Privacy Policy
Toggle your .
1. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Jannis T. Werner
Sonnenallee 127
12059 Berlin
Germany
Email: mail(at)jtw.photography
2. Hosting and server logs
This website is hosted on Lovable Cloud and delivered through the Cloudflare content delivery network. When you visit the site, technically necessary data is processed so the page can be delivered at all — in particular the IP address of the requesting device, the browser used (user agent), the requested URL, and the time of access. The legal basis is my legitimate interest in providing the website securely and reliably pursuant to Art. 6(1)(f) GDPR. In doing so, Cloudflare may set the technically necessary __cf_bm cookie, which serves to fend off automated attacks and expires after about 30 minutes. The hosting platform may additionally set a technically necessary cookie (__dpl) that ensures the current version of the site is delivered consistently.
3. Reach measurement and usage analytics
The hosting platform (Lovable Cloud) embeds an integrated analytics function on this website, served from the site's own (first-party) domain. Without your consent, it is limited to cookie-free reach measurement: when a page is loaded, I count which page was viewed, the referring page, the browser used (user agent), the browser language, and the country derived from your browser's time-zone setting. No cookies are set and no identifiers are stored on or read from your device; individual page views therefore cannot be linked into a usage profile, and no cross-site tracking takes place. The data is sent to an endpoint on the same domain and processed by the platform operator (Lovable) as a data processor for statistical evaluation. The legal basis is my legitimate interest in anonymous reach measurement pursuant to Art. 6(1)(f) GDPR; consent under § 25(1) of the German TDDDG (formerly TTDSG) is not required, as your device is not accessed. You can object to this measurement at any time (Art. 21 GDPR) by choosing "Decline" in the consent banner; an active Global Privacy Control (GPC) signal in your browser is automatically honoured as an objection.
Only if you agree via the consent banner is extended usage analytics additionally activated: to recognise you within a session, a session cookie (session-id, lifetime 30 minutes) is set and pseudonymous identifiers are stored in your browser's local storage — this enables metrics such as time on page and bounce rate. The extended analytics also includes session replay: interactions with the page — such as page views, mouse and scroll movements, and clicks — are recorded so that usage can be understood; any text you enter is masked. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the "Privacy settings" link in the website footer.
For visitors whose browser time zone suggests a location outside the EU, the EEA, and the United Kingdom, I activate the extended usage analytics without asking first. The legal basis is my legitimate interest in analysing website usage (Art. 6(1)(f) GDPR); the consent requirement of § 25 TDDDG is aimed at protecting devices within the European legal area. These visitors too can object to the analytics at any time — via the "Privacy settings" link in the footer ("Decline"); an active GPC signal is likewise honoured automatically and prevents the analytics from running in the first place.
4. Contact form
If you use the contact form, the data you provide (name, email address, and message) is stored in the website's database and forwarded to me by email via the delivery service Mailgun. The sender's IP address is stored only as a salted hash value in order to prevent abuse (rate limiting the number of messages). The legal basis for processing is the handling of your inquiry pursuant to Art. 6(1)(b) GDPR. The data is kept until your inquiry has been fully dealt with and is deleted on request.
5. Local storage
Your preferred language is stored in your browser's local storage under the key lang so the website appears in the correct language on your next visit. Your analytics consent decision (section 3) is also stored, under the key analytics-consent — this storage is strictly necessary to respect your choice (§ 25(2) no. 2 TDDDG). Both entries are purely functional and are not used to track your behaviour.
6. Fonts
All fonts used on this website are served locally from my own server. No connections are made to Google Fonts or other external font providers, and accordingly no data is transmitted to such providers.
7. External links
This website links to my Instagram profile. When you follow such a link, the privacy policy of the respective provider (Instagram) applies; I have no influence over their data processing.
8. Your rights
Within the limits of the law, you have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing (Art. 21). You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Last updated: July 2026