Privacy

1. Data Controller

Kevin Luck – Kevin Luck PHOTOGRAPHY Odensehof 5 30457 Hannover Germany Email: hello@kevinluck.de

2. Privacy contact

For questions about the processing of your data or to exercise your rights, please use the contact form.

3. Hosting and technical provision

This website runs with Lufaro on a Hostinger VPS in Germany. Images are stored with Hetzner in Nuremberg. Technical connection data such as IP address, time, requested path and browser information is processed to deliver and protect the website. Security-relevant events are logged.

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable website operation).

4. Contact form

When you use the contact form, we process your name, email address, selected project type and message to handle your enquiry. The information is stored in Lufaro together with the source page, submission time and a random submission ID. To prevent abuse, we check the origin and frequency of requests using technical connection data.

Legal basis is Art. 6(1)(b) GDPR (initiation and handling of requests) and Art. 6(1)(f) GDPR (abuse prevention and operational stability).

5. Email delivery (SMTP)

For email communication, we use the hello@kevinluck.de mailbox with All-Inkl. Sender and recipient addresses, subjects, messages and any attachments are processed by the email provider. Submitting the website form initially stores the enquiry in Lufaro; it does not immediately send an email.

Legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

6. Server-side audience measurement

Lufaro counts successful page requests on the server. It stores the time, requested path, device class, host of an external referral and a pseudonymous daily identifier. The identifier is derived from the IP address and browser identifier with a daily changing random value held only in memory. The IP address and complete browser identifier are not stored in the analytics data. Visits can be linked within a day; this identifier cannot recognise visitors across days. Daily totals, page transitions and time intervals until the next request are calculated from the events. Audience measurement uses no analytics cookies, browser scripts or third-party beacons.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in understanding website usage and improving its content. Under Article 21 GDPR, you may object to this processing on grounds relating to your particular situation. Please use the contact form to exercise this right.

7. Colour mode and locally served content

When you select light or dark mode, your browser stores that preference locally. The stored value serves only the display and is not used for visitor measurement. It remains until you change it or clear this website’s data in your browser. Fonts and images are served through this website; no external font services are loaded when you visit a page.

Storing the colour mode you explicitly select provides the requested display (§ 25(2)(2) TDDDG). The legal basis for related processing is Article 6(1)(f) GDPR, our interest in consistently displaying your selection.

8. Recipients/categories of recipients

Data is received by the parties required for hosting, file storage and communication: Hostinger, Hetzner and, for email communication, All-Inkl. Access within our business is restricted to people authorised to handle enquiries and operate the service. Telegram is involved in direct Telegram communication. Claude (Anthropic) may be used for images and texts submitted for editorial work; depending on the selected feature, OpenAI, Black Forest Labs or Ideogram are available for image generation.

9. Retention periods

Contact and communication data is stored to handle your enquiry and, where applicable, fulfil an order. The deletion policy for enquiries that do not result in an order or booking provides for 24 months from receipt. Documents subject to statutory retention duties and data needed to establish, exercise or defend legal claims are excluded. Where statutory retention duties apply, the usual periods depend on the document type: six years for business and commercial correspondence, eight years for accounting vouchers and ten years for books and annual accounts (§ 147 AO and, where applicable, § 257 HGB). The period generally starts at the end of the relevant calendar year; ongoing relevant tax proceedings may require longer retention. The legal basis is Article 6(1)(c) GDPR. Data is deleted once its processing purpose and any necessary retention period have ended.

The deletion policy provides for seven days for individual audience-measurement events and 90 days for security events stored in the database. Regular deletion runs carry out this cleanup. Aggregated daily statistics without the visitor identifier remain for statistical analysis. Further technical logs are retained according to whether they remain necessary to investigate service disruptions, abuse or security incidents. Incident-related entries support the investigation and, where necessary, the establishment, exercise or defence of legal claims. They must be deleted once these purposes and any retention duties have ended. Lufaro’s backup policy provides for rolling rotation with 14 daily, 8 weekly and 12 monthly restore points. Older file versions are removed during the backup run after the intended retention period of 90 days. Deleted data may remain in backups until the relevant restore point is rotated out. Additional backups by the hosting and storage providers follow their backup and recovery procedures. You can delete the local colour-mode preference at any time by clearing this website’s data in your browser.

10. External links and Telegram

Instagram and LinkedIn are offered as external links. You access the respective service only when you open a link; its privacy notice then applies. The Telegram bot is used to edit submitted images and texts. The website contact form does not immediately transfer your enquiry to that bot. If you communicate directly through Telegram, Telegram processes the contents and connection data submitted there; processing outside the EU may occur. Depending on the editorial feature, submitted images or texts are transferred to Anthropic and image descriptions to the selected image provider. Processing outside the EU may also occur there. These editorial activities are separate from simply visiting the website.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

Please use the contact form to submit requests about your rights.

You also have the right to lodge a complaint with a data protection supervisory authority.

12. Automated decision-making

Automated decision-making including profiling according to Art. 22 GDPR does not take place.

Updated: 8 October 2026