Diese Seite auf Deutsch lesen

Privacy notice for embedded galleries

This notice applies when a Portrait-Archiv gallery is not opened on portrait-archiv.com but on a photographer’s own website — embedded through our WordPress module, a comparable module for a website builder such as Wix, an iframe, or the REST API. For the portrait-service.com website itself, our general privacy policy applies (German only).

1. Who is responsible for what?

An embedded gallery brings two separate responsibilities together. The distinction is not a formality — it determines whom you should approach with a request for access or erasure.

• The photographer whose website hosts the gallery is the controller for the images, the gallery structure and their publication. They decide which images are uploaded, how long they remain visible and when they are deleted. The duty to inform visitors of their website under Art. 13 GDPR rests with them; that is what section 8 is for.
• Portrait-Service acts as a processor in this respect and only on the photographer’s instructions, under a data processing agreement pursuant to Art. 28 GDPR which photographers can generate in their Portrait-Archiv account.
• For handling the order towards the end customer, Portrait-Service acts as a controller in its own right — for invoicing, payment, complaints, tax records and the assertion of its own claims. This is not a choice but a legal requirement: whoever issues an invoice cannot do so on someone else’s behalf. The details are set out in section 11 of our terms and conditions.

The controller for the processing carried out in our own right, and the contact for all enquiries, is:

Thomas Schiffler
Portrait-Service
Draiser Strasse 6
D-55270 Ober-Olm, Germany
Email: info@portrait-service.com

2. What is processed when an embedded gallery is opened

The gallery content — images, shopping cart and checkout — is provided by Portrait-Archiv in every embedding method. How the data reaches us differs by method: with an iframe and for the image files themselves, the visitor’s browser retrieves them directly from portrait-archiv.com; with the WordPress module and the REST API, the photographer’s server requests them from us. In both cases the following is processed:

• the IP address of the requesting device or requesting server
• a session identifier, so that image selection and shopping cart are retained across page views — as a cookie set by portrait-archiv.com or, where the browser blocks third-party cookies, as a parameter in the address
• information about browser and operating system as well as the referrer address
• the gallery opened and the images selected
• for protected galleries, the gallery code or guest password entered
• the date and time of access in the server log files

The purposes are displaying the gallery, retaining the selection during the visit, and system security. Log files are deleted after 7 days at the latest. No profiling or advertising analysis takes place; the galleries contain no third-party analytics or advertising scripts.

3. What is processed when an order is placed

If a visitor adds images to the cart and places an order, the details required for the purchase are added:

• the name of the person ordering
• the email address for order confirmation, invoice and follow-up questions
• the delivery address and, where different, the billing address
• the images and products ordered including prices
• the payment method and the details required to process the payment

Card details and payment account credentials never reach Portrait-Archiv — they are entered directly with the payment service provider. We only receive confirmation that payment was made and in what amount.

4. Legal bases

• Displaying the gallery, session, log files: Art. 6(1)(f) GDPR. The legitimate interest lies in the technical provision and secure operation of the service. The session identifier is strictly necessary for the service requested, which is why no consent under section 25 TDDDG is required for it.
• Order, delivery, invoice: Art. 6(1)(b) GDPR — performance of the purchase contract.
• Retention of invoices and accounting records: Art. 6(1)(c) GDPR in conjunction with commercial and tax retention obligations.
• Processing image and gallery data on the photographer’s behalf: Art. 28 GDPR under the data processing agreement; the legal basis for the processing itself is the photographer’s responsibility.

5. Recipients

We pass on data only as far as necessary for display, production, delivery and payment:

• the partner lab chosen by the photographer receives the image data and the delivery address in order to produce the order and ship it on the photographer’s behalf (list of labs, German)
• the payment service provider, in particular PayPal, receives the details required for the payment
• the photographer receives the order data for their own galleries, because they are the seller
• tax advisors and tax authorities within the scope of statutory obligations

The servers are located in Germany; they are our own root servers operated at Keyweb AG under a managed service arrangement. Apart from payment processing, no transfer to a third country takes place.

6. Retention periods

• Server log files: deleted after 7 days at the latest.
• Session data and shopping cart: when the session ends, at the latest once it expires.
• Images and galleries: for as long as the photographer keeps them — they determine the point of deletion and can delete at any time. The details are set out in section 9 of our terms and conditions.
• Order and invoice data: up to 10 years, in line with commercial and tax retention periods.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), as well as the right to object to processing based on a legitimate interest (Art. 21 GDPR).

Whom to approach follows from section 1: for images and galleries it is the photographer, for your order it is us. If in doubt, write to info@portrait-service.com — we will either forward your request to the right place or tell you whom to contact.

Independently of this, you may lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

8. Paragraph for your own privacy policy

Photographers can copy the following paragraph into their own privacy policy. It describes the embedding from the perspective of the website hosting the gallery — adapt the form of address, company name and the details about the photo lab to your own circumstances.

Galleries and ordering system provided by Portrait-Archiv

To display our photo galleries and process orders we use Portrait-Archiv, a service operated by Portrait-Service, Thomas Schiffler, Draiser Strasse 6, 55270 Ober-Olm, Germany (“Portrait-Archiv”).

When you open a gallery on our website, the gallery content is provided by Portrait-Archiv. In doing so, your IP address, a session identifier, information about your browser and device, and the galleries you open and images you select are processed in order to display the gallery and retain your selection across page views. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the gallery. To access protected galleries, the gallery code or guest password you enter is also processed.

If you place an order, your name, email address, delivery address and the order and payment details are transmitted to Portrait-Archiv, which processes the order as our service provider. The legal basis is Art. 6(1)(b) GDPR. The data required for production and shipping is passed on to the photo lab commissioned for the order, and the data required for payment to the respective payment service provider, in particular PayPal.

Portrait-Archiv processes the gallery and image data on our behalf as a processor under a contract pursuant to Art. 28 GDPR. For handling the order towards you — invoicing, payment, complaints and tax records — Portrait-Archiv acts as a controller in its own right; you will find the corresponding information at https://www.portrait-service.com/en/privacy-embedding/.

The data is processed on servers located in Germany. We delete galleries as soon as they are no longer needed; order and invoice data is subject to statutory retention periods of up to ten years.

Important: the paragraph covers the embedding only, not your other processing activities — contact forms, analytics, newsletters and hosting need to be described separately in your policy. And it is not legal advice: it reflects what actually happens in our system, but it does not replace a review by your data protection officer or a qualified lawyer. If you use a photo lab based outside the EU, or run additional services, the text needs to be extended.

9. Changes to this notice

This notice is dated September 2026 (Stand September 2026). If the embedding technology or the legal situation changes, we will update it. Photographers who have adopted the paragraph above should compare it with this version after any change.