Privacy Policy
Sarah Stange Fotografie
Last updated: September 2026
1. Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Sarah Stange Fotografie
Sarah Stange
Fontaneweg 21
71665 Vaihingen an der Enz
Germany
Email: hello@sarahstange.de
2. General Information on the Processing of Personal Data
We process personal data exclusively in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
The personal data processed, the purposes for which it is processed and the applicable legal basis depend in particular on the photographic service used.
As part of our kindergarten and institutional photography services, we process personal data relating to parents or legal guardians as well as personal data and photographs of registered children.
3. Kindergarten and Institutional Photography
3.1 Registration via fotograf.de
For the organisation and implementation of our photo sessions and for the subsequent provision and ordering of the resulting photographs, we use the fotograf.de platform.
The platform is operated by:
Fotografen Online Service GmbH (FOS)
Hausvogteiplatz 12
10117 Berlin
Germany
Registration for a photo session takes place directly via the fotograf.de platform.
Parents or legal guardians enter the data required for their child's participation directly on the platform.
The following personal data in particular may be processed:
child's first and last name,
institution and group or class affiliation,
first and last name of the parent or legal guardian,
email address and, where applicable, other contact details,
registration information,
information relating to consent given,
technical data generated when using the platform, and
subsequently, the image files assigned to the respective child.
Fotografen Online Service GmbH generally processes the personal data collected in connection with our photo sessions on our behalf as a processor pursuant to Article 28 GDPR.
For this purpose, we have entered into a data processing agreement with Fotografen Online Service GmbH in accordance with Article 28 GDPR.
3.2 Legal Bases for Processing
Depending on the individual processing activity, personal data may be processed on different legal bases.
Where consent is obtained for a child's participation in a photo session or for the processing of their personal data, the processing is based on Article 6(1)(a) GDPR.
Where processing is necessary in order to take steps prior to entering into a contract or to perform a contract, the processing is based on Article 6(1)(b) GDPR.
Where processing is necessary for the purposes of our legitimate interests or those of a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, processing is based on Article 6(1)(f) GDPR.
Where we are legally required to process certain personal data, processing is based on Article 6(1)(c) GDPR.
3.3 Photographing Children
As part of our kindergarten and institutional photography services, we generally only photograph children for whom the required registration and/or consent of the parents or legal guardians has been provided in advance.
The photographs are processed for the purpose of carrying out the photo session, editing and assigning the images and subsequently making them available in a protected online gallery.
Photographs taken during a photo session are not published or used for advertising purposes solely on the basis of participation in the photo session.
Publication or promotional use of photographs will only take place where a separate legal basis exists, in particular where appropriate consent has been obtained.
4. Transfer of Photographs to fotograf.de
Following the photo session, the resulting photographs are uploaded to the platform provided by fotograf.de.
The images are stored and processed there, assigned to the relevant photo orders or registered persons and subsequently made available to authorised persons in a protected online gallery.
The following data in particular may be processed in this context:
photographs,
names and identification or assignment data of photographed persons,
group or class affiliations,
contact details of parents or legal guardians,
order and transaction data,
delivery and billing information,
payment-related information,
technical usage data, and
organisational data and metadata.
5. Storage by fotograf.de
Personal data collected via fotograf.de and photographs uploaded by us are processed within the technical infrastructure provided by Fotografen Online Service GmbH.
According to the information provided by FOS, customer and image data are stored on cloud infrastructure within the European Union, including data centres located in Frankfurt am Main, Germany.
FOS implements technical and organisational measures designed to ensure an appropriate level of protection for personal data.
6. Online Gallery and Ordering of Photographs
Following the photo session, photographs are made available to authorised persons for viewing and ordering via the protected online gallery provided by fotograf.de.
When using the gallery or placing an order, the following data in particular may be processed:
name,
contact details,
image files,
selected photographs and products,
billing and delivery address,
order value and date,
payment information, and
technical usage data.
Where processing is necessary for the performance of an order or purchase contract, the legal basis is Article 6(1)(b) GDPR.
7. Production and Shipping of Photo Products
Where printed photographs or other photo products are ordered, personal data required for the production and delivery of those products may be transferred to the production and shipping service providers involved.
Depending on the product ordered, this may include in particular the required image files, order information, name and delivery address.
Such data is transferred only to the extent necessary for the production and delivery of the products ordered.
The legal basis is Article 6(1)(b) GDPR.
8. Payment Processing
When placing a paid order, personal data required for the selected payment method is processed.
Depending on the payment method selected, the data necessary to process the payment may be transferred to the respective payment service provider.
This may include in particular:
name,
billing information,
payment method,
payment amount,
payment status, and
transaction data.
Processing is carried out for the purpose of completing the order pursuant to Article 6(1)(b) GDPR and, where applicable, for compliance with legal obligations pursuant to Article 6(1)(c) GDPR.
9. Sub-processors Used by fotograf.de
Fotografen Online Service GmbH is entitled to engage additional service providers as sub-processors for the provision and operation of its platform.
These may include, in particular, service providers for cloud infrastructure, hosting, databases, technical analytics, IT security, error diagnostics, communications, payment processing and other services required for the operation of the platform.
FOS is required under the data processing agreement concluded with us to contractually impose appropriate data protection obligations on the sub-processors it engages.
10. Processing Outside the EU or EEA
According to the information provided by FOS, the central storage of customer and image data takes place on cloud infrastructure within the European Union, including Frankfurt am Main, Germany.
However, in connection with certain technical services, processing of personal data by service providers outside the European Union or European Economic Area cannot be completely excluded.
Where personal data is transferred to or processed in a third country, this is carried out in accordance with the requirements of Articles 44 et seq. GDPR.
Depending on the recipient and destination country, this may be based in particular on an adequacy decision of the European Commission or on appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission.
11. Anonymisation and Use of Anonymised Data by FOS
As part of the contractually agreed services, FOS may anonymise personal data.
According to the contractual provisions, anonymisation is carried out in such a way that the resulting information can no longer be attributed to an identified or identifiable natural person.
FOS may use such anonymised or aggregated data in particular for internal analysis and statistics, product development and improvement, benchmarking, business intelligence and aggregated reporting.
According to the contractual provisions, FOS is required not to re-identify anonymised data and to take measures designed to prevent re-identification.
12. Other Recipients of Personal Data
In addition to fotograf.de, personal data may be disclosed to other recipients where this is necessary for the provision of our services or where disclosure is required by law.
Such recipients may include in particular:
IT and technical service providers,
production service providers and photo laboratories,
shipping and logistics providers,
payment service providers,
tax advisers and other professional advisers, and
authorities and public bodies where disclosure is required by law.
Personal data will only be disclosed where there is a valid legal basis for doing so.
13. Contacting Us
If you contact us by email or by other means, we process the personal data you provide in order to handle your enquiry.
This may include, in particular, your name, contact details and the content of your message.
Depending on the nature of the enquiry, processing is based in particular on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
14. Storage Period and Deletion
Personal data is generally stored only for as long as necessary to fulfil the respective purpose of processing or for as long as statutory retention obligations apply.
Where the purpose of processing no longer applies and there is no statutory or other permissible basis for continued storage, the relevant personal data will be deleted.
Statutory retention requirements may apply in particular to tax and commercial records.
Where fotograf.de processes personal data on our behalf, deletion is additionally governed by the data processing agreement between us and FOS and by the relevant functions and settings of the platform.
Upon termination of the processing relationship, FOS is generally required under the data processing agreement to return or delete the personal data processed on our behalf, unless statutory retention obligations require continued storage.
15. Withdrawal of Consent
Where processing is based on consent pursuant to Article 6(1)(a) GDPR, consent may be withdrawn at any time with effect for the future.
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Consent may be withdrawn in particular by contacting:
hello@sarahstange.de
16. Rights of Data Subjects
Subject to the applicable statutory requirements, data subjects have in particular the following rights:
right of access pursuant to Article 15 GDPR,
right to rectification pursuant to Article 16 GDPR,
right to erasure pursuant to Article 17 GDPR,
right to restriction of processing pursuant to Article 18 GDPR,
right to data portability pursuant to Article 20 GDPR,
right to object pursuant to Article 21 GDPR, and
right to withdraw consent pursuant to Article 7(3) GDPR.
To exercise these rights, please contact:
Sarah Stange Fotografie
Email: hello@sarahstange.de
Where fotograf.de processes customer, registration or image data on our behalf, data protection requests relating to our photo sessions may also be addressed directly to us.
17. Right to Lodge a Complaint
Pursuant to Article 77 GDPR, data subjects have the right to lodge a complaint with a competent data protection supervisory authority if they believe that the processing of their personal data infringes applicable data protection law.
18. Right to Object Pursuant to Article 21 GDPR
Where we process personal data on the basis of Article 6(1)(f) GDPR, data subjects have the right, on grounds relating to their particular situation, to object at any time to the processing of their personal data.
Following such an objection, we will no longer process the personal data on this legal basis unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or where processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to processing for such purposes.
19. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised disclosure and unauthorised access.
Processors engaged by us are likewise required to implement appropriate technical and organisational measures to protect personal data.
20. Automated Decision-Making
We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR that produces legal effects concerning a data subject or similarly significantly affects them.
21. Updates to this Privacy Policy
We reserve the right to amend this Privacy Policy where the services we use, our processing activities or applicable legal requirements change.
The current version of this Privacy Policy will be made available through our website or in connection with our photographic services.
Last updated: September 2026
