Privacy Policy

This is a convenience translation. Only the German version is legally binding.

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Kerstin Reuter Im Schönblick 13 71563 Affalterbach Deutschland Email: booking@kerstin-reuter.de Phone: +49 170 5846014

Where this website is technically provided by the platform provider „Modelframe“, Modelframe processes personal data on behalf of the controller on the basis of a data processing agreement (DPA). Details are set out in the terms of service and the privacy policy of Modelframe (modelframe.io).

Processor: Modelframe, a service by Johann Steinwand (trading as „21 Reasons“) — postal address and contact in the legal notice at modelframe.io/impressum.

2. General information

This privacy policy explains how personal data is processed when visiting this website. Personal data is any data relating to an identified or identifiable natural person (e.g. name, contact details, IP address, usage data).

Processing takes place in accordance with the GDPR and the applicable national data protection regulations. Which data is processed in detail depends on the specific use of this website.

3. Hosting and technical provision

This website is technically provided via the platform „Modelframe“ (modelframe.io). Modelframe uses the following service providers for delivery and storage:

  • Cloudflare CDN: A content delivery network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) is used to deliver the content of this website. Technical information (in particular IP address, browser and device data, access data) is processed in order to deliver the content quickly and securely and to protect the website against attacks.
  • Cloudflare Images: Images on this website are stored and delivered via „Cloudflare Images“; when they are retrieved, the IP address and other technical access data may be processed.
  • Cloudflare R2: Certain file and media content is kept in the object storage „Cloudflare R2“ and delivered from there; technical access data is processed on access.
  • Cloudflare Stream: Where videos are provided on this website, they are stored and delivered via „Cloudflare Stream“. On retrieval, in particular the IP address, technical device information and usage data (e.g. start time, playback status) are processed.
  • Supabase: Modelframe uses the service „Supabase“ to store account, settings and content data (e.g. portfolio content), with processing on servers within the European Union. Supabase processes data on behalf of Modelframe and thus indirectly on behalf of the controller.

4. Transfer of data to third countries

These services are used on the basis of the legitimate interest in a secure and high-performance provision of the website (Art. 6(1)(f) GDPR) and, where necessary, for the performance of the user relationship (Art. 6(1)(b) GDPR). Where data is transferred to third countries (in particular the USA), this takes place on the basis of appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular the standard contractual clauses of the EU Commission and the certification of Cloudflare under the EU-US Data Privacy Framework (DPF).

5. Server log files

When this website is visited, log data (server log files) is collected automatically: in particular IP address, date and time of access, requested URL, status code, amount of data transferred, browser type/version and, where applicable, operating system. Processing serves the technical functionality, IT security and error analysis; the legal basis is the legitimate interest (Art. 6(1)(f) GDPR). Log files are stored only briefly and then deleted, unless longer storage is required to investigate security incidents.

6. Contact and booking form

When visitors send booking requests or messages via the form, the data entered is processed — in particular name, email address, phone number where provided, and the content of the message.

This data is transmitted to Kerstin Reuter and processed by Modelframe only technically (storage, provision in the backend) as part of the data processing on behalf of the controller. The purpose is to handle the request and, where applicable, to initiate a contract. The legal bases are Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in communication).

7. Contact by email

When visitors get in touch by email, the data transmitted (sender address, content, signature data where applicable) is processed. The service „Resend“ is used to send notifications and confirmations; the mailbox and domain/mail provider is provided by „All-inkl“ (ALL-INKL.COM – Neue Medien Münnich). Purpose and legal basis correspond to communication in the context of an enquiry (Art. 6(1)(b) and (f) GDPR).

8. Audience measurement (cookieless)

A proprietary, cookieless first-party statistic is used to measure reach. Aggregated access data (e.g. page visited, referral source, approximate country and device type) and a pseudonymous visitor value that cannot be traced back to a person are recorded. No cookies are set, no full IP addresses are stored and no personal user profiles are created. The legal basis is the legitimate interest in a statistical evaluation of the use of the website (Art. 6(1)(f) GDPR).

9. Rights of data subjects

As data subjects, visitors to this website have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR), in particular to direct marketing

10. Exercising these rights

To exercise these rights, data subjects can contact Kerstin Reuter directly, in particular by email to the address given in the legal notice or in the section „Controller“.

11. Storage period and deletion

Personal data is stored only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

  • Data from contact requests is deleted as soon as the request has been fully dealt with and no retention obligations prevent deletion.
  • Server log files/log data are usually stored briefly (e.g. up to 14 days) and then deleted.
  • Portfolio content (photos, videos, texts) remains stored as long as it is published on this website.
  • Statutory retention periods (e.g. under tax and commercial law) remain unaffected.

12. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority if they consider that the processing of their personal data infringes data protection law. The competent authority is usually:

the State Commissioner for Data Protection and Freedom of Information of the German federal state in which the controller is based.