1. An overview of data protection
The following information provides an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information is provided in the privacy policy below.
2. Information about the responsible party (controller)
The party responsible for processing data on this website within the meaning of the GDPR is:
DevMonics UG (haftungsbeschränkt) represented by the managing directors Dean Kidder and Dominik Kriehuber Enkircher Str. 44 13465 Berlin Germany Local court (Amtsgericht) Charlottenburg, HRB 291111 B E-mail: info@devmonics.com Phone: +49 40 57291986
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.
3. Two roles: controller and processor
Digital Souvenirs acts in two clearly separated roles under data protection law, depending on the data concerned:
This website, contact requests and business communication. For these, DevMonics UG (haftungsbeschränkt) is the controller within the meaning of Art. 4(7) GDPR and determines the purposes and means of processing itself.
Photos, videos and guest data from the souvenir operation. This data is created at an experience location. The controller is solely the respective experience location (or the respective photographer) that uses Digital Souvenirs. DevMonics UG (haftungsbeschränkt) merely provides the technical platform and processes this data only as a processor pursuant to Art. 28 GDPR, strictly on instructions, on the basis of a data processing agreement and without any use for its own purposes. The required consent of the depicted persons is obtained by the location or photographer, not by Digital Souvenirs.
Are you a guest of an experience location? If you received a link to a personal gallery with your recordings after a visit, then: the controller for this data is the location you visited, not Digital Souvenirs. For access, rectification, erasure or withdrawal of consent regarding these recordings, please contact that location directly. Digital Souvenirs supports the location but, as a processor, may not decide about your data independently.
4. Hosting
Hetzner. We host the content of our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. For details, see Hetzner's privacy policy: https://www.hetzner.com/de/legal/privacy-policy/. The use is based on Art. 6(1)(f) GDPR; we have a legitimate interest in the most reliable provision of our website. A data processing agreement (DPA) is in place with Hetzner.
5. General information and mandatory information
Legal basis for processing. Where you have consented, we process your data on the basis of Art. 6(1)(a) GDPR or Sect. 25(1) TDDDG; consent can be revoked at any time. If your data is required for the performance of a contract or pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. To comply with legal obligations we rely on Art. 6(1)(c) GDPR; otherwise on our legitimate interest under Art. 6(1)(f) GDPR.
Storage duration. Unless a more specific storage period is stated in this policy, your personal data remains with us until the purpose for processing no longer applies. Upon a justified request for erasure or revocation of consent, your data will be deleted unless other legally permissible reasons for storage exist (e.g. tax or commercial retention periods).
Recipients of personal data. We only disclose personal data to external parties where required for the performance of a contract, where we are legally obliged to do so, where we have a legitimate interest, or where another legal basis permits. When using processors, we disclose data only on the basis of a valid data processing agreement.
Revocation of consent. Many processing operations are only possible with your consent. You can revoke consent already given at any time; the lawfulness of processing carried out until revocation remains unaffected.
Right to object (Art. 21 GDPR). If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation. If your data is processed for direct advertising, you have the right to object at any time; thereafter your data will no longer be used for direct advertising (Art. 21(1) and (2) GDPR).
Right to lodge a complaint. In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged violation.
Competent supervisory authority. The data protection supervisory authority responsible for us under the GDPR is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information) Alt-Moabit 59-61 10555 Berlin Germany Phone: +49 30 13889-0 E-mail: mailbox@datenschutz-berlin.de Web: https://www.datenschutz-berlin.de
Further rights. You also have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may contact us at any time in this regard.
SSL / TLS encryption. For security reasons, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the address line switching from "http://" to "https://".
6. Data collection on this website
Contact and inquiry form. If you contact us via the inquiry form or by e-mail, telephone or fax, we process the data you provide (e.g. company, contact person, e-mail address, telephone number and message) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), Art. 6(1)(f) GDPR (handling of inquiries) or your consent (Art. 6(1)(a) GDPR). The data remains with us until the purpose no longer applies or you request deletion; mandatory retention periods remain unaffected.
Registration on this website. You may register to use additional functions. We use the data entered only for the purpose of using the respective offer. Processing is carried out to implement the user relationship established by the registration (Art. 6(1)(b) GDPR). The data is stored as long as you are registered and is subsequently deleted; mandatory retention periods remain unaffected.
7. eCommerce and payment service providers
We collect, process and use personal customer and contract data to establish, arrange and modify our contractual relationships and for billing (Art. 6(1)(b) GDPR). We transfer personal data to third parties only where necessary for the handling of the contract, for instance to the financial institution or payment service provider tasked with processing payments. Any further transfer occurs only with your express consent. Collected customer data is deleted upon completion of the order or termination of the business relationship and expiry of any retention periods.
8. Processing in the souvenir operation (photos, videos, guest data)
For recordings and guest data from the experience operation, Digital Souvenirs is a processor on behalf of the respective location or photographer (see section 3). Processed data includes in particular the photo and video recordings, name and (if provided) e-mail address for delivering the gallery link, and the documented record of consent.
Sending of gallery e-mails. The gallery e-mail and the reminder e-mail before the gallery expires are sent via the Transactional Email service of Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France ("Scaleway"). Processing takes place in Scaleway's data center in Paris (region fr-par), i.e. within the EU. Processed data includes the guest's e-mail address, the content of the e-mail (name, gallery link, activity, date and company logo of the location or photographer) as well as the delivery status and the SMTP responses of the receiving mail server. These serve as proof of whether the recipient's mail server accepted the e-mail and to detect bounces. For details, see Scaleway's privacy policy: https://www.scaleway.com/en/privacy-policy/. Scaleway is engaged as a sub-processor (Art. 28(4) GDPR); a data processing agreement (DPA) is in place with Scaleway.
Delivery of media and logos. The photos and videos in the gallery (viewing and download), the media previews in the dashboard and the company logos of the locations or photographers are delivered via the content delivery network of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia ("Bunny"). Bunny retrieves the files from the non-public storage at Hetzner and keeps them in its cache for a limited time for delivery. Files can only be retrieved via signed, time-limited links. Delivery takes place exclusively via locations within the EU. Processed data includes the retrieved media as well as technical access data such as the IP address of the requesting device and the time of retrieval. For details, see Bunny's privacy policy: https://bunny.net/privacy/. Bunny is engaged as a sub-processor (Art. 28(4) GDPR); a data processing agreement (DPA) is in place with Bunny.
Storage location and third countries. All personal data and media are processed and stored exclusively in data centers within the EU/EEA. Recordings are not transferred to third countries.
Storage period and deletion. Galleries and media are accessible only for a defined period and are then deleted automatically; guest master data is anonymized after a defined period. The depicted person can revoke consent at any time via the deletion link in the gallery, upon which their data and recordings are deleted immediately and completely.
Minors. Where recordings of minors are made, the location or photographer obtains the required consent of the legal guardians; the record is documented.
No AI analysis. The recordings are not analyzed by means of artificial intelligence, and no biometric facial recognition takes place.
9. Data security
We use technical and organizational measures to protect data against loss, misuse and unauthorized access, including encrypted transmission via TLS and encrypted storage of personal data.
10. Changes to this privacy policy
We adapt this privacy policy when the legal situation or our processing activities change. The version published here applies in each case.