Privacy

Controller

Janet Laura Reinbold
Happiest Moments Photography
Kübelmarkt 30
76646 Bruchsal
Germany

janet@happiestmoments.de
0176 64180422

Website hosted by Cloudflare

This website is delivered through Cloudflare Workers and Cloudflare’s network. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you access the site, Cloudflare processes in particular your IP address, the time and destination of the request, and technical browser and connection data. Its network operates worldwide.

This processing serves to provide, maintain and secure the website. The legal basis is Article 6(1)(f) GDPR. Fonts and images are delivered with the website; no external font provider is integrated.

The advertising measurement described below does not start without your consent. Cloudflare may process technical operational and security data to deliver and protect the service. Further information is available in Cloudflare’s privacy notice.

Contact form and email

When you write to me, I process your names, email address and message, along with any optional details about your date, place and how you found me. The form sends this information in encrypted form to a Cloudflare Worker. The Worker processes it for email delivery through STRATO to my mailbox. My public email alias is janet@happiestmoments.de. The mailbox provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin.

The information is used to answer your enquiry and, where applicable, prepare a contract (Article 6(1)(b) GDPR). For other enquiries, the basis is my legitimate interest in communication (Article 6(1)(f) GDPR). I cannot reply without a working contact address. An enquiry does not create a booking.

If the form configuration cannot load, you can prepare a local email draft and send it yourself from your email app. Copying and downloading only happen when you choose them. The website does not save form entries in cookies or local storage. You can also email me directly at any time.

Enquiries are kept for as long as needed to handle them and, where applicable, fulfil a booking. They are then deleted unless legal retention duties or other legitimate reasons require longer storage. Retention may also be needed to establish, exercise or defend legal claims.

Spam and attack protection

Cloudflare Turnstile is used before the form is sent. The check loads only when you select “Start security check”. Cloudflare processes, among other things, your IP address and technical browser and device signals to identify automated requests. After a successful check, the form receives a short lived token that is sent to the contact Worker with your enquiry.

The application does not pass names, email addresses or message text to the Turnstile widget. The contact Worker receives those details for delivery. An additional form field invisible to visitors helps identify automated submissions.

This security processing serves the legitimate interest in preventing spam and attacks (Article 6(1)(f) GDPR). Where strictly necessary access to your device is involved, section 25(2)(2) TDDDG is relied upon. You can contact me directly by email instead.

Further information about the service: Cloudflare Turnstile and privacy. A failed check prevents the form from being sent; it does not decide anything about a booking or the merits of your enquiry.

Cookies and browser storage

Your choices about analytics and advertising measurement are stored with a timestamp and text version in local storage under hm-consent for no more than 180 days. This storage ensures your choice is respected (section 25(2)(2) TDDDG; Article 6(1)(c) GDPR). You are then asked again. Without JavaScript, neither analytics nor advertising measurement loads.

Only after consent may an advertising identifier be stored under hm-ads-ref for up to 30 days. The OpenAI pixel may also use the cookies __oppref (advertising identifier, up to 30 days), __obref (browser identifier, up to one year), __oaiq_consent (consent status, up to 30 days) and the local storage entry oaiq_consent The measurement ends no later than the expiry of your 180 day choice. If you withdraw consent, the website removes accessible advertising identifiers; a refusal status may remain to enforce the block.

The shared panel offers “Allow all”, “Necessary only” and “Choose services”. “Necessary only” rejects every optional service. Under “Choose services”, you can turn Google Analytics, Google Ads and OpenAI advertising measurement on or off independently and save your choices. Necessary functions remain active.

Through Cookie settings you can allow or reject services at any time. Withdrawal takes effect for the future; it does not affect the lawfulness of earlier processing. The contact form works without consent to analytics or advertising. Form entries are not saved in local storage.

Measurement of ChatGPT ads

With your voluntary consent, I use the OpenAI Measurement Pixel and Conversions API to measure the performance of my ads in ChatGPT. Under the OpenAI Ad Tools Data Processing Agreement, OpenAI Ireland Limited is responsible for data from the European Economic Area, at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The legal basis is Article 6(1)(a) GDPR; section 25(1) TDDDG applies to storage and access on your device.

On selected general service pages, the pixel may, after consent, send technical connection data including IP address and browser details, page address, time, and advertising and browser identifiers to OpenAI. The pixel is not loaded on contact or draft form pages, the queer weddings page, personal pages, wedding stories or legal pages.

Only after your enquiry has been accepted by the mail server does the contact server send “lead_created” with a random event ID, timestamp, fixed contact page address and any available advertising or browser identifiers. This lets OpenAI associate the enquiry with an ad. Names, email addresses and message text are not sent, even in hashed form. Failed sends do not count. The enquiry is reported only as a server side conversion. For visits and conversion events explicitly sent, use for future personalisation is disabled through opt_out .

Processing in the USA and other countries outside the European Economic Area is possible. The OpenAI Ad Tools Data Processing Agreement describes responsibilities and transfer mechanisms. OpenAI retains data according to purpose and legal requirements; the documentation used does not state a fixed deletion period for individual conversion data. Further information: OpenAI privacy policy and conversion measurement.

Google Analytics

With your voluntary consent, I use Google Analytics 4 to understand the use of general service pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Article 6(1)(a) GDPR; section 25(1) TDDDG applies to storage and access on your device.

Google Analytics loads only if you consent to analytics in the cookie panel. Google then processes page views, timestamps, pseudonymous browser and session identifiers, and technical browser and connection data. The IP address is processed to connect to Google. Detailed location and device collection is disabled in the Analytics settings. Broad regional assignment may still occur.

Measurement is restricted to general service pages: prices and services, photo booth, elopements and portfolio, along with the home and wedding photography pages if they do not contain an enquiry form. Analytics does not load on pages with enquiry forms, contact pages, personal pages, wedding stories, the queer weddings page or legal pages. The website sends no form entries, names, email addresses or its own user IDs to Analytics. Page addresses are sent without query strings or fragments; the referring page address is not sent. Google Signals, collection of user provided data and Google ad personalisation are disabled.

Analytics uses the cookies _ga and _ga_* to recognise browsers and sessions. The website limits their lifetime to 180 days and disables automatic extension of cookie lifetime. Event data is retained in the Analytics account for two months and user data for 14 months. New user activity restarts the retention period for the user identifier. These periods do not apply to standard aggregated reports. More information about Google Analytics data retention.

Processing in the USA and other countries outside the European Economic Area is possible. Google’s data processing terms describe international transfer mechanisms, including standard contractual clauses. More information is available in the Google data processing terms and in Google’s privacy policy.

Through Cookie settings you can withdraw your consent for the future at any time. The website then stops measurement and removes accessible Analytics cookies. Your OpenAI choice is independent.

Google Ads measurement

With your voluntary consent, I load the Google Ads tag from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It associates visits and successfully sent contact enquiries with my Google ads. The legal basis is Article 6(1)(a) GDPR; section 25(1) TDDDG applies to storage and access on your device.

The tag loads only after separate consent to Google Ads. Google processes technical browser and connection data, including your IP address, together with information about the page view and, where applicable, an ad click. Cookies such as _gcl_* can recognise ad clicks. The website limits the configured cookie lifetime to 180 days. Individual cookies may expire sooner.

The integration is restricted to general service pages, including the home page, wedding photography, prices and services, photo booth, elopements and portfolio. On the home and wedding photography pages, the tag may also load beside the enquiry draft. The contact page, wedding stories and personal pages are excluded. The website does not pass form entries, names or email addresses to the tag. Enhanced conversions, Google Signals and ad personalisation are disabled in the integration. The website does not currently set up its own Google Ads conversion for submitted enquiries.

Processing in the USA and other countries outside the European Economic Area is possible. More information is available in Google’s privacy policy and the Google data processing terms.

Your consent to Google Ads is independent of Google Analytics and OpenAI. Through Cookie settings you can withdraw it at any time for the future. The website then sets Google advertising consent to denied and removes accessible Google Ads cookies.

Service providers and processing abroad

Cloudflare may process personal data outside the EU and European Economic Area, particularly in the USA. Cloudflare’s data processing terms describe processing on behalf of the controller, subcontractors and the mechanisms for international transfers, including standard contractual clauses.

Further information: Cloudflare data processing terms and STRATO data processing agreement.

Your rights

Under the GDPR, you may request access, rectification, erasure, restriction of processing and data portability where applicable. You may withdraw consent at any time for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation.

Write to the contact address above. You can also lodge a complaint with a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. For Baden-Württemberg: State Commissioner for Data Protection and Freedom of Information, Heilbronner Straße 35, 70191 Stuttgart. Contact and complaint options.