Privacy Policy

Fotowaschbaer, Franz Robert Berger (sole proprietorship, Austria) – registered trade location Hofackerstrasse 18, 6974 Gaissau, Austria; business address Feldstrasse 36, 9445 Rebstein, Switzerland
Data Protection Contact: office@foto-waschbaer.com

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG); for visitors from Switzerland we additionally observe the Swiss Data Protection Act. This policy explains which data we collect, why, and how we protect it.

• Performance of a contract (Art. 6(1)(b) GDPR): processing your orders and assignments and delivering photography services.
• Consent (Art. 6(1)(a) GDPR): only where we expressly ask for it. There is currently no newsletter and no advertising; we do not collect marketing consent.
• Legitimate interest (Art. 6(1)(f) GDPR): Website functionality, fraud prevention, and improving our services.
• Legal obligation (Art. 6(1)(c) GDPR): tax and accounting retention duties under Austrian law (BAO, UGB).

• Contact information (name, email address, and the billing address when you buy) when you order, request an assignment or write to us. We do not ask for a phone number.
• Order and payment information (purchased items, amounts, billing address, payment method via Stripe; when prints are shipped, the delivery address – which is the billing address)
• Enquiries about photography services (requested service, dates, event location, messages) via the contact form or by email
• Details of photo purchases (selected images, rider name or start number you searched for)
• Technical data (IP address, browser type, device information, pages visited) collected automatically when you visit our website

• Providing our photography services and handling assignments
• Processing orders, payments, and generating invoices
• Communication about assignments and orders, and replies to your enquiries
• Improving our services and website functionality
• Compliance with legal obligations (tax records, accounting)

We share data with the following service providers, each acting as a data processor under appropriate data processing agreements (DPAs):

• Stripe Payments Europe Ltd. (Ireland) / Stripe, Inc. (USA): payment processing, fraud prevention and – if you use it – saving your payment details via Stripe Link. Stripe is certified under the EU-US Data Privacy Framework. Privacy policy: https://stripe.com/privacy
• Supabase, Inc. (USA): database and file storage (preview images, transfers, invoices). Servers in the EU (Frankfurt, eu-central-1). Privacy policy: https://supabase.com/privacy
• Resend, Inc. (USA): delivery of our emails (order confirmation, invoice, download links, replies to enquiries). Sent via servers in the EU (Ireland). Privacy policy: https://resend.com/legal/privacy-policy
• Google LLC (USA): Google Places API for address suggestions while you fill in the billing address at checkout. Only what you type into the address field is transmitted. Privacy policy: https://policies.google.com/privacy
• Vercel, Inc. (USA): hosting of the website and execution of server functions (servers located in the USA). Privacy policy: https://vercel.com/legal/privacy-policy
• Swiss Post (Die Schweizerische Post AG) or the respective delivery service: delivery of printed photos (name and delivery address), only if you choose shipping at checkout.

We never sell your personal data to third parties.

Some of our service providers are based in the United States. Data transfers to the US are protected by the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or the Swiss-US Data Privacy Framework, as applicable. Switzerland is recognized by the EU as providing an adequate level of data protection.

We use cookies that are essential for website functionality. For detailed information about specific cookies, please see our Cookie Policy. Cookie Policy

• Order and invoice data: 7 years from the end of the financial year (§ 132 BAO, § 212 UGB)
• Service enquiries and resulting assignments: for the duration of the business relationship and up to 7 years thereafter to meet legal obligations
• Contact form enquiries are not stored in our database but delivered to us by email; we delete them after 12 months unless they belong to an order or assignment
• Technical/server logs: automatically deleted after 30 days at the latest
• All other personal data is deleted upon your request, unless retention is required by law.

• Right of access to your personal data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure, 'right to be forgotten' (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, contact us at office@foto-waschbaer.com. We will respond within 30 days.

For visitors from Switzerland: complaints may also be lodged with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch).

The competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (www.dsb.gv.at). Residents of other EU/EEA states may also contact their national authority (Art. 77 GDPR).