Privacy Policy

1. Controller

The controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Niklas Niepagen
trading as MyStageShot
Lohrweg 31
56218 Mülheim-Kärlich
Germany
Email: info@mystageshot.com
Phone: +49 162 232 9851

2. General information on data processing

We process personal data exclusively within the framework of applicable data protection law, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person.

Depending on the processing operation, processing is based in particular on:

• Art. 6(1)(a) GDPR – consent
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR – compliance with a legal obligation
• Art. 6(1)(f) GDPR – protection of legitimate interests

Where processing is based on consent, that consent may be withdrawn at any time with effect for the future.

3. Hosting and provision of the website

This website is hosted by Hostinger.

When our website is accessed, the hosting provider may process in particular the following data:

• IP address
• date and time of access
• pages or files accessed
• volume of data transferred
• referrer URL
• browser type and version
• operating system used
• information about the access status

The processing serves the technically secure, stable and reliable provision of our website as well as the detection and prevention of abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically flawless provision of our online offering.

Insofar as Hostinger processes personal data on our behalf, the processing is based on a data processing agreement pursuant to Art. 28 GDPR. Insofar as personal data is processed outside the European Union or the European Economic Area in connection with the use of Hostinger, such a transfer only takes place in compliance with the requirements of Art. 44 et seq. GDPR.

4. Bookings and contract processing

When you book photographic or media coverage of a competition via our website, we process the personal data you provide. This may include in particular:

• first and last name
• email address
• Instagram username
• federation
• competition class
• booked competition and event day
• booked services and add-ons
• payment and transaction information
• further information provided voluntarily

The processing serves in particular the handling and administration of the booking, the assignment to the respective competition and class, the planning and delivery of the photographic or media coverage, the identification and assignment of the resulting footage, communication before and after the competition, the provision of an individual gallery and the handling of subsequent purchases and add-ons.

The legal basis is Art. 6(1)(b) GDPR. Insofar as data must be stored due to commercial, tax or other statutory retention obligations, further processing is based on Art. 6(1)(c) GDPR.

5. Individual image and video galleries

After the competition, customers may receive access to an individual online gallery. We use PicDrop and the Saal Photo Portal to provide these galleries.

For this purpose, in particular name, email address, assignment to the respective competition, gallery assignment, image and video footage of the respective athlete as well as information about image selection and orders may be processed.

The processing serves in particular the viewing, selection, ordering and provision of the footage created as part of the booked service. The legal basis is Art. 6(1)(b) GDPR.

Insofar as the service providers used process personal data on our behalf, this is based on a data processing agreement pursuant to Art. 28 GDPR, where such an agreement is legally required.

The individual online gallery is generally kept accessible to the customer for a period of 30 days from provision. After this period there is no entitlement to further online provision of the gallery. The gallery may then be deactivated or deleted. Statutory retention obligations and further storage permitted on another legal basis remain unaffected.

6. Payment processing via Stripe

We use Stripe to process payments. In the course of a payment, the data required for payment processing is transmitted to Stripe. This may include in particular name, email address, invoice or payment information, payment amount, payment method used, transaction data and technical information, insofar as this is necessary for payment processing and fraud prevention.

The processing serves to execute the payment and thus to perform the contract concluded with you. The legal basis for transmitting the data required for contract processing is Art. 6(1)(b) GDPR.

Stripe may also process personal data under its own data protection responsibility, in particular to comply with legal obligations, for fraud prevention and for the security of payment transactions. Insofar as processing takes place outside the European Union or the European Economic Area, the statutory requirements of Art. 44 et seq. GDPR must be observed.

7. Email communication and transactional messages

For communication with customers and for sending transactional emails we use in particular Gmail via Google Workspace and Resend.

This may be used to send booking confirmations, payment information, organisational information about the competition, information on the booked coverage, gallery links, information about the completion of the footage, information on subsequent orders and other contract-related messages.

In this context, in particular name, email address, booking information, competition assignment and the content of the respective communication may be processed.

Insofar as the communication serves the performance of a contract or pre-contractual measures, the processing is based on Art. 6(1)(b) GDPR. Insofar as Google or Resend process personal data on our behalf, the processing is based on a data processing agreement pursuant to Art. 28 GDPR, where legally required. Transfers to third countries only take place in compliance with Art. 44 et seq. GDPR.

8. Advertising by email

The use of an email address provided in the course of a booking for booking confirmations, gallery links and other communication necessary to perform the contract must be distinguished from its use for advertising purposes.

Promotional emails about future competitions, offers, campaigns or comparable services are only sent where a corresponding legal basis exists. Where consent is obtained for this, the processing is based on Art. 6(1)(a) GDPR. Consent granted may be withdrawn at any time with effect for the future.

Where the statutory requirements for advertising to existing customers are met, promotional contact may also take place without separate consent to the extent permitted by law. Every promotional email contains an option to object to further promotional contact or to unsubscribe from such messages.

9. Cookies and technically necessary technologies

Our website uses technically necessary technologies insofar as these are required for the provision and functionality of the website and for functions expressly requested by the user.

Insofar as information is stored on a user’s device or information already stored is accessed, this takes place in accordance with the statutory provisions of the TDDDG.

Cookies or comparable technologies that are not technically necessary are only used where a legal basis exists and — where required — the user’s consent has been obtained in advance. If additional analytics, marketing or tracking technologies are used in the future, this privacy policy will be adapted accordingly.

10. Analytics and marketing services

This website uses the web analytics service Plausible Analytics. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia (registration number 14709274).

Plausible Analytics operates without cookies. No cookies are set and no information is stored on or read from the user’s device. Consent under section 25 TDDDG is therefore not required.

Only aggregated usage data is collected, namely the page visited (hostname and path, without query parameters except campaign parameters), the referring website, the browser used, the operating system, the device type as well as country, region and city.

The user’s IP address is not stored. To distinguish repeat page views within a single day, a non-reversible check value is generated from a daily rotating random value, the website domain, the IP address and the browser identification. The random value is deleted and replaced every 24 hours; IP addresses and browser identifications are never stored. No recognition takes place across days, across several websites or across several devices, and no profiles are created.

Data is processed and stored exclusively within the European Union. No transfer to third countries takes place.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the statistical evaluation of website usage in order to design this offering according to demand and to improve it continuously. As neither personal data is stored nor user profiles are created, the collected data cannot be attributed to a specific person.

Further information on data processing by Plausible Analytics is available at https://plausible.io/data-policy.

If such services are used in the future, they will only be activated in compliance with the applicable data protection requirements. Where consent is required, the services concerned will only be activated once that consent has been given. This privacy policy will be supplemented with the necessary information before or upon the introduction of such services.

11. Image and video recordings as part of booked services

As part of the booked photographic or media competition coverage, image and, where applicable, video recordings of the customer are created.

The creation, review, editing, assignment and provision of this footage takes place on the basis of Art. 6(1)(b) GDPR insofar as this is necessary to perform the booked service.

This includes in particular the creation of the recordings during the competition, the review and selection of the recorded material, photographic and videographic post-production, the assignment to the respective athlete, the provision via an individual online gallery and the provision of the digital files purchased by the customer.

12. Use and publication of footage for portfolio and marketing purposes

The image and video recordings created at a competition may — insofar as a corresponding legal basis exists — also be used to present and promote the photographic and media work of MyStageShot.

Such use may take place in particular on the MyStageShot website, in online portfolios and reference galleries, on MyStageShot social media channels, in organic social media posts, reels, stories and comparable formats as well as in our own presentation, reference, marketing and communication materials.

Use for portfolio and marketing purposes must be distinguished from the processing of the footage for the actual performance of the contract.

Insofar as the publication or promotional use of a recording requires the consent of the customer depicted, this consent is obtained separately and voluntarily. Granting such consent is not a prerequisite for booking or performing the photographic service.

Consent granted may be withdrawn at any time with effect for the future. The lawfulness of processing carried out up to the point of withdrawal remains unaffected. Insofar as processing is based on another legal basis, the statutory rights of the data subject, in particular any right to object, remain unaffected.

The permissibility of processing under data protection law must be distinguished from any additional requirements under personality and image rights.

13. Underage participants

MyStageShot also offers photographic and media services in connection with competitions in which underage athletes may take part.

In the case of minors, the applicable statutory requirements for the processing of personal data and for the creation, provision and publication of image and video recordings are observed.

Insofar as the approval or consent of a legal guardian is required for a booking, data processing or the use or publication of recordings, this is obtained before the processing in question. MyStageShot may request suitable proof of the authority to represent or consent.

Use of recordings for portfolio, social media or other marketing purposes going beyond the processing necessary to perform the contract only takes place on the basis of separate consent, where legally required. Refusing such consent has no effect on the performance of a duly booked service. Consent granted may be withdrawn at any time with effect for the future in accordance with the statutory provisions.

14. Contacting us and contact form

If you contact us by email or via a contact form, we process the data you transmit in order to handle your enquiry. This may include in particular name, email address, the content of the message and further information provided voluntarily.

If the enquiry relates to an existing or potential contract, the processing is based on Art. 6(1)(b) GDPR. For other enquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling incoming enquiries appropriately.

15. Recipients of personal data

Personal data is only passed on to third parties where a legal basis exists. Recipients or categories of recipients may include in particular:

• hosting providers
• payment service providers
• gallery and cloud service providers
• email and communication service providers
• IT and technical service providers
• tax advisors and other professional advisors
• authorities and public bodies, where a legal obligation exists

Insofar as service providers process personal data exclusively on our behalf, data processing agreements pursuant to Art. 28 GDPR are concluded where required.

16. Transfers to third countries

In connection with the use of certain service providers, personal data may be processed outside the European Union or the European Economic Area.

Such a transfer only takes place in compliance with the requirements of Art. 44 et seq. GDPR. This may include in particular adequacy decisions of the European Commission, appropriate safeguards such as standard contractual clauses or other transfer mechanisms provided for by law. The specific transfer mechanisms used depend on the respective service provider.

17. Storage period

Personal data is generally stored only for as long as is necessary to fulfil the respective processing purpose. Where statutory retention obligations exist, the data concerned is stored for the duration of those obligations.

Once the respective processing purpose no longer applies and statutory retention periods have expired, personal data is deleted, unless another legal basis permits or requires further storage. Data processed exclusively on the basis of consent is generally no longer processed on the basis of that consent if the consent is withdrawn and no other legal basis exists for further processing.

18. Rights of data subjects

Subject to the statutory requirements, data subjects have in particular the following rights:

• right of access pursuant to Art. 15 GDPR
• right to rectification pursuant to Art. 16 GDPR
• right to erasure pursuant to Art. 17 GDPR
• right to restriction of processing pursuant to Art. 18 GDPR
• right to data portability pursuant to Art. 20 GDPR
• right to object pursuant to Art. 21 GDPR
• right to withdraw consent pursuant to Art. 7(3) GDPR
• right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR

Insofar as personal data is processed on the basis of Art. 6(1)(f) GDPR, there is a right under Art. 21 GDPR to object at any time to the processing on grounds relating to the data subject’s particular situation. Where personal data is processed for direct marketing purposes, there is a right to object at any time to processing for the purposes of such marketing.

19. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority about the processing of their personal data.

The following supervisory authority is responsible for our place of business in particular:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
Germany

20. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

The security measures are reviewed and adapted in line with technological developments and taking into account the risk of the respective processing. Our website is generally transmitted in encrypted form using SSL/TLS.

21. Changes to this privacy policy

We reserve the right to adapt this privacy policy if the services used, our data processing procedures or the legal requirements change. The current version published on our website applies.