Data protection

1. Controller and Contact

RLmedia · Fotobox NB
Owner: Robert Latendorf
Warliner Straße 4
17039 Neuenkirchen, Germany
Phone: +49 395 5718178-0
Email: info@fotobox-nb.de

You can address your data protection concerns and requests to exercise your rights to these contact details.

2. Types of Data, Purposes, and Legal Bases

Depending on the service used, we process contact and master data, event and contract details, messages, photo and video recordings, possibly audio recordings and voluntarily provided names or motif texts, as well as technical access, device, and security data. Not every service requires all of this data.

• Consent: Art. 6 para. 1 lit. a GDPR, for example, for voluntary AI photo actions, separate publications, or additional services requiring consent.
• Inquiry and Contract: Art. 6 para. 1 lit. b GDPR for processing contract-related inquiries and fulfilling contracts with the data subject.
• Legal Obligations: Art. 6 para. 1 lit. c GDPR, particularly for statutory proof and retention obligations.
• Legitimate Interests: Art. 6 para. 1 lit. f GDPR, particularly for secure website operation, prevention of abuse, and processing general communication. Your conflicting interests and rights must be taken into account.

For storing information on your device or accessing it, Section 25 TDDDG also applies. Processes requiring consent require your consent; the legal exception particularly concerns technically absolutely necessary processes.

3. Hosting, Server Access, and Technical Security

Our website and the event galleries we provide are hosted by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany. Our storage of original photos, results, and galleries takes place on servers in Germany. Separate processing by AI providers is described in Section 9.

When accessing the site, IP address, time, requested file or page, HTTP status, browser and operating system information, and the referring page may be processed in server logs. This serves for delivery, error analysis, and security based on Art. 6 para. 1 lit. f GDPR. Security-relevant logs may be required longer for clarifying specific incidents and for legal prosecution.

Hosting provider information: Data protection at Alfahosting.

The website uses HTTPS for encrypted transmission. For the protection of the WordPress installation, we use, among others, Wordfence from Defiant, Inc., USA. In this process, IP addresses, access attempts, and security-related events may be processed to detect and ward off attacks. Depending on the security function used, data may be transmitted to Defiant. The legal basis is our legitimate interest in protecting the website according to Art. 6 para. 1 lit. f GDPR. Information: Wordfence Privacy Policy.

4. Cookies, Language, and Consent Settings

We use CookieYes to manage your privacy settings. The provider is CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. Your selection and the information required for its proof can be stored so that your decision is taken into account. The management and documentation of consents are based on Art. 6 para. 1 lit. c GDPR in conjunction with statutory proof obligations, additionally Art. 6 para. 1 lit. f GDPR for a functional consent mechanism.

Technically necessary storage and access are governed by Section 25 para. 2 TDDDG. For other storage and access, your consent according to Section 25 para. 1 TDDDG is generally required; the associated processing of personal data is governed in particular by Art. 6 para. 1 lit. a GDPR.

You can reopen, change your selection, and revoke granted consents for the future via the cookie settings button. Details on the services listed there and storage times can be found in the settings. Deleting browser cookies may result in your selection being requested again.

For multilingual display, we use WPML. The selected language can be stored to show you the corresponding language version. Cache and display functions, including WP Rocket, serve for fast and stable delivery of the website.

Provider information: Data protection at CookieYes.

5. Inquiries, Forms, Email, and Bookings

If you contact us, we process the information you provide to answer and process your request. This may include your name, email address, phone number, company, event date, event location, desired modules, and your message. The website uses WordPress forms with WPForms, among others, for this purpose.

For an inquiry regarding a booking or the execution of a contract, Art. 6 para. 1 lit. b GDPR is the legal basis. For other communication, we rely on Art. 6 para. 1 lit. f GDPR and our interest in processing your request. If you act on behalf of a company, business communication may also be based on this legitimate interest. Statutory retention obligations remain in effect.

Mandatory fields are marked in the respective form. Without necessary contact or event details, we may not be able to process your inquiry meaningfully. Voluntary information is not required for using the website.

Contact Form Spam Protection

We use the integrated protection features of WPForms to prevent automated and abusive inquiries, including a technical check and a minimum submission time. Google reCAPTCHA is not used in the contact form. The use of the form does not depend on consent to optional services. The processing required for this serves our legitimate interest in secure and reliable processing of inquiries based on Art. 6 para. 1 lit. f GDPR. For technically absolutely necessary storage or access operations, Section 25 para. 2 TDDDG applies.

6. Photo Booths, Photo Mirrors, and Other Event Modules

When voluntarily using our event services, photos, videos, or, with appropriate modules, audio recordings may be created. The processing serves the desired result, for example, an instant print, digital download, photo album, audio guestbook, or an event gallery. Depending on the module, voluntary additional information such as a first name, a motif text, or an email address may be processed.

Contract processing with the booking customer is based on Art. 6 para. 1 lit. b GDPR. The participation of guests and the consent required for this are to be distinguished: a contract with the organizer does not automatically replace the consent of the depicted persons. For voluntary recording and design actions, Art. 6 para. 1 lit. a GDPR applies in particular.

For events where we act exclusively on behalf of an organizer, the organizer determines the purposes and scope of processing. In this case, their data protection notices and the agreed data processing agreements also apply. We provide support for data protection inquiries within our area of responsibility.

7. Galleries, QR Downloads, Slideshow, and Publication

Online galleries, single and collective downloads, and QR code links can be used for providing results. Depending on the booked service, images can also be displayed on an event wall, a screen, via a projector, or as a photo mosaic. The scope, access, and recipient group depend on the respective service and event.

Please only pass on gallery access data and personal download links to authorized persons. Anyone who receives a correspondingly released access or link may be able to access and download the assigned content. Legally downloaded copies on third-party devices are not automatically removed by deletion in our gallery.

Public presentation or promotional publication is a separate processing purpose. If consent is required for this, it must be obtained separately; mere participation in a photo action is not a blanket release for publication on our website or in social networks.

8. Voluntary Contact Details and Lead Actions

In individual company promotions, participants can voluntarily provide contact details for a download, a prize draw, or a desired further contact. Which information is transmitted to which organizer and what they intend to use it for must be identifiable in the respective promotion.

Providing an image and consenting to advertising are different purposes. Promotional contact requires the respective legal basis; a separately given consent can be revoked at any time for the future. For further processing by the named organizer, their data protection notices apply.

9. AI Images, Caricatures, and AI Videos

For AI sketches, caricatures, and the motif photos of our Digital Booth, we use OpenAI. For the AI processing of recorded video clips, we use Runway AI, Inc. The photos or clips selected for this and the necessary design specifications are transmitted to the respective service for processing. The results are then provided for the selected event function.

AI processing can change faces, clothing, accessories, body representation, and surroundings. Results may differ from the original and contain errors. Only use recordings for which you are authorized to process; for group recordings, the rights and consents of all affected persons must be observed. For minors, necessary declarations from legal guardians must be considered.

We base the voluntary processing of participant recordings for the selected AI function particularly on Art. 6 para. 1 lit. a GDPR. Without the required recordings and design specifications, the respective AI function cannot be provided. The mere use of the information pages does not require the transfer of your own photos or clips to these AI services.

The storage of our galleries in Germany does not mean that all AI processing takes place exclusively in Germany or the EU. For OpenAI and Runway, as well as their subcontractors, processing outside the European Economic Area, particularly in the USA, may occur. The decisive factors are the product used, the contractual regulations, and the respective settings; exclusively German or European AI processing is not guaranteed here.

For the business processing of EEA data, OpenAI generally provides OpenAI Ireland Limited as the contractual partner. Regulations on processing on behalf of and international transfers can be found in the OpenAI Data Processing Addendum. Further information: OpenAI Subprocessors and Runway Privacy Policy.

Notes from the AI providers on storage and further use

For its API, OpenAI states that transmitted data is not used for model training by default unless corresponding data sharing is enabled. Security and abuse logs may be stored for up to 30 days under the published standard rules, or longer in justified exceptional cases. Further storage depends on the function used. Details: OpenAI API data controls and retention rules.

The general Runway Terms of Service provide for possible use of inputs and outputs to improve and train the systems. Different provisions may result from separate agreements for enterprise customers. Whether and which different provisions apply to a specific action must be clarified before it is carried out. No general assurance is given here that no further use takes place at Runway.

The deletion periods for our own gallery and QR downloads do not automatically apply to external AI services. The relevant terms of use do not replace the data protection agreements and information required in each case.

A blanket assurance that external providers delete all data immediately after an event or process it exclusively in Germany is not given. You can request information on the processing used for a specific event via our data protection contact.

10. Reviews, Trustami, and ReviewForest

Our website integrates review displays from Trustami GmbH, Friedrich-Wilhelm-Straße 68, 12103 Berlin, Germany. When loading the review display, IP address, browser information, and the accessed page may be transmitted to Trustami. The purpose is to present summarized reviews and information about experiences with our service. We only load this display after your consent in the “External Content” category. The legal basis is Art. 6 para. 1 lit. a GDPR; insofar as information is stored or read on your device, additionally Section 25 para. 1 TDDDG. You can change your selection at any time via “Cookie Settings”.

For our review and tree planting campaign, we refer to ReviewForest. If you access an external review or ReviewForest link, the privacy policy on the destination page applies to the processing there. For embedded external content, technically required connection data is already transmitted to the respective provider when loading. Further information: Trustami and ReviewForest.

11. External Links and Social Networks

Our website contains links to partners, review portals, and social networks. An ordinary link only leads to the destination page when it is clicked. There, the respective provider can process data under its own responsibility, especially if you are logged in there. This applies, for example, to the linked profiles on Facebook, Instagram, LinkedIn, TikTok, YouTube, and X. For embedded content, in contrast to a simple link, its loading process must already be considered.

12. Recipients and International Transfers

Data may be transmitted, as far as necessary for the respective purpose, to hosting, communication, security, and AI service providers, as well as to the organizer named in a specific event action. In addition, tax advisors, payment processing, authorities, or other legally authorized recipients may be considered within the framework of contract processing or legal obligations. Publication is to be distinguished from this and requires its own legal basis.

When processing by service providers on our behalf, the requirements of Art. 28 GDPR must be observed. For transfers to countries outside the EEA, Art. 44 et seq. GDPR also apply. Depending on the provider, a relevant adequacy decision or suitable safeguards, in particular EU standard contractual clauses, may be considered. Consent to AI use does not generally replace these requirements. You can request information on the safeguards relevant for the specific use and, if applicable, a copy from us.

13. Storage and Deletion

• Event Galleries: Online provision is for six months after the event.
• Photos for QR Code Download: These are provided for four weeks.
• Other Local Event Recordings: If not required for the agreed gallery or QR download, they will be deleted after the event.
• Inquiries and Communication: Storage depends on the processing of the request and any subsequent contract fulfillment. Data will be deleted when it is no longer required for these purposes and no legal obligations or overriding legitimate reasons prevent deletion.
• Contract and Accounting Documents: Retention is based on the respective legal document type. Regularly, eight years apply to booking receipts, six years for commercial and business letters subject to retention, and ten years for certain books and financial statements. Deviating legal obligations and necessary retentions for legal defense must be considered.

Longer processing for another purpose requires its own legal basis. The mentioned provision periods for our galleries and QR downloads are not a guarantee of identical storage times with external AI providers. You can contact us for necessary deletion there and to exercise your rights. Server, security, and backup data are subject to their respective technical security purpose and the relevant necessity and deletion criteria.

14. Your Rights

Under the respective legal conditions, you have the right to information according to Art. 15 GDPR, rectification according to Art. 16, erasure according to Art. 17, restriction of processing according to Art. 18, and data portability according to Art. 20 GDPR. You can revoke a given consent at any time with effect for the future. The lawfulness of processing until revocation remains unaffected.

Objection: You can object to processing based on Art. 6 para. 1 lit. e or f GDPR for reasons arising from your particular situation, according to Art. 21 GDPR. You can object to processing for direct marketing at any time without having to state specific reasons.

Please address your concerns to info@fotobox-nb.de. To assign an event image, the event, date, and possibly an image or download reference will help us. Please only send the necessary information for this purpose.

15. Complaint to a Supervisory Authority

You can lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority responsible for our registered office is in particular:

The State Commissioner for Data Protection and Freedom of Information Mecklenburg-Vorpommern
Schloss Schwerin, Lennéstraße 1
19053 Schwerin
Phone: +49 385 59494-0
Email: info@datenschutz-mv.de
Contact and complaint options

16. Automated Decisions and Updates

The AI functions serve the creative design of image and video content. This is not associated with an exclusively automated decision with legal effect or a similarly significant impairment within the meaning of Art. 22 GDPR.

We adapt these notices if our processing or legal requirements change. Please also note the information and consent details for the respective event action used.