Legal

Privacy Policy

The protection of your personal data is very important to me. This Privacy Policy explains how personal data is collected, processed and used on this website in accordance with the General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this website is:
Lukas Mari, Etrichstraße 17/21, 1110 Vienna, Austria
Email: photo@one-more-light.com

2. General information

Personal data is processed exclusively on the basis of the applicable legal provisions (GDPR, Austrian Data Protection Act). Personal data is any information that can be used to personally identify you.

3. Access data / server log files

When visiting this website, the hosting provider automatically collects and stores information in so-called server log files. These include: IP address (anonymised where possible), date and time of access, browser type and version, operating system, referrer URL. This data is processed to ensure the proper operation, security and stability of the website. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest).

4. Hosting

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare delivers the site through a global server network; the access data described in section 3 is processed by Cloudflare on my behalf. Where data is transferred to the United States, this is based on the EU standard contractual clauses and Cloudflare's certification under the EU-US Data Privacy Framework. More information: cloudflare.com/privacypolicy

4a. Web analytics

This website uses Cloudflare Web Analytics, a privacy-friendly measurement service by Cloudflare, Inc. It works without cookies, stores nothing on your device and does not track you across websites. Collected are aggregated usage data such as pages visited, referrer, country, browser and device type. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in understanding how this website is used). More information: cloudflare.com/web-analytics

5. Contact by email or form

If you contact me by email or through the contact form, the data you provide will be stored for the purpose of processing your request and in case of follow-up questions. The following data may be processed: name, email address, message content. This data is not passed on except as described below. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract or pre-contractual measures).

The contact form is processed by Web3Forms (Backyard Innovations Pvt. Ltd.), which forwards the submitted data to my email address on my behalf. Data may be processed on servers outside the EU; the transfer is based on the EU standard contractual clauses. Web3Forms does not use the data for its own purposes. More information: web3forms.com/privacy

6. Online shop / orders

When purchasing prints or zines via this website, personal data necessary for processing the order will be collected and processed, including: name, billing and shipping address, email address. This data is processed exclusively for order handling, delivery and accounting purposes. The legal basis is Art. 6 para. 1 lit. b GDPR. Data is only passed on to third parties where necessary to fulfil the contract (e.g. payment providers, shipping services).

7. Storage period

Personal data is stored only for as long as necessary for the respective purpose. Enquiries by email or contact form are deleted once they have been dealt with conclusively and no statutory retention obligations apply. Order data is retained for the duration of the statutory retention periods (generally seven years under tax and commercial law). Server log files are deleted or anonymised automatically after a short time.

8. Cookies

This website does not use cookies. Nothing is stored on your device, and no consent banner is needed. If this ever changes, this policy will say so, and your consent will be obtained where the law requires it.

9. Your rights

You have the right to: access your stored personal data (Art. 15 GDPR), rectification of inaccurate data (Art. 16 GDPR), erasure of your data (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and to object to processing (Art. 21 GDPR). If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority.

10. Supervisory authority

The competent data protection authority in Austria is: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria. dsb.gv.at

11. Data security

Appropriate technical and organisational measures are taken to protect personal data against loss, misuse or unauthorised access.

12. Changes to this privacy policy

This Privacy Policy may be updated from time to time to reflect legal or technical changes. The current version is always available on this website.