarespace Payments is offered, payment information is processed through Squarespace and its payment and fraud-prevention partners, including Stripe and Sift.
Stripe
Where Stripe is offered, payment information is processed by Stripe as the payment service provider.
PayPal
Where PayPal is offered, you are redirected to or connected with PayPal. PayPal processes the payment under its own terms and privacy policy.
The selected payment provider’s privacy policy contains additional information about its processing, retention periods and international transfers.
12. Production and delivery of photographic prints
Keep this section if another company prints or fulfils your orders.
To produce and deliver photographic prints, I may share the information necessary to fulfil your order with:
[INSERT PRINTING OR FULFILMENT PROVIDER]
The shared information may include your name, delivery address, email address, telephone number and details of the product ordered.
The information is shared only to manufacture, package and deliver your purchase. The legal basis is Article 6(1)(b) GDPR.
Delete this section if you print and package every order yourself.
13. Postal and delivery services
For physical orders, delivery information may be provided to postal services or delivery companies, such as:
[INSERT DELIVERY PROVIDER, FOR EXAMPLE DHL OR DEUTSCHE POST]
This may include your name, address, email address, telephone number and shipment details.
The legal basis is Article 6(1)(b) GDPR.
14. Customer accounts
Keep this section only if customer accounts are enabled.
Visitors may have the option to create a customer account. When an account is created, the website may process:
Name
Email address
Billing and shipping addresses
Telephone number
Order history
Saved shopping-cart information
Account login and security information
This information is used to provide account functions, simplify future orders and offer customer support.
The legal basis is Article 6(1)(b) GDPR.
You may request the deletion of your customer account, subject to any information that must continue to be retained for legal or contractual purposes.
15. Order and account emails
When you place an order or create a customer account, you may receive service-related emails. These can include:
Order confirmations
Payment confirmations
Shipping notifications
Refund or cancellation information
Account creation messages
Password-reset messages
Important changes concerning an order or account
These messages are necessary to perform the contract or provide the requested account function. They are not marketing emails and cannot generally be unsubscribed from while the related transaction or account remains active.
Squarespace may send these communications on my behalf.
16. Abandoned-cart emails
Delete this section unless abandoned-cart recovery is enabled.
Where this feature is enabled, you may receive an email reminding you about an incomplete order after entering your email address during checkout.
The legal basis is your consent under Article 6(1)(a) GDPR or, where legally appropriate, my legitimate interest under Article 6(1)(f) GDPR.
You can unsubscribe using the link included in the message.
17. Embedded video and audiovisual work
This website may display films, trailers, showreels or other audiovisual work.
Videos uploaded directly to Squarespace
Where a video is hosted directly through Squarespace, the technical data described in the website-hosting section may be processed when the video is displayed or played.
YouTube
Keep this paragraph only if YouTube videos are embedded.
When you consent to and load a YouTube video, a connection may be established with YouTube or Google servers. YouTube may receive your IP address, browser and device information, the page you visited and information about your interaction with the video.
Where you are signed into a Google or YouTube account, the provider may associate your interaction with that account.
The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Vimeo
Keep this paragraph only if Vimeo videos are embedded.
When you consent to and load a Vimeo video, a connection may be established with Vimeo’s servers. Vimeo may receive your IP address, browser and device information, the page you visited and information about your interaction with the video.
The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Third-party videos should not be loaded before the required consent has been provided.
18. Social-media links
This website may contain links to my profiles on platforms such as Instagram, Vimeo, YouTube or LinkedIn.
When these are ordinary links, information is transmitted to the relevant platform only after you click the link and leave this website. The processing that subsequently occurs is controlled by the platform and is governed by its own privacy policy.
If a social-media feed, share button or interactive widget is embedded directly into the website, additional data may be transmitted when the element loads. Such elements should be blocked until the required consent has been provided.
19. Fonts
This website may use fonts supplied through Squarespace’s integrations with services such as Google Fonts or Adobe Fonts.
When externally supplied fonts are loaded, the provider may receive technical information including your IP address, browser and device details and the page you are viewing.
Where the font service is not technically necessary, it will be loaded only after consent. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
This section may be removed if all fonts are uploaded and served locally without a connection to an external font provider.
20. External links
The website may contain links to external websites, festivals, collaborators, galleries, clients, social networks or other third-party services.
I am not responsible for the processing of personal data on external websites. Please review the privacy information provided by the relevant website operator.
21. Recipients of personal data
Personal data may be shared with service providers where this is necessary to operate the website, respond to enquiries or complete an order.
Potential recipients include:
Squarespace
Payment providers
Printing and fulfilment providers
Postal and delivery companies
Email and communication providers
Tax advisers and accountants
Technical support providers
Public authorities, where disclosure is legally required
Legal advisers, where necessary to establish or defend legal claims
Service providers receive only the information necessary for their respective function.
22. Storage periods
Personal data is retained only for as long as necessary for the purpose for which it was collected.
In particular:
Technical and security information is retained for the period necessary to operate and protect the website.
Contact enquiries are retained while the enquiry or professional relationship remains active.
Unsuccessful project enquiries may be deleted after the communication has concluded, unless continued storage is justified.
Contract, order, invoice and payment records may be retained for the periods required by German tax and commercial law.
Consent records may be retained for as long as necessary to demonstrate that valid consent was obtained.
Information required for legal claims may be retained until the applicable limitation period has expired.
When there is no continuing legal basis or retention obligation, the information will be deleted or anonymised.
23. Your data-protection rights
Subject to the conditions established by law, you have the right to:
Request access to your personal data under Article 15 GDPR
Request correction of inaccurate information under Article 16 GDPR
Request deletion under Article 17 GDPR
Request restriction of processing under Article 18 GDPR
Receive certain information in a portable format under Article 20 GDPR
Object to processing based on legitimate interests under Article 21 GDPR
Withdraw consent at any time under Article 7(3) GDPR
Lodge a complaint with a data-protection supervisory authority under Article 77 GDPR
Where you object to processing for direct-marketing purposes, your personal data will no longer be processed for that purpose.
To exercise your rights, contact:
[INSERT CONTACT EMAIL]
I may need to request information necessary to confirm your identity before responding.
24. Supervisory authority
You have the right to lodge a complaint with a competent data-protection authority.
For a private business or self-employed professional based in Augsburg, the relevant authority will generally be:
Bavarian State Office for Data Protection Supervision
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany
You may also contact the supervisory authority in the EU member state where you live or work or where you believe a data-protection infringement occurred.
25. Security
Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.
The website uses encrypted HTTPS communication. Nevertheless, transmitting information over the internet can never be guaranteed to be completely secure.
Please avoid sending sensitive or confidential information through an ordinary contact form or unencrypted email unless this has been agreed in advance.
26. Changes to this Privacy Policy
This Privacy Policy may be updated when the website, shop, service providers or legal requirements change.
The current version will always be published on this page together with its revision date.