Privacy Policy

Last updated: October 2026

This is a courtesy translation. The German version is the legally authoritative one.

I process personal data only where it is necessary to run this website and to answer your enquiry. The following informs you pursuant to Art. 13 GDPR.

Controller

Sandra Mannigel, Fotografin
Undinestraße 42
12203 Berlin, Germany
Email: sandra@mannigel-photography.de
Phone: +49 155 67050 950

Visiting the website

On each visit, server log files record your IP address, the time, the address requested, the referrer and your browser identification, and are kept for 14 days. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation).

Cookies and your choice

Of its own accord this website sets no cookies. Only when you set something does it remember it: smp_lang the language you chose (until you close your browser), smp_consent your cookie decision (180 days) and, in your browser storage, your theme setting (light or dark).

Without any action on your part, the website places only two technical markers in your browser’s session storage: that the cookie notice has already been counted for this visit, and that the short hint at the search bar has already been shown. Neither contains an identifier, and both disappear as soon as you close the tab. All of this stays on this website. The legal basis is § 25(2) No. 2 TDDDG.

Everything beyond that—Analytics and Marketing—runs only with your consent. If you choose nothing, nothing happens: the outcome is the same as “Necessary only.” You can change or withdraw your choice at any time via “Cookie settings” in the footer; the lawfulness of processing carried out until then remains unaffected (Art. 7(3) GDPR).

Audience measurement

I count visits with my own statistics, without cookies. The legal basis is Art. 6(1)(f) GDPR.

Analytics and marketing (only with your consent)

Only once you consent to Analytics or Marketing does this website load Google Tag Manager (Google Ireland Limited), which controls the services below; loading it transmits your IP address, browser identification and the address requested to Google. Without your consent, none of these services is loaded.

Under Analytics, that is Hotjar Ltd. (Malta), which analyses anonymously how pages are used. Under Marketing, it is Google Ads—the measurement of advertising performance, including the cookies required for it, and remarketing, which lets me show you ads for my photography later on—and Fraud Blocker, Inc. (USA), which protects my ads against click fraud and processes your IP address and device and browser information for that purpose.

Enhanced conversions: if you have consented to Marketing and send me an enquiry through a form, I transmit your email address and, if given, your phone number to Google after you send it, not in plain text but only as a SHA-256 hash. Google matches this value against the details of its user accounts to determine whether an enquiry came from one of my ads, and processes it for that purpose as my processor (Google Ads Data Processing Terms). This happens only for an enquiry you actually send, never from input you do not send. To hand the hashes over to the confirmation page, they are kept for at most five minutes in a cookie (smp_ec), which is deleted there immediately.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Transfers to the USA are based on the EU-US Data Privacy Framework and, additionally, on the EU standard contractual clauses.

Enquiries via the contact form

Through the form I process the details you provide in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), otherwise Art. 6(1)(f) GDPR. Only if you have consented to Marketing is a hash of your email address and phone number additionally sent to Google after you submit (see “Analytics and marketing”); the legal basis for that is your consent.

The fields marked as required are the ones I need in order to answer your enquiry or to perform the contract; all other details are optional. To prevent abuse, I also process your IP address (Art. 6(1)(f) GDPR).

The notification to me is sent by an email service provider in the EU; my mailbox is hosted by a provider in the USA. This transfer is based on the EU-US Data Privacy Framework or on the EU standard contractual clauses. I delete the copies of your enquiry stored on the web server after 180 days; in my mailbox I keep enquiries only for as long as handling them requires or statutory retention periods demand.

Service providers

These service providers receive personal data. Google, Hotjar and Fraud Blocker are used only with your consent (see “Analytics and marketing”):

Transfers to the USA are based on the EU-US Data Privacy Framework or on the EU standard contractual clauses (Art. 46(2)(c) GDPR); I’ll send you a copy on request.

Storage periods

Server log files 14 days · contact form enquiries on the web server 180 days · cookie decision 180 days · encrypted backups (EU) up to 90 days. Beyond that I store data only for as long as it is necessary for the respective purpose or as statutory retention periods require.

Your rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An email to sandra@mannigel-photography.de is sufficient.

You also have the right to object at any time, on grounds relating to your particular situation, to processing that I base on a legitimate interest (Art. 21 GDPR).

You may also lodge a complaint with a supervisory authority; for me that is the Berlin Commissioner for Data Protection and Freedom of Information.