Privacy Policy

Legally Binding Version

This Privacy Policy is provided in English for informational purposes only. The German version of this Privacy Policy is the legally binding version. In case of discrepancies or interpretation issues, the German version shall prevail.

Introduction and General Information

This privacy policy (as of March 2026) provides a transparent overview of how I, as the data controller, process personal data and how data may be processed by service providers working on my behalf.

I am subject to German data protection law and the requirements of the European General Data Protection Regulation (GDPR).

Additional privacy notices or legal documents may apply to specific services, tools, or activities.

Controller

Alina Henkel
Ludolfingerweg 57h
13465 Berlin
Germany

Email: alinahenkel17@gmail.com
Phone: +49 176 30782810

Scope of this Privacy Policy

This privacy policy applies to all of my online presences including my website and my social media profiles:

Instagram
https://www.instagram.com/alinahenkel_photography/

Facebook
https://www.facebook.com/people/Alina-Henkel-Photography/61584183595728

TikTok
https://www.tiktok.com/@alinahenkel_photography

Pinterest
https://pin.it/3EDfZXj2J

Terms and Legal Bases

Personal data means any information that can be used to directly or indirectly identify you ("data subject").

In particular, I process information that you voluntarily provide when contacting me, for example via postal mail, email, contact form or telephone.

This may include your name, email address, phone number or other details related to your inquiry. Such information may be stored in digital systems or address management tools.

Personal data is processed only if at least one of the following legal bases applies:

Art. 6 (1) lit. a GDPR – Consent
Processing based on your consent. If you consent to the storage of cookies or access to information on your device (for example via device fingerprinting), processing may also take place on the basis of § 25 (1) TDDDG. Consent can be withdrawn at any time.

Art. 6 (1) lit. b GDPR – Contract performance
Processing necessary for the performance of a contract or for pre-contractual measures.

Art. 6 (1) lit. c GDPR – Legal obligation.

Art. 6 (1) lit. d GDPR – Protection of vital interests.

Art. 6 (1) lit. e GDPR – Public interest.

Art. 6 (1) lit. f GDPR – Legitimate interests
Legitimate interests include in particular my interest in operating my website and business activities in a secure, user-friendly and reliable way. This includes communication with clients, ensuring IT security, preventing misuse and enforcing legal claims.

Type, Scope, Purpose and Duration of Data Processing

The personal data processed may include contact and identification data, browser and device data, content data, metadata and usage data, location data and payment data.

Personal data is only stored for as long as necessary for the respective purpose or as required by law. Data that is no longer required will be deleted or anonymized.

Personal data may be processed by third-party service providers working on my behalf. These providers support me in operating my website, communication or marketing activities.

If you transmit personal data of third parties to me, you are responsible for ensuring that such transmission is legally permitted.

I may also process personal data obtained from publicly available sources or from third parties where legally permitted.

Rights of Data Subjects

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR)
You may request information about the personal data I process about you.

Right to rectification (Art. 16 GDPR)
You may request correction of inaccurate or incomplete personal data.

Right to erasure (Art. 17 GDPR)
You may request deletion of your stored personal data unless legal obligations require further processing.

Right to restriction of processing (Art. 18 GDPR)

Right to data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR)
You may object to the processing of your personal data if it is based on legitimate interests.

Right to withdraw consent (Art. 7 (3) GDPR)
You may withdraw your consent at any time with effect for the future.

Right to lodge a complaint (Art. 77 GDPR)
You have the right to file a complaint with a data protection authority.

Data Transfers to the USA and Other Third Countries

Some services used on this website are provided by companies based in the United States or other countries outside the European Union. These countries may not offer the same level of data protection as the EU.

If data is transferred to the United States, this may occur based on certification under the EU-US Data Privacy Framework or based on Standard Contractual Clauses approved by the European Commission.

Where possible, I try to use service providers within the EU or providers offering EU-based server locations.

Data Security

I implement appropriate technical and organizational security measures to protect personal data. However, absolute security cannot be guaranteed.

My website uses SSL/TLS encryption (HTTPS) to ensure secure data transmission.

Contact via Email, Phone, Messenger or Contact Form

If you contact me via email, phone, messenger or contact form, the information you provide (such as name, email address, phone number and the content of your message) will be processed for the purpose of handling your request.

This processing is based on Art. 6 (1) lit. b GDPR (contract or pre-contractual communication), Art. 6 (1) lit. f GDPR (legitimate interest in responding to inquiries) or Art. 6 (1) lit. a GDPR (consent).

The data you provide will remain stored until the purpose for storage no longer applies or you request deletion, unless legal retention obligations require otherwise.

Zoom

I use the video conferencing service Zoom. The provider is Zoom Video Communications Inc., San Jose, California, USA.

If you participate in a Zoom meeting with me, certain personal data may be processed on Zoom servers. This may include your IP address, device information, usage data, meeting metadata (such as time, duration and participants) as well as audio, video, screen sharing or chat content.

If enabled, Zoom may offer artificial intelligence features such as automatic transcription, summaries, translations or subtitles. These functions may automatically analyze meeting content.

Processing is based on Art. 6 (1) lit. b GDPR, Art. 6 (1) lit. f GDPR or Art. 6 (1) lit. a GDPR.

Data may be transferred to the United States. Zoom is certified under the EU-US Data Privacy Framework.

Further information: https://explore.zoom.us/privacy/

Facebook

I maintain a profile on Facebook. The provider is Meta Platforms Ireland Limited, Dublin, Ireland.

When visiting my Facebook profile, personal data may be processed by Meta. This may occur even if you do not have a Facebook account.

The collected data may include your IP address, usage data or profile information. Meta may use this information to create user profiles and display personalized advertising.

I have no influence on Meta's data processing activities.

Data may be transferred to the United States. Meta relies on Standard Contractual Clauses and is certified under the EU-US Data Privacy Framework.

More information: https://www.facebook.com/privacy/policy/

Instagram

I maintain a profile on Instagram. The provider is Meta Platforms Ireland Limited, Dublin, Ireland.

When visiting my Instagram profile, Meta may process personal data such as IP address, usage behavior and profile data. This data may be used to create user profiles and deliver personalized advertising.

I have no control over Meta's data processing.

More information: https://privacycenter.instagram.com/policy

TikTok

I maintain a profile on TikTok.

Providers are TikTok Technology Limited, Dublin, Ireland, and TikTok Information Technologies UK Limited, London, United Kingdom.

When visiting my TikTok profile, TikTok may process personal data such as IP address, device information, usage data, location data and profile information.

TikTok may use this information to create user profiles and display personalized advertising.

Processing is based on Art. 6 (1) lit. f GDPR (legitimate interest in maintaining a presence on social media) or Art. 6 (1) lit. a GDPR if consent has been given.

More information: https://www.tiktok.com/legal/privacy-policy

Cookie Consent Tool (Webnode)

My website uses a cookie consent tool provided by my website provider Webnode.

Provider: Webnode AG, Zug, Switzerland.

The tool allows me to obtain and document your consent to the use of cookies or other technologies.

When you visit my website, a cookie is stored that records your consent or withdrawal of consent.

The use of this tool is required to comply with legal obligations under Art. 6 (1) lit. c GDPR.

More information: https://www.webnode.com/privacy-policy/

Google Maps

My website uses Google Maps, a map service provided by Google Ireland Limited, Dublin, Ireland.

To use Google Maps, your IP address must be processed. Google may also load Google Fonts to display maps correctly.

Data may be transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework.

More information: https://policies.google.com/privacy

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited.

Google Analytics allows me to analyze visitor behavior on my website, including page views, time spent on pages, clicks and technical information about devices.

These data may be transferred to Google servers in the United States.

Google Analytics is used only with your consent in accordance with Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG.

More information: https://support.google.com/analytics

Google Tag Manager

This website uses Google Tag Manager. Google Tag Manager is a management tool that allows website tags and tracking codes to be integrated and managed centrally.

The tool itself does not create user profiles but manages other tracking tools.

When using Google Tag Manager, your IP address may be processed.

Processing is based on Art. 6 (1) lit. f GDPR or Art. 6 (1) lit. a GDPR if consent is required.