Privacy Policy

Scope of this English version: Brad Watson Studio (Bradley Watson) is established in Germany. This translation is provided for the convenience of international, English-speaking clients. Processing is governed directly and uniformly by the General Data Protection Regulation (EU) 2016/679 ("GDPR"), which applies in the same way in every EU/EEA member state, supplemented where relevant by German national law, since that is the law applicable to the controller. If you are located in another EU/EEA member state, you retain the right to lodge a complaint with the supervisory authority of your own country of residence, workplace, or the place of the alleged infringement (Art. 77 GDPR) — this is explained further below. In case of any discrepancy between this English version and the German original, the German version shall prevail.

1. Privacy at a glance

General information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information on the subject of data protection can be found in our privacy policy set out below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Their contact details can be found in the section “Information about the controller” in this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, from information you provide to us. This may, for example, be data you enter into a contact form.

Other data is collected automatically, or after you give your consent, by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated via the website, the data transmitted will also be processed for contract offers, orders, or other requests.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You are welcome to contact us at any time regarding this or any other questions about data protection.

2. Hosting

We host the content of our website with the following provider:

IONOS

The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (“IONOS”). When you visit our website, IONOS collects various log files, including your IP address. Details can be found in IONOS’s privacy policy:

https://www.ionos.de/terms-gtc/terms-privacy

The use of IONOS is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable possible presentation of our website. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting), the applicable national law implementing the ePrivacy Directive. Consent can be revoked at any time.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

Please note that data transmitted over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:
Brad Watson Studio
Bradley Watson
Rennfeld 16
91792 Ellingen
Deutschland

Email: info@bradwatsonstudio.com
Phone: +49 175 1474737

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (such as names, email addresses, etc.).

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion, or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place once those reasons no longer apply.

General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR, or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is additionally based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is additionally based on the applicable national law implementing the ePrivacy Directive. Consent can be revoked at any time. Where your data is required for the performance of a contract or the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, insofar as your data is required to fulfil a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Data processing may also take place on the basis of our legitimate interest under Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business activities, we work with various external parties. In some cases, this requires the transfer of personal data to these external parties. We only pass on personal data to external parties where this is necessary for the performance of a contract, where we are legally obliged to do so (e.g. disclosure of data to tax authorities), where we have a legitimate interest under Art. 6(1)(f) GDPR in the disclosure, or where another legal basis permits the data transfer. Where we use processors, we only pass on personal data of our customers on the basis of a valid data processing agreement. In the case of joint processing, a joint controller agreement is concluded.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You may withdraw consent you have already given at any time. The lawfulness of data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

WHERE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work, or the place of the alleged infringement. This right exists regardless of any other administrative or judicial remedy. This applies equally whether you are located in Germany or in any other EU/EEA member state — you may always contact your own national data protection authority.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

Access, rectification, and erasure

Within the scope of applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, a right to rectification or erasure of this data. You are welcome to contact us at any time regarding this or any other questions about personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You may contact us at any time for this purpose. The right to request restriction of processing applies in the following cases:

If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data has occurred/is occurring unlawfully, you may request the restriction of data processing instead of erasure.

If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data — apart from being stored — may only be processed with your consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address line changes from “http://” to “https://” and by the lock icon in your browser line.

If SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Contact form

If you send us enquiries via the contact form, the information you provide in the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not share this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where this has been requested; consent can be revoked at any time.

The data you enter in the contact form remains with us until you ask us to delete it, you revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions — in particular retention periods — remain unaffected.

Enquiries by email or telephone

If you contact us by email, telephone, or fax, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where this has been requested; consent can be revoked at any time.

Data you send to us via contact enquiries remains with us until you ask us to delete it, you revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions — in particular statutory retention periods — remain unaffected.

Contact via WhatsApp

On our website we provide a link that allows you to contact us directly via the messaging service WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (“WhatsApp”).

Simply visiting our website does not result in any data being transmitted to WhatsApp. Only once you actively click the link and initiate contact with us are the data you provide (e.g. your phone number, name, profile picture, message content, and technical metadata) processed by WhatsApp/Meta in order to technically enable the message exchange. This may involve the transfer of data to the USA.

The data you send us is processed to handle your enquiry on the basis of Art. 6(1)(b) GDPR, where your enquiry relates to the initiation or performance of a contract, and otherwise on the basis of our legitimate interest in fast and straightforward communication with our customers and prospective clients (Art. 6(1)(f) GDPR).

If you would prefer not to communicate via WhatsApp, you can always reach us instead via the contact form, by email, or by phone.

Further information on WhatsApp’s data processing can be found in WhatsApp’s privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

Invoicing via Lexware

To create and send invoices for our services, we use the software Lexware Office by Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg im Breisgau, Germany (“Lexware”). As part of invoicing, the data required for this purpose is processed, in particular name, address, email address, the service provided, the invoice amount, and, where applicable, your bank details.

Processing is carried out to fulfil the contract in place with you (Art. 6(1)(b) GDPR) and to comply with statutory retention obligations under German tax and commercial law, in particular Section 147 of the German Fiscal Code (Abgabenordnung) and Section 257 of the German Commercial Code (Handelsgesetzbuch) (Art. 6(1)(c) GDPR). These retention obligations apply to us as a business established in Germany, regardless of where you as the client are located. A data processing agreement pursuant to Art. 28 GDPR is in place with Lexware.

Your invoicing data is stored for the duration of the statutory retention periods (generally six to ten years) and is deleted afterwards, unless further statutory retention obligations apply.

Image delivery via Picdrop

o deliver the finished photo and video files to our clients, we use the platform Picdrop by PicDrop GmbH, Am Kupfergraben 4/4a, 10117 Berlin, Germany (“Picdrop”). A password-protected gallery is set up via Picdrop for each project, through which you can view and download the images we have created.

As part of this use, your name and email address are processed to set up access, as are the image files themselves, insofar as they contain personal data — for example, because people are recognisable in the images.

Processing is carried out to fulfil the contract in place with you (Art. 6(1)(b) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Picdrop. Picdrop processes data on servers located within Germany; no transfer to third countries takes place as a result.

The access link to each gallery is automatically deactivated after 30 days. The gallery and the data it contains are then deleted, unless a different arrangement has been agreed with you beforehand.

Client selection via Capture One online galleries

To let our clients select images — for example, as part of the initial picture selection after a shoot — we additionally use the online gallery feature of the Capture One software, provided by Capture One A/S, Roskildevej 39, 2000 Frederiksberg, Denmark (“Capture One”).

An online gallery is set up for each project, through which you can view and mark the images available for selection. As part of this, your name and email address are processed to set up access, as are the image files themselves, insofar as they contain personal data — for example, because people are recognisable in the images.

Processing is carried out to fulfil the contract in place with you (Art. 6(1)(b) GDPR). When using the relevant Capture One cloud features, we act as the controller and Capture One acts as processor; according to Capture One, the corresponding data processing agreement pursuant to Art. 28 GDPR forms part of the subscription agreement concluded with Capture One. Capture One uses, among others, Microsoft Azure as a hosting provider for its cloud services. According to Capture One, this may in certain cases involve the transfer of personal data to countries outside the EU/EEA; where this occurs, such transfers are safeguarded through the European Commission’s Standard Contractual Clauses together with appropriate technical and organisational measures.

Galleries and the data they contain are retained for 30 days after completion of the selection process and are then deleted, unless a different arrangement has been agreed with you beforehand.