Privacy Policy

This Privacy Policy explains how personal data are processed when you visit this website, contact us or subscribe to the newsletter.

1. Controller

The controller responsible for processing personal data is:

Nicola Hackl-Haslinger
Leitnergasse 4
4040 Gramastetten
Austria

Email: photography@nhh.art

2. Hosting and technical logs

The website and its principal systems are hosted on a server in Vienna, Austria, provided by netcup GmbH, Germany. Authorised technical administration may access the systems only when necessary for operation, maintenance, security or support and acts on the controller’s instructions.

When you access the website, technical connection data such as your IP address, time of access, requested address, response status, referrer and browser information may be processed. This is necessary to deliver the website, maintain its security and detect misuse. The legal basis is our legitimate interest in providing a secure and reliable website under Article 6(1)(f) GDPR.

Ordinary technical logs are generally deleted within 14 days unless they are required for investigating a specific security incident.

Encrypted backups are maintained for disaster recovery and deleted after no more than 60 days. Data already deleted from the live systems may remain in a backup until that backup expires.

3. Local storage and Umami analytics

The website uses browser local storage to remember your colour-theme preference and analytics decision. These settings remain on your device until you change them or clear your browser storage. They are not used for advertising. If you decline analytics, only an aggregate daily rejection count without a visitor identifier or individual rejection timestamp is recorded.

We use our independently operated Umami analytics installation to understand in aggregate how the website is used and to improve its content. Umami is loaded only after you select “Accept” in the analytics panel. The legal basis is your consent under Article 6(1)(a) GDPR.

Umami may process visited pages, referrer, time of access, browser, operating system, device type, screen size, language and approximate geographic location. IP address and user-agent information may be used to create a pseudonymous session identifier. We do not use distinct user IDs, advertising profiles, cross-site tracking or analytics cookies.

Umami and its database are hosted on the Vienna server. Analytics data are not used for advertising or shared with third parties for their own purposes. Pseudonymous event and session data are deleted after 12 months. Statistics that no longer permit identification may be retained for longer.

You can change or withdraw your consent at any time with effect for the future through “Privacy settings” in the website footer.

4. Newsletter

You may subscribe to an occasional newsletter about exhibitions, publications, website updates and other significant events, currently expected approximately four to six times per year.

We process your email address, subscription status and technical confirmation data. Subscription uses a double-opt-in procedure. The legal basis is your consent under Article 6(1)(a) GDPR. Providing your email address is voluntary and is not required to use the website.

The newsletter list is managed with Listmonk on our Vienna server. Messages are delivered through Amazon Simple Email Service (Amazon SES), provided by Amazon Web Services EMEA SARL, using the Frankfurt region. AWS may use affiliated companies and subprocessors. Where processing involves countries outside the European Economic Area, AWS relies on recognised transfer mechanisms including the European Commission’s Standard Contractual Clauses.

Newsletters may contain a small image and tracked links that measure aggregate campaign-level openings and clicks. Individual subscriber tracking is disabled, and these measurements are not assigned to a named subscriber or email address. Loading the image or following a tracked link transmits ordinary connection data such as the IP address and browser information to our server; related technical logs follow the 14-day period stated above and are not used to identify readers.

You can withdraw your consent at any time through the unsubscribe link in each newsletter or by contacting us. Your address is then blocklisted and retained only to ensure that no further newsletters are sent to it. The legal basis for this limited retention is our legitimate interest in reliably observing your withdrawal under Article 6(1)(f) GDPR. You may request deletion of the blocklisted address unless continued retention is required to demonstrate compliance or address legal claims. Campaign content and genuinely anonymous aggregate statistics may be retained.

5. Contact by email

The website does not use a contact form. If you contact us by email, we process your address, message and any information you provide in order to respond and handle your enquiry.

The mailbox is provided by Proton AG, Switzerland. Proton may process message content and technical metadata required to deliver and secure email. Proton states that Proton Mail data are stored in encrypted form on servers in Switzerland, Germany or Norway. Switzerland is recognised by the European Commission as providing an adequate level of data protection.

The legal basis is taking steps at your request before entering into or performing a contract under Article 6(1)(b) GDPR, or our legitimate interest in responding to enquiries under Article 6(1)(f) GDPR. Correspondence is retained until the enquiry is completed and longer only where required by law or necessary for legal claims.

If an enquiry results in a sale, related contractual, payment and accounting records may be retained for the periods required by applicable tax and commercial law.

6. Recipients and international transfers

Personal data are disclosed only where necessary for the purposes described above, where a service provider acts on our behalf, where disclosure is legally required or where necessary for legal claims. Recipient categories include hosting and infrastructure providers, authorised technical administration, backup providers, Proton as mailbox provider and AWS as newsletter delivery provider.

The principal systems and the selected SES region are in the European Union. Limited AWS processing or support access from outside the European Economic Area cannot be excluded and is protected, where required, by the European Commission’s Standard Contractual Clauses and supplementary safeguards.

7. Your rights

Subject to the applicable legal requirements, you have the right to request access to your personal data, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

To exercise these rights, contact photography@nhh.art. We may request information necessary to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent Austrian authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), www.dsb.gv.at.

We do not use personal data collected through this website for automated decision-making or profiling that produces legal or similarly significant effects.

Last updated: 14 October 2026