PRIVACY POLICY

Last Updated: 05.10.2026

1. Scope

This Privacy Policy explains how personal data is processed when you visit www.spectrum-imagery.com, use its contact or newsletter forms, create a customer account, place an order, submit a withdrawal, or otherwise interact with Spectrum Imagery.

This Privacy Policy supplements the separate Cookie Policy available on the Website.

2. Controller

The controller responsible for the processing of personal data on this Website is:

Phillip M. Greißel, sole proprietor
Trading as Spectrum Imagery / Phillip Greissel Photographie
Nürnberger Straße 168
91052 Erlangen
Germany

Email: privacy@spectrum-imagery.com

Spectrum Imagery is a business name and not a separate legal entity.

3. General Information About Data Processing

Personal data is any information relating to an identified or identifiable individual. Depending on how you use the Website, the processed data may include:

  • Identification and contact information, such as your name, email address, telephone number, billing address, and delivery address.

  • Account and authentication information.

  • Order, product, delivery, payment-status, and transaction information.

  • Information submitted through contact, newsletter, or withdrawal forms.

  • Technical information, such as your IP address, browser, device, operating system, referring page, requested pages, access time, and security or error data.

  • Consent and communication records.

Personal data is primarily collected directly from you. Certain transaction or status information may also be received from payment, fulfilment, email, and automation providers.

Personal data is not sold or rented to third parties.

4. Website Hosting and Technical Operation

The Website is hosted and operated through Squarespace Ireland Limited and affiliated Squarespace companies.

When the Website is accessed, Squarespace and its technical service providers may process information including:

  • IP address.

  • Date and time of access.

  • Requested page or file.

  • Referring URL.

  • Browser type and version.

  • Operating system and device information.

  • Security, diagnostic, and error information.

This processing is necessary to deliver the Website, maintain its stability and security, prevent misuse, and diagnose technical errors.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure, reliable, and efficient operation of the Website. Where processing is necessary to provide a function expressly requested by the visitor, Article 6(1)(b) GDPR may also apply.

Access to or storage of information on a visitor’s device that is strictly necessary for these purposes is based on Section 25(2) TDDDG.

Squarespace also provides the Website’s content-delivery, image-hosting, native video, form, customer-account, commerce, and checkout infrastructure.

Further information is available in the Squarespace Privacy Policy.

5. Cookies and Squarespace Analytics

The Website uses cookies and similar storage technologies.

Strictly necessary technologies are used to operate functions such as security, cookie preferences, forms, customer accounts, shopping carts, checkout, order-status pages, and the Squarespace video player.

Optional Squarespace Analytics cookies are used only after consent has been given. They help measure visits and understand how the Website is used.

The legal bases for optional analytics are:

  • Section 25(1) TDDDG for storing or accessing information on a visitor’s device.

  • Article 6(1)(a) GDPR for the subsequent processing of personal data.

Consent can be withdrawn at any time through the Cookie Preferences control available at the bottom of the Website. Withdrawing consent does not affect processing carried out before the withdrawal.

Further information, including the technologies used and their storage periods, is provided in the separate Cookie Policy.

6. Contact and General Enquiries

When you contact me through a contact form or by email, I process the information you provide. This may include your name, email address, message, attachments, and any other information included in your enquiry.

The data is processed to answer your enquiry and manage any subsequent communication.

The legal basis is:

  • Article 6(1)(b) GDPR where the enquiry relates to an existing contract or steps requested before entering into a contract.

  • Article 6(1)(f) GDPR for other enquiries. The legitimate interest is responding to communications concerning the Website, photography, products, licensing, or services.

Forms are processed through Squarespace. Business email communications may be processed through Google Workspace or Gmail, provided by Google Ireland Limited and affiliated Google companies.

Further information is available in the Google Privacy Policy.

7. Newsletter

Visitors can subscribe to receive information about new photographs, blog posts, products, or other Spectrum Imagery updates.

The processed information includes:

  • Email address.

  • Name, if requested or voluntarily provided.

  • Date and time of registration or confirmation.

  • Technical information required to document the subscription and consent.

Newsletter subscriptions and delivery are managed using Squarespace Email Campaigns.

A confirmation email is sent after registration. The subscription becomes active only after the email address has been confirmed.

The legal basis for sending the newsletter is consent under Article 6(1)(a) GDPR and, where applicable, the requirements governing electronic advertising under Section 7 UWG.

Consent may be withdrawn at any time by using the unsubscribe link or contacting privacy@spectrum-imagery.com. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Limited information concerning the subscription, withdrawal, or suppression of an email address may be retained under Article 6(1)(f) GDPR to document consent, demonstrate legal compliance, and ensure that no further newsletter is sent after an objection.

Operational emails concerning an order, customer account, withdrawal, or other transaction are not newsletters and may still be sent where necessary to perform a contract or comply with legal obligations.

8. Online Shop, Orders, and Customer Accounts

When you use the online shop, place an order, or create a customer account, the following information may be processed:

  • Name and contact information.

  • Billing and delivery address.

  • Email address and, where required for delivery, telephone number.

  • Products, quantities, configurations, prices, and order number.

  • Payment method, payment status, and transaction identifiers.

  • Delivery, fulfilment, return, withdrawal, and support information.

  • Customer-account and authentication information.

  • Communications relating to the order.

The data is processed to provide the shopping cart and checkout, create and manage an account, conclude and perform the purchase contract, process payment, produce and deliver the order, provide order-status information, handle returns or complaints, and prevent misuse or fraud.

The legal bases are:

  • Article 6(1)(b) GDPR for concluding and performing the contract.

  • Article 6(1)(c) GDPR for tax, accounting, consumer-protection, and commercial-law obligations.

  • Article 6(1)(f) GDPR for fraud prevention, IT security, and the establishment, exercise, or defence of legal claims.

Squarespace processes the shop, account, checkout, and order data required to provide these functions.

Fields marked as mandatory are required to complete the relevant transaction. Without this information, an order or customer account may not be created or performed.

9. Payment Through PayPal

PayPal is available as a payment method.

When you select PayPal, information required to initiate and process the payment may be transmitted to PayPal directly or through the Squarespace checkout. This may include your name, email address, billing information, order amount, currency, transaction identifiers, and technical information.

I normally receive confirmation of the payment, payment status, transaction identifier, payer information made available by PayPal, and other information required for order processing. I do not receive your PayPal password or full payment credentials.

PayPal generally processes payment data as an independent controller and may carry out identity, fraud-prevention, regulatory, or compliance checks under its own legal obligations.

The transmission of data required for the payment is based on Article 6(1)(b) GDPR. Tax and accounting records are processed under Article 6(1)(c) GDPR. Fraud-prevention measures may also be based on Article 6(1)(f) GDPR.

The provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg

Further information is available in the PayPal Privacy Statement.

10. Print Production, Fulfilment, and Delivery Through WhiteWall

Orders for photographic products may be produced and shipped through:

WhiteWall Media GmbH
Europaallee 59
50226 Frechen
Germany

To produce and deliver an order, the information required for fulfilment may be transferred to WhiteWall. Depending on the order, this may include:

  • Recipient name.

  • Delivery address.

  • Order and product information.

  • Product configuration and production details.

  • Order reference.

  • Email address or telephone number where required for delivery or order communication.

The transfer is based on Article 6(1)(b) GDPR because it is necessary to manufacture and deliver the ordered product.

WhiteWall or a delivery provider engaged for fulfilment may process delivery information for shipment tracking and delivery. WhiteWall may process certain information under its own legal obligations.

Further information is available in the WhiteWall Privacy Policy.

11. Withdrawal Form and Automated Confirmation

The Website provides an online form through which customers can exercise a right of withdrawal.

The withdrawal form may collect:

  • First and last name.

  • Email address.

  • Order number.

  • Products to which the withdrawal relates.

  • Date and time of submission.

  • Other information voluntarily provided in the form.

The information is processed to identify the relevant order, record and process the withdrawal, comply with consumer-protection obligations, and send confirmation that the withdrawal was received.

The submission is initially processed through Squarespace. An automation provided by Zapier, Inc. may transfer the submitted information to Gmail or Google Workspace so that an automatic confirmation email can be sent. The submission may therefore also appear in the relevant Squarespace form storage, Zapier task history, and email account.

The legal bases are Article 6(1)(b) GDPR for handling the withdrawal from the purchase contract and Article 6(1)(c) GDPR for compliance with applicable consumer-protection obligations.

Zapier only forwards the information and triggers the confirmation email. The workflow does not make a decision concerning the validity or legal effect of the withdrawal.

Further information is available in the Zapier Privacy Policy, the Zapier Data Processing Addendum, and the Google Privacy Policy.

12. Google reCAPTCHA

Squarespace forms may use Google reCAPTCHA to protect against automated submissions, spam, and misuse.

Google reCAPTCHA may process information such as:

  • IP address.

  • Referring page.

  • Browser and device information.

  • Date, time, and duration of access.

  • Mouse movements, keystrokes, or other interaction data used to distinguish human users from automated systems.

  • Existing Google cookies or identifiers, where applicable.

The provider for users in the European Economic Area is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The processing of personal data for protecting forms is based on Article 6(1)(f) GDPR. The legitimate interests are preventing spam, protecting the Website, and ensuring the availability and integrity of its forms.

Where storing or accessing information on a visitor’s device requires consent, the legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. Further information is provided in the Cookie Policy.

Google and affiliated companies may process information outside the European Economic Area as described in Section 16 below.

Further information is available in the Google Privacy Policy and Google Terms of Service.

13. Ko-fi

The Website provides access to a Ko-fi page where visitors may voluntarily support the project.

When Ko-fi is provided as a standard external link, no connection with Ko-fi is established merely by displaying that link. A connection is established when the link is followed.

Ko-fi is operated by Ko-fi Labs Limited. When you support Spectrum Imagery through Ko-fi, Ko-fi and the payment provider selected there may process and share information such as:

  • Your name, username, or email address.

  • Your message.

  • The amount and date of the support.

  • Payment status and transaction information.

  • Delivery information if a product is purchased through Ko-fi.

Information made available to me is processed to acknowledge or administer the support, respond to messages, fulfil any associated transaction, maintain accounting records, and comply with legal obligations.

The legal bases are Article 6(1)(b), Article 6(1)(c), and, where applicable, Article 6(1)(f) GDPR.

Further information is available in the Ko-fi Privacy Policy.

14. External Links, Social Media, Maps, and Videos

The Website contains standard links to external websites, social-media platforms, and other services.

Displaying a standard link does not normally transmit personal data to the external provider. When you follow the link, the external provider receives technical information associated with your visit and processes it under its own privacy policy.

Some blog posts use static map images hosted through Squarespace. Displaying these static images does not establish a connection with Google Maps. A connection with Google is established only when you follow the relevant link and open the interactive map on Google Maps.

Videos uploaded directly to Squarespace are delivered through Squarespace’s infrastructure. Associated storage technologies and player preferences are described in the Cookie Policy.

No third-party map or video content is intentionally configured to load automatically without any consent required by law.

15. Recipients of Personal Data

Personal data may be disclosed to the following categories of recipients where necessary:

  • Squarespace and its subprocessors for hosting, forms, analytics, customer accounts, and commerce.

  • Google for business email and form-security services.

  • Zapier for the withdrawal-confirmation automation.

  • PayPal for payment processing.

  • WhiteWall and delivery providers for production and fulfilment.

  • Ko-fi and its payment providers when Ko-fi is used.

  • IT, communications, accounting, legal, or tax advisers where necessary.

  • Public authorities, courts, or other bodies where disclosure is legally required.

  • Other recipients where you have expressly consented to the disclosure.

Service providers acting as processors are required to process personal data only on documented instructions and to apply appropriate safeguards, insofar as required by law.

16. International Data Transfers

Some service providers or their subprocessors may process personal data outside Germany or outside the European Economic Area, including in the United States.

Where personal data is transferred to a country outside the European Economic Area, the transfer is based on an appropriate legal mechanism, such as:

  • An adequacy decision adopted by the European Commission.

  • Participation by the recipient in the EU-U.S. Data Privacy Framework, where applicable.

  • Standard Contractual Clauses adopted by the European Commission.

  • Additional technical and organisational safeguards where required.

  • Another lawful derogation or transfer mechanism under Chapter V GDPR.

Squarespace and Zapier provide contractual data-processing terms that include safeguards for international transfers. Further information may be requested through privacy@spectrum-imagery.com.

17. Data Retention

Personal data is retained only for as long as necessary for the relevant purpose or as required by law.

The following general periods or criteria apply:

  • Technical and security data: Retained for the period necessary to operate, secure, and diagnose the Website, according to the applicable provider settings and security requirements.

  • Contact enquiries: Retained until the enquiry has been resolved. Information may be retained longer where required for contractual documentation, legal claims, or statutory record-keeping.

  • Newsletter data: Retained until consent is withdrawn. Limited consent and suppression records may be retained afterwards to demonstrate compliance and ensure that no further newsletter is sent.

  • Customer accounts: Retained while the account remains active and deleted following an effective deletion request, except where particular transaction records remain subject to legal retention requirements.

  • Orders, invoices, and payments: Retained for the applicable statutory period. Under German tax and commercial law, this may generally be six years for business correspondence, eight years for booking documents, and ten years for certain books, records, and financial statements.

  • Withdrawal and return records: Retained with the relevant order records for the period necessary to document the transaction, fulfil legal obligations, and defend legal claims.

  • Zapier workflow information: Retained only for the period made available under the applicable account settings and required to operate or troubleshoot the workflow.

  • Ko-fi transaction records: Retained for the relevant accounting, tax, or legal retention period.

Once the applicable purpose and retention periods have expired, the data is deleted or anonymised unless continued storage is legally permitted or required. Deletion from backup systems may occur during the providers’ ordinary backup-rotation cycles.

18. Your Rights

Subject to the applicable legal requirements, you have the right to:

  • Obtain information about whether and how your personal data is processed.

  • Request access to your personal data.

  • Request correction of inaccurate or incomplete information.

  • Request deletion of your personal data.

  • Request restriction of processing.

  • Receive data you provided in a structured, commonly used, machine-readable format where the right to data portability applies.

  • Have eligible data transmitted directly to another controller where technically feasible.

  • Withdraw consent at any time with effect for the future.

  • Object to processing based on legitimate interests.

  • Lodge a complaint with a data-protection supervisory authority.

Requests can be submitted to privacy@spectrum-imagery.com.

Reasonable information may be requested to verify your identity and prevent personal data from being disclosed to an unauthorised person.

19. Right to Object

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

Following an objection, the relevant data will no longer be processed unless compelling legitimate grounds for the processing override your interests, rights, and freedoms, or the processing is required for the establishment, exercise, or defence of legal claims.

You may object to the processing of personal data for direct-marketing purposes at any time. If you object, the data will no longer be used for direct marketing.

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a data-protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

The supervisory authority responsible for private businesses based in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

Submit an online data-protection complaint

21. Required Data and Automated Decision-Making

Providing personal data is generally voluntary.

Information marked as mandatory during checkout, account registration, payment, delivery, or withdrawal processing is required to perform the requested transaction or comply with legal obligations. Without the required information, the relevant service or transaction may not be completed.

The newsletter and general contact options are voluntary.

No solely automated decision-making, including profiling, within the meaning of Article 22 GDPR is used. Automated emails or data transfers, such as the withdrawal confirmation, do not determine legal rights or produce comparable significant effects.

22. Data Security

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful loss, alteration, disclosure, destruction, or unauthorised access.

The Website uses encrypted HTTPS connections. Nevertheless, no internet transmission or electronic storage system can guarantee absolute security.

23. Children

The Website is not specifically directed at children under the age of 16, and personal data is not knowingly collected from children without the consent or other authorisation required by law.

If you believe that a child has provided personal data without the required authorisation, please contact privacy@spectrum-imagery.com.

24. Changes to This Privacy Policy

This Privacy Policy may be updated when the Website’s functions, service providers, business processes, or legal requirements change.

The current version and revision date will be published on this page. Changes to this Privacy Policy do not replace any consent that is legally required for a particular processing activity.

Return to Home