Skip to content
Newpic Photography

Privacy policy

Updated: 27 September 2026.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

newpic photography
Owner: Toni Kretschmer
Bosewitzer Straße 22
01259 Dresden
Germany
Telephone: 0351 – 25655329
Email: info@newpic.eu

(referred to below as “we” or “us”).

This privacy policy describes the processing of personal data on newpic.eu, including its language versions. Other websites are outside its scope. It also covers enquiries and contracts initiated through newpic.eu. The actual privacy notices for booking portals or other independent websites must be checked separately.

General information on data processing

  1. We process personal data only to the extent necessary to provide a functioning website, our content and services, perform contracts, safeguard our legitimate interests, or where the user has consented.
  2. The legal bases for processing include, in particular, Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (performance of a contract and pre-contractual steps), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests).
  3. We use service providers to operate the website and deliver images. Where they process personal data on our behalf, the requirements of Article 28 GDPR apply.
  4. Personal data are transferred to third countries outside the EU/EEA only where the European Commission has determined an adequate level of protection (adequacy decision), we have agreed appropriate safeguards with the recipient (for example EU standard contractual clauses), or a statutory permission or consent applies.

Website delivery and server log files

  1. When newpic.eu is accessed, the web server processes connection data technically required to deliver the requested page. This does not by itself mean that those data are stored in customer access logs.
  2. The website is hosted by ALL-INKL.COM. Customer-managed access logs and web statistics are disabled in our hosting account. The provider may process connection and security data needed to deliver and protect the service. Retention depends on the technical purpose and any statutory duties; we do not assert an unverified fixed period. See the provider’s privacy information for its own processing.

Image delivery via Optimole

  1. We use Optimole to deliver optimised images. Your browser connects to an Optimole domain; in particular, your IP address, user agent and requested image URL are transmitted. Our interest is functional and efficient image delivery (Article 6(1)(f) GDPR).
  2. Optimole states that image requests are logged at CDN level using the visitor's IP address and user agent to count visits. The stated 24-hour combination is a counting method, not a verified deletion period. According to the provider documentation, images are delivered via Amazon CloudFront's global CDN.
  3. The global CloudFront network may deliver images from locations outside the EEA. The list of CDN edge locations does not itself establish the storage location or a specific deletion period. See the provider’s image-delivery information for further details.

Cookies and consent management (TDDDG / GDPR)

  1. On newpic.eu, cookies and similar technologies are used for technically necessary functions and consent management. This policy does not itself activate analytics or marketing services.
  2. Storing information on your device or accessing it generally requires consent under Section 25(1) TDDDG. The exception in Section 25(2) TDDDG applies only in the cases specified there, including functions strictly necessary for a service expressly requested by you. Processing personal data additionally requires a legal basis under the GDPR.
  3. Real Cookie Banner manages and documents your choices. The consent cookie is set to 365 days; documented consents are configured to be retained for up to 120 months. Storage of the full IP address is disabled. You can change your choice via the website’s cookie settings.
  4. Optional services will only be activated after technical and legal review, appropriate information in this policy and the consent tool, and effective consent control. Merely mentioning a planned service does not constitute consent.

Contact by email, telephone or contact form

  1. If you contact us by email, telephone or through a contact form, we process the information you provide (such as your name, contact details and enquiry) to handle your request.
  2. Where your enquiry concerns the initiation or performance of a contract, the legal basis is Article 6(1)(b) GDPR. Otherwise, the basis is Article 6(1)(f) GDPR (legitimate interest in handling enquiries).
  3. The data are deleted when they are no longer needed to handle the enquiry, unless statutory retention duties apply.

Contract performance (photo shoots, workshops, studio and equipment rental, image sales)

  1. To initiate and perform contracts, we process, in particular, master data (such as names, addresses and contact details), contract and payment data (such as booked services, prices, payment method and payment status), communications (such as emails, briefs and agreements) and, where applicable, data concerning people photographed (such as names and specific instructions).
  2. The legal basis is Article 6(1)(b) GDPR (performance of a contract and pre-contractual steps). Where legal obligations apply (for example tax record-keeping), Article 6(1)(c) GDPR also applies.
  3. We retain contract and accounting data for statutory retention periods (generally six to ten years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code). We delete other communication data when no longer required to perform the contract or in connection with warranty or liability claims.

Online galleries and file delivery (Picdrop)

  1. We use the Picdrop platform, among other means, to deliver images and allow image selection (PicDrop GmbH, Am Kupfergraben 4/4a, 10117 Berlin, Germany).
  2. Picdrop processes personal data on our behalf, such as customer email addresses or names (for gallery invitations), IP addresses, timestamps and technical metadata when a gallery is accessed, and possibly comments, ratings or selections in the gallery.
  3. The owner has confirmed that NEWPIC uses Picdrop under a data processing agreement.
  4. The legal basis is Article 6(1)(b) GDPR where you use our services and we provide images for selection or download. Article 6(1)(f) GDPR (legitimate interest in efficient and secure delivery of image files) may also apply.

Payment processing (PayPal, SumUp)

PayPal

  1. Depending on the selected payment method, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal is an independent controller under the GDPR.
  2. We transmit data required to process the payment to PayPal (for example the amount, payment reference and customer number). You provide additional data directly to PayPal.
  3. The legal basis is Article 6(1)(b) GDPR. PayPal's privacy policy applies to its further processing: https://www.paypal.com/de/legalhub/paypal/privacy-full

SumUp

  1. For payments via SumUp (for example card payments on site), payment data are processed by SumUp Limited, Ireland/UK. SumUp is an independent controller.
  2. We transmit the data required to process the payment to SumUp (for example the amount and terminal ID). You provide further data directly to SumUp.
  3. The legal basis is Article 6(1)(b) GDPR. For further details, see SumUp's privacy policy: https://www.sumup.com/de-de/datenschutz/

Social media (links and embedded content)

  1. Newpic.eu links to external profiles, including Instagram and LinkedIn.
  2. Merely loading a page containing an ordinary link does not automatically contact the linked service; after a click, the external provider processes data under its own notice.
  3. Embedded external content may connect your browser to its provider when it loads. Where we use such content, we identify it at the element and control services requiring consent through the consent tool.

Photography, portfolio use and social media

  1. Our photographic work involves creating images of people, places and objects. These images may constitute personal data.
  2. The legal basis is generally Article 6(1)(b) GDPR (performance of a contract) in conjunction with Sections 22 and 23 of the German Art Copyright Act (KUG), supplemented by Article 6(1)(f) GDPR (legitimate interest in documentation and artistic design).
  3. Where we use images for our own advertising (for example a website portfolio, social media or printed portfolios), we rely on the depicted person's consent (Article 6(1)(a) GDPR and Section 22 KUG), or on a legitimate interest under Article 6(1)(f) GDPR in conjunction with Section 23 KUG, provided the depicted person's overriding interests do not prevent this.
  4. Customers may object to planned use for our own advertising under their contract or withdraw consent at any time with future effect. In that case we will no longer use the images concerned for our own future advertising and will remove them from existing online publications where technically and organisationally possible.

Retention and deletion

  1. We retain personal data only for as long as required for the relevant purpose. In particular, contract and accounting data are retained for commercial- and tax-law periods (generally six to ten years); communications for as long as required to handle them or during limitation periods; and image files according to the agreement and our own archiving interest (artistic archive, portfolio), potentially for a longer period.
  2. When purposes cease to apply or statutory retention periods expire, the data are regularly deleted or anonymised.

Your rights as a data subject

Under the GDPR you have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), withdrawal of consent (Article 7(3)) and objection (Article 21). You may contact us at any time to exercise your rights (see the controller's contact details above).

Right to object (Article 21 GDPR)

  1. You may object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Article 6(1)(e) or (f) GDPR.
  2. We will then cease processing the personal data unless we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or unless processing is necessary to establish, exercise or defend legal claims.
  3. Where personal data are processed for direct marketing, you may object at any time to processing for that purpose. Following an objection, the data will no longer be processed for direct marketing.

Right to lodge a complaint with a supervisory authority

  1. You may complain to a data-protection supervisory authority about our processing of your personal data (Article 77 GDPR).
  2. In particular, you may contact the authority of the federal state in which you live or the authority responsible for our registered location. One authority responsible for us is:

Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17
01067 Dresden
https://www.datenschutz.sachsen.de/kontakt.html

Requirement to provide data

  1. During contract initiation and performance, you must provide the personal data required to establish and perform the contractual relationship and its obligations, or that we are legally required to collect.
  2. Without these data, we will generally be unable to enter into or perform a contract with you.

Automated decision-making and profiling

We do not carry out automated individual decision-making, including profiling, within the meaning of Article 22 GDPR.

Changes to this privacy policy

  1. We reserve the right to amend this privacy policy if the law, our services or our data processing changes. The version current at the time of your next visit will then apply.
  2. After publication, the latest version will be available on newpic.eu.