Legal
Privacy Policy
1. Controller
Felix Thomann, Felix Thomann Photography, Perhamerstraße 44, 80687 Munich, Germany, email: kontakt@felixthomann.de
2. General information on data processing
This website uses no cookies and no advertising trackers. Audience and performance measurement rely exclusively on cookieless, anonymous methods (see section 4). Personal data is processed only insofar as this is necessary to provide the website and to handle enquiries.
3. Hosting and server log files
This website is hosted by Vercel Inc. (USA). When you access the website, Vercel automatically processes information in what are known as server log files (including IP address, date and time of access, page requested, browser type). Processing is based on Art. 6 (1) (f) GDPR, in the legitimate interest of secure and stable operation of the website. A data processing agreement is in place with Vercel; as data may be transferred to the USA, the transfer is safeguarded by EU Standard Contractual Clauses.
4. Audience and performance measurement (Vercel Web Analytics and Speed Insights)
To evaluate website usage statistically and to monitor loading speed, I use the “Web Analytics” and “Speed Insights” services provided by Vercel Inc. (USA). Both services are cookieless: no cookies are set, no information is stored on your device and no information stored on it is read. They are therefore used without consent under section 25 TDDDG (the German Telecommunications Digital Services Data Protection Act). Only anonymous measurements are collected, in particular: the page requested and its route, the referring page (referrer), filtered query parameters, approximate geographic origin (country, region, city), operating system and browser including version, device type (desktop, tablet, mobile), estimated network speed, time of access and technical performance metrics (Core Web Vitals such as loading time, responsiveness and layout stability). Your IP address is not stored. In order to distinguish returning from new visits, Vercel derives a hash value from the incoming request, which is discarded automatically after no more than 24 hours. No recognition over a longer period, no cross-site tracking and no combination with other data takes place; I am unable to draw any conclusions about your identity. The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest lies in designing this website to meet actual demand and in optimising it technically. Vercel acts as a processor in this respect; a data processing agreement is in place. Insofar as data is transferred to the USA, the transfer is safeguarded by EU Standard Contractual Clauses. You may object to the processing under Art. 21 GDPR; independently of this, common script and tracking blockers prevent the measurement scripts from loading.
5. Contact form and email contact
If you write to me via the contact form or by email, the data you provide (name, email address, project type, content of the message) is processed solely to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR. To send the notification triggered by the form, I use the service provider Resend (Resend, Inc., USA) as a processor; the data mentioned is transmitted to Resend and transferred to the USA (safeguarded by EU Standard Contractual Clauses). The email mailbox is hosted by IONOS SE (Germany). The data is deleted as soon as it is no longer required for processing and no statutory retention obligations prevent this.
6. Spam protection in the contact form (Cloudflare Turnstile)
To protect the contact form against automated requests and abuse (spam), I use the “Turnstile” service provided by Cloudflare, Inc. (USA) on the contact page. When you open the contact page, a script is loaded from a Cloudflare server; in the process your IP address is transmitted to Cloudflare and technical characteristics of your device and browser are evaluated in order to distinguish human from automated input. According to the provider, Turnstile does not use the information collected for advertising purposes or for cross-site tracking. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in preventing spam and operating the contact form securely. As data may be transferred to the USA, the transfer is safeguarded by EU Standard Contractual Clauses. Further details are set out in Cloudflare’s privacy policy.
7. Protection against abuse (rate limiting)
To prevent an excessive number of submissions via the contact form, the number of requests per IP address is technically limited (rate limiting). For this purpose your IP address is processed for a short period (a maximum of two hours) and, to that end, stored with the service provider Upstash, Inc. (USA) as a processor in a cache (Redis). No storage or evaluation beyond this takes place; the data is deleted automatically once the time window has elapsed. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse). Insofar as data is transferred to a third country, this is safeguarded by EU Standard Contractual Clauses.
8. Fonts
This website uses locally served fonts (self-hosted via next/font). Loading the fonts establishes no connection to servers operated by Google or other third parties, and no data is transmitted to third parties.
9. Your rights
In relation to the controller you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object to processing (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority; in Bavaria: Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.
10. Last updated
This privacy policy is dated July 2026 and will be updated if the functionality of the website changes.