Privacy Policy

The party responsible for data processing on this website is:

More details about the provider can be found in the legal notice (Impressum).

We only process personal data when data protection law (the GDPR) allows it. This overview shows what we use data for and what we rely on:

• Providing the website and keeping it secure (server log files): legitimate interest, Art. 6(1)(f) GDPR.
• Answering your enquiry through the contact form: an enquiry about a possible contract, Art. 6(1)(b) GDPR, plus your consent via the tick box in the form, Art. 6(1)(a) GDPR.
• Protecting the contact form from spam and abuse (hidden field, limit on submissions, Google reCAPTCHA): legitimate interest, Art. 6(1)(f) GDPR.
• Measuring how the website is used (Umami): legitimate interest, Art. 6(1)(f) GDPR. We want to understand which content is used so we can improve the site.
• Measuring advertising (Meta Pixel): only with your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
• Remembering your cookie choice in your browser: technically necessary, Section 25(2) no. 2 TDDDG.
• Showing photos and testimonials of clients: consent of the people pictured or named, Art. 6(1)(a) GDPR.
• Keeping business correspondence and records: legal obligation, Art. 6(1)(c) GDPR.

Every time you open this website, technical data is transmitted automatically and stored in log files on the server. This is needed for the page to be displayed at all, and it serves security and stability. It consists of:

• your IP address
• the date and time of the request
• the page or file requested
• the amount of data transferred and the status code of the response
• your browser and operating system
• the page you came from

Our website is hosted by netcup GmbH, with servers in Nuremberg (Germany). The domain runs through Cloudflare: your requests first go to Cloudflare, which fends off attacks and speeds up the site, and are then passed on to our server. Cloudflare also processes technical connection data such as your IP address in the process.

We do not combine this data with other data and only look at it to fix errors and defend against attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in running the website securely and reliably.

When you write to us through the contact form, we process what you enter there:

• Name (required)
• Email address (required)
• Phone number (optional)
• Preferred date (optional)
• Type of shoot, for example wedding or baby shoot (required)
• Your message (required)
• Your consent to this data being processed (tick box in the form)

We use this information only to answer your enquiry and, where appropriate, to prepare an appointment or contract with you.

The form is delivered to us by email through the service Resend (Resend, Inc., USA). Resend acts as a technical service provider on our behalf. Your details are not stored in a database on our website itself.

Spam protection: the form has a hidden field that only spam robots fill in, and it allows only three messages per IP address within 30 minutes. For this, our server keeps your IP address in memory for at most 30 minutes. We also use Google reCAPTCHA v3. It is loaded only on the contact page and checks in the background whether the entry comes from a human. In doing so, Google (Google Ireland Limited, Ireland; parent company Google LLC, USA) receives, among other things, your IP address and information about your device and your behaviour on the page, and may set cookies.

Legal bases: Art. 6(1)(b) GDPR (your enquiry about a possible contract) and your consent under Art. 6(1)(a) GDPR, which you give with the tick box in the form. Spam protection relies on Art. 6(1)(f) GDPR (our interest in an abuse-free form). You can withdraw your consent at any time with effect for the future, informally by email to contact@ibejiphotography.com.

We use Umami to measure how our website is used, for example which pages are viewed and on what type of device. We run Umami ourselves (self-hosted), so there is no external analytics provider that receives data.

Umami sets no cookies and stores no information on your device. Your IP address is not stored. Only an anonymous value is calculated from technical details; it changes regularly and cannot be traced back to you as a person.

Because Umami neither sets cookies nor stores information on your device, we do not need consent for it under Section 25 TDDDG. That is why you see no cookie banner for visit measurement.

The legal basis is Art. 6(1)(f) GDPR, our interest in improving the website. You can object to the measurement at any time, see “Your rights”.

This website does not set cookies itself. The exceptions are the two services described here: the Meta Pixel (only with your consent) and Google reCAPTCHA on the contact page (see “Contact form”).

In your browser’s local storage we keep a single entry (“ibeji-consent-marketing”) that remembers whether you accepted or declined the Meta Pixel. It is technically necessary so that we can respect your decision (Section 25(2) no. 2 TDDDG) and contains no personal data.

Fonts: we serve the fonts used on this website from our own server. No connection to Google Fonts is made.

Meta Pixel (only with your consent)

With your consent we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). The pixel is only loaded once you click “Accept” in the notice. Without your agreement, no connection to Meta is made.

After you agree, the pixel stores cookies (_fbp and _fbc, for up to 90 days) in your browser and sends data such as your IP address, browser and device information, the pages you visit, the time of your visit and whether you sent the contact form (never what you wrote in it) to Meta. We use this to measure the effectiveness of our advertising and to show our ads to relevant audiences. Meta may also process this data for its own purposes, which we cannot influence, and data may be transferred to third countries such as the USA. We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR). For more information see Meta’s privacy policy: https://www.facebook.com/privacy/policy

The legal basis is your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future: click “Cookie settings” at the bottom of any page and choose “Decline”. The Meta cookies are then deleted.

The link to Instagram on our site is an ordinary link. Data is only sent to Instagram (Meta) once you click it.

In the gallery, the blog and the testimonials section we show photos of clients as well as their names and quotes. This is done only with the consent of the people pictured or named (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time with effect for the future; we then remove the content promptly.

We manage and deliver the photos, blog posts and legal texts through the content management system Sanity (Sanity AS, Norway).

We use the following service providers. Where they process data outside the EU and the EEA, we base the transfer on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We run Umami for visit measurement ourselves, so there is no external provider for it. With providers that process data on our behalf, we conclude data processing agreements (Art. 28 GDPR) where the law requires it.

You have the following rights towards us regarding your personal data:

• Access to the data we hold about you (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Objection to processing that we base on our legitimate interest (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR)
• Data portability, meaning receiving your data in a common format (Art. 20 GDPR)
• Complaint to a data protection supervisory authority (Art. 77 GDPR)

To use any of these rights, just email us at contact@ibejiphotography.com. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de). You can also contact the supervisory authority where you live.

We keep data only as long as the respective purpose requires. These are the criteria we apply:

• Contact enquiries: until your enquiry has been dealt with. If no contract results, we delete the message once no further questions are expected. If a contract is concluded, we keep the related correspondence for as long as statutory retention periods require (commercial and tax law, generally six to eight years).
• Server log files: only as long as needed for security and troubleshooting. After that they are deleted automatically.
• Visit measurement: no personal data is stored, the figures are anonymous.
• Cookie choice: until you clear your browser data or change your choice.
• Meta Pixel cookies: up to 90 days, or until you withdraw your consent.
• Photos and testimonials: until the person concerned withdraws their consent.