Privacy Policy

This Privacy Policy explains what personal data is processed when using this website — from a simple visit, through a shoot request, to a client account with order management, contract, payment and photo delivery. It applies both to visitors and to registered clients.

The person or entity named in the Legal Notice (Impressum) is responsible for data processing on this website. The Legal Notice is linked in the footer. For privacy-related requests, please use the contact details listed there or write directly to the email address given in the Legal Notice.

When you visit this website, the web server automatically processes technically necessary access data, in particular IP address, date and time of access, the page or file requested, referrer URL, browser type, operating system, HTTP status code, and the amount of data transferred.

This data is processed to technically deliver the website, ensure stability and security, analyse errors, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and reliable operation of the website.

This website does not set its own marketing or tracking cookies. Only technically necessary cookies are used: a session cookie once you log into your client account (keeps you logged in, expires automatically), a short-lived cookie during an active two-factor login, and — only if maintenance mode is active and a preview password is used — a cookie remembering that access. No consent is required for these technically necessary cookies (§ 25(2) No. 2 TTDSG, Art. 6(1)(f) GDPR).

The embedded live chat (section 14) may set additional cookies through its own provider once it is loaded on a page.

A client account is required to book a shoot. Registration collects first name, last name, an optional nickname, date of birth, phone number, address, email address, and a password stored in encrypted form. The date of birth is used for age verification (see Terms, Minors), the address for contract and invoicing purposes.

Registration is verified via a confirmation link sent by email. You can optionally secure your account further with two-factor authentication (authenticator app). The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR).

You can have your account deleted at any time from the account area. If no invoices exist yet, the account is deleted immediately and completely; otherwise our team reviews the deletion manually and removes any data no longer subject to retention requirements (see section 8 on statutory retention periods).

When you submit a shoot request, the data you provide is processed (e.g. desired time frame, character/concept, location, reference images). As the process continues, price proposals, the agreed appointment, an optional meeting-point address, and a digitally signed contract (including TFP agreements) are stored. This data is necessary to carry out the contractual relationship; the legal basis is Art. 6(1)(b) GDPR.

If online payment is enabled, payments are processed via the payment provider Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland). The data necessary for payment (e.g. amount, payment reference, payment status) is transmitted to Stripe; payment data such as card details is processed directly by Stripe and does not pass through our own servers. Stripe may use processors outside the EU, in which case Stripe ensures an adequate level of data protection (e.g. via EU Standard Contractual Clauses). See Stripe's own privacy policy for details. The legal basis is Art. 6(1)(b) GDPR.

Alternatively, payment outside this system (e.g. bank transfer) or a TFP arrangement without monetary payment is possible — in that case no data is transmitted to Stripe.

Where invoices, payment receipts, or other tax-relevant business records are created in connection with a shoot, these are retained for 6 or 10 years after the end of the relevant calendar year due to statutory retention obligations (§ 147 AO, § 257 HGB), even where earlier deletion would otherwise be possible. The legal basis is Art. 6(1)(c) GDPR (legal obligation).

Finished, edited photos are made available to you via a password-protected area of this website. The image files themselves are stored on our own, self-hosted Nextcloud server (not with an external cloud provider) — photos never leave our own infrastructure. Before full payment, preview images are delivered with a visible watermark. The legal basis is Art. 6(1)(b) GDPR.

Order, payment and appointment notifications (e.g. invoices, payment reminders, appointment confirmations, feedback requests after a shoot) are sent via our own, self-hosted mail server — not via a third-party email marketing provider. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for pure service notices.

If you have booked a shoot with us before, you may — after an extended period without a new request (typically not before 12 months) — receive a single, non-binding reminder email. The legal basis is a legitimate interest in client retention (Art. 6(1)(f) GDPR); you can object informally by email at any time, which permanently stops this reminder for you.

Within your account, notifications (e.g. new message, status change) are also shown as a bell icon — these remain within your account only and are not duplicated by email unless stated otherwise.

When you redeem a discount code or gift voucher, it is linked to your order or account to prevent misuse (e.g. repeated redemption) and to track its validity. If you take part in the referral program, we store which code belongs to which account and whether it has been redeemed, so the agreed reward can be attributed correctly. The legal basis is Art. 6(1)(b) GDPR.

The portfolio may display images, titles, descriptions, categories, tags, and further shoot-related information. Testimonials (e.g. taken from feedback you submitted, or a public review) may be published with a name or initials. This content becomes publicly visible once released in the dashboard — generally only with prior consent or based on the usage rights agreed as part of the order (see Terms & Conditions). You can object to a publication informally by email at any time.

For internal scheduling, a confirmed appointment (including character/concept, client name, and any meeting-point address) may be transferred to a Google Calendar connected to a team member's Google account (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This serves purely internal appointment organisation, not your own calendar use. The legal basis is a legitimate interest in reliable scheduling (Art. 6(1)(f) GDPR).

This website embeds the live chat service tawk.to, a provider based in the United States (tawk.to inc., 187 East Warm Springs Rd, SB298, Las Vegas, NV 89119, USA). Once the chat is loaded, the following data may be processed: chat messages, voluntarily provided name and email address, IP address, device and browser information, and technical cookies required to provide the chat.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast, direct communication) or Art. 6(1)(a) GDPR where the chat is actively used or cookie consent has been given.

As tawk.to processes data in the United States, this involves a transfer to a third country. tawk.to has self-certified under the EU-US Data Privacy Framework, recognised by the European Commission as an adequacy mechanism for transfers to the US; tawk.to additionally offers a Data Processing Addendum (DPA). See tawk.to's own privacy policy for further details.

If enabled in the site settings, this website may use Google Analytics for anonymised traffic analysis (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In that case, processing only takes place with prior consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time with future effect. If Google Analytics is not enabled, no such processing takes place.

This website may contain links to external platforms, such as Instagram, Discord, YouTube, TikTok, or X/Twitter. Clicking such links may result in personal data being processed by the respective provider. Rakku has no direct influence on the nature or scope of such processing.

Account data is retained for as long as your account exists and is removed upon account deletion (see section 5). Order, contract, and communication data is generally deleted once the order has been fully processed and no further communication is required, but no later than 3 years after the shoot is completed, unless longer statutory retention obligations apply (see section 8).

Server log files are used only for technical security, error analysis, and misuse prevention, and are deleted automatically on a regular basis. Session cookies expire automatically. Portfolio and page content remains stored until changed, hidden, or deleted in the dashboard. Chat histories are stored according to tawk.to's own retention periods.

Where data is processed for the technical provision, security, and administration of the website, this is based on Art. 6(1)(f) GDPR. To perform a contract or carry out pre-contractual steps (registration, order processing, payment, photo delivery), processing is based on Art. 6(1)(b) GDPR. To fulfil legal obligations (e.g. invoice retention), processing is based on Art. 6(1)(c) GDPR. Where consent is obtained (e.g. Google Analytics), processing is based on Art. 6(1)(a) GDPR.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to certain processing activities. Where processing is based on consent, you can withdraw that consent at any time with future effect. Registered clients can view and change most of their details themselves in the profile area, and can initiate deletion of their account directly there (see section 5).

If you believe that the processing of personal data violates data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority — typically the data protection authority of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

This Privacy Policy may be updated as the website's features, the services used, or legal requirements change. The current version is always available on this page.