Sascha van der Werf

Privacy notice

1. Controller and scope

The controller is Mag.(FH) Sascha van der Werf, Wiedner Hauptstrasse 33, 1040 Vienna, Austria. Privacy enquiries: contact@van-der-werf.com.

This notice covers visits to van-der-werf.com, email enquiries, newsletter signup and the embedded videos and maps described here. The website has no shop, checkout, member area or Academy contracting function. An enquiry or newsletter signup is not a paid booking. Processing for a specific photography assignment, workshop or art purchase is supplemented with contract-specific information where needed.

2. Website delivery and security

The website is delivered through Cloudflare Pages. Access involves processing IP addresses, requested URLs, timestamps, browser/device information and technical connection information to transmit content and identify attacks or technical faults. The legal basis is Article 6(1)(f) GDPR; the legitimate interests are secure, reliable provision of this website. Necessary connection data arises when you access it. Without that data the website cannot be delivered.

The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The website uses Pages for static delivery and associated network and connection security. Cloudflare Web Analytics and our own Logpush exports are not enabled. Cloudflare states a default of seven days for regular end-user activity logs; this is provider information, not a guarantee of one identical period for every category of security data. Separate preservation for a specific fault or attack is determined by its diagnosis, closure of the documented incident and applicable legal evidence requirements. This does not mean indefinite retention against hypothetical future incidents.

Public provider information: Cloudflare privacy policy. Our specific processing and relevant transfers are also described in section 10 and the storage inventory.

3. Email, enquiries and contract preparation

When you write to me, I process your email address, voluntarily supplied contact details and content, and necessary delivery and communication data to handle your enquiry. Article 6(1)(b) GDPR applies to contract preparation requested by you or contract performance. Other relevant enquiries are handled under Article 6(1)(f) GDPR based on my legitimate interest in accessible, organised communication. Statutory documentation and retention obligations are based on Article 6(1)(c) GDPR.

Domain and email services are supplied by easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria. The account-specific processor agreement concluded on 19 October 2026 covers hosting and associated email/domain services. Messages are received in the Easyname mailbox and managed using Apple Mail. Data include sender/recipient addresses, subject, message, any attachments and necessary delivery/connection information. The website has no contact form: an email link opens your own email application. Delivery also involves the email services you use.

The following retention rules apply to my email and customer correspondence:

Non-binding enquiries without a commission: normally deleted twelve months after the last substantive contact.
Spam and obviously irrelevant messages: normally deleted within 30 days.
Ongoing customer/project correspondence: until the contract has been fully performed; longer retention afterwards requires specific legal claims or statutory obligations.
Accounting records: statutory retention periods, generally seven years; longer only where a relevant law or proceeding requires it.

Under the agreed manual routine, my email holdings are reviewed at least quarterly for records due for deletion. This is not a technically automated deletion function. Please provide only information needed for your enquiry; without a usable email address I may be unable to reply.

Technical email and security logs

The service provider’s technical email, delivery, spam and security logs are separate from that correspondence. They may include connection/IP data, times and delivery/error messages. Retention criteria are technical delivery and checking specific sending/receipt errors, diagnosis of identified operational faults, and detection/prevention of spam, abuse and unauthorised access. Data required for a documented security incident may be preserved separately until that incident has been handled and closed; further preservation requires a specific legal evidence need or statutory duty. Duration also depends on the actual deletion and backup cycles of the service used. Routine logs are not intended for indefinite retention for merely hypothetical incidents. Separate preservation must remain purpose-bound and proportionate.

No currently guaranteed uniform provider period for all email logs is promised. The historical eight-week statement is therefore not presented as a current period. The processor agreement requires deletion of commissioned data after completion of contractual work, subject to necessary processing records and contrary legal duties; that contract-end provision is not a period for each individual operational log. The legal bases are the contract, communication and statutory purposes described above, and Article 6(1)(f) GDPR for secure, reliable communication.

Cookies and comparable technologies such as Local Storage are assessed by their actual purpose. Storage or access strictly necessary for transmission or a service explicitly requested by you falls within the exception in section 165(3) of the Austrian Telecommunications Act 2021 (TKG). Other storage or access requires prior consent. Where personal data is processed, the stated GDPR legal basis also applies.

You may allow or reject optional external content. Rejection does not prevent use of the remainder of this website. “Privacy settings” lets you change your selection and withdraw consent as easily as you gave it. Withdrawal takes effect for the future and does not affect earlier lawful processing. The switch does not automatically delete data already lawfully transferred to a provider; the rights in section 12 remain available.

The website operates its own consent dialog without an external consent SDK. It appears immediately when no valid stored selection is available, including when the selection has expired. “Accept all”, “Reject optional” and “Settings” are equivalent choices. Acceptance, rejection and individual choices are kept in this browser’s Local Storage under svdw-privacy-v1: version, video/map choices, timestamp and expiry date. The selection is valid for 30 days, including across browser restarts, unless browser storage is cleared or blocked. A missing, expired, invalid or outdated selection requires a new choice. The selection is not transferred to other browsers or devices. The website does not operate a server-side consent register for this selection. Its purpose is to implement and respect your choices; the bases are section 165(3) TKG and Article 6(1)(c), together with Article 7 GDPR, for respecting/evidencing that choice. Optional transfers rely on Article 6(1)(a) GDPR. “Privacy settings” in the footer reopens the same dialog to change or withdraw permission.

Inventory of storage technologies

Consent: first-party Local Storage key svdw-privacy-v1; acceptance, rejection or individual video/map selection, version, timestamp and expiry date; valid for 30 days, unless browser storage is cleared or blocked. This key is not transmitted to a consent provider.
Age confirmation: only if the separate remember option is selected, first-party Local Storage key svdw-adult-confirmed-at stores the confirmation time; considered valid for at most 30 days and discarded at the next check afterwards.
Hosting: the website itself sets no analytics or advertising cookie. Necessary connection/security processing by Cloudflare is distinct from our browser storage.
YouTube/Google Maps: before permission, no embedded player/map or storage access initiated by the website for those services. After permission, Google services may use their own cookies, local storage and device information. These are not controlled by the local consent key; provider purposes, settings and deletion rules are described in Google’s privacy information. No fixed list or identical duration for every device is promised.

Browser settings also allow you to delete or block cookies and website storage. This may remove saved refusals or preferences. Deleting browser data does not withdraw a separately given newsletter consent.

5. Age notice

An age and content notice precedes appropriately labelled image areas. Confirmation is an informed choice to view that content; it is not consent to advertising, newsletters or YouTube. No identity document or date of birth is requested solely for this notice.

Without the remember option, confirmation applies only to the currently opened page in working memory. If you select the separate remember option, only the timestamp is stored locally under svdw-adult-confirmed-at. It is considered for at most 30 days and discarded at the next check after expiry. You can remove it using the deletion control in the privacy notice or by clearing this website’s storage. This optional memory is separate from other consent; its basis is your choice under section 165(3) TKG and, insofar as personal data are involved, Article 6(1)(a) GDPR.

6. YouTube videos

Videos load only after you expressly allow transmission to YouTube. Until then a locally stored preview is displayed. Google Ireland Limited, Dublin, Ireland, is generally responsible for the service in the EEA; Google companies and service providers may also process data outside the EEA. After consent, Google receives in particular your IP address, browser/device information, the embedding page and information about video use. If you are signed in to a Google account, association with your account may be possible.

The legal basis for enabling the video is Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 165(3) TKG 2021. YouTube’s privacy-enhanced mode does not promise the absence of personal-data processing or storage. Google’s information applies to its own processing purposes. Google privacy policy and embedded-player information.

The current website uses the privacy-enhanced player at www.youtube-nocookie.com, including conversation video ID cFN6G3ok7w0. A local preview button is replaced by the player only after the relevant permission and activation; playback may then begin automatically. The player uses the strict-origin-when-cross-origin referrer policy. The permission recorded by this website remains valid until withdrawal or expiry of the 30-day selection, unless browser storage is cleared or blocked. Google’s own retention depends on the relevant usage, security and account purpose and, where applicable, your Google settings; withdrawal here does not automatically delete data already processed by Google. See Google cookie information and Google retention information. Transfers are described in section 10.

You may withdraw permission through “Privacy settings”. No further embedded players are then loaded, and running players are removed. Alternatively, you may follow a clearly identified external YouTube link. This leaves our website and processing there is governed by the provider’s information.

If you subscribe, you receive email news about my photography and artistic work, Journal articles, projects and photography, workshop and art offerings. Subscription is voluntary and independent of any commission. The website form sends your email address and expressly selected newsletter consent to the “VAN DER WERF” audience. The service also receives technical signup and confirmation data, such as timestamps and IP addresses.

Newsletters are managed and sent using Mailchimp, The Rocket Science Group LLC d/b/a Mailchimp, USA. For European customer data, its Data Processing Addendum forms part of the standard terms and incorporates standard contractual clauses for relevant transfers. Mailchimp processes contacts for list management and delivery on our behalf; its privacy information also describes its own security, abuse-prevention and legally required processing.

Signup uses double opt-in: after submitting the form, you receive an email asking you to confirm. Newsletters are sent only after confirmation. Sascha has accepted this functionality, including receipt of the confirmation email. Consent declarations, timestamps and technical signup/confirmation data evidence signup. Without confirmation, no newsletters are sent. The form leads to Mailchimp’s signup page, where the enabled reCAPTCHA protection may be used. This website loads no reCAPTCHA script before submission.

Newsletter delivery and associated processing rely on your consent under Article 6(1)(a) GDPR in conjunction with section 174 TKG 2021. Necessary evidence of compliance with consent requirements relies on Article 6(1)(c) together with Article 7(1) GDPR. Necessary restricted retention to defend specific legal claims may rely on Article 6(1)(f) GDPR.

You can withdraw consent at any time using the unsubscribe link in a newsletter or by emailing contact@van-der-werf.com. Earlier lawful processing remains unaffected. Your address will no longer be used for further newsletters. Unsubscribing does not automatically erase every record: limited suppression information may be needed to prevent unwanted re-subscription; consent records remain only as required to evidence legal compliance or defend specific claims. Unconfirmed signups are not used for delivery. Further retention depends on the pending confirmation, necessary evidence of that particular signup and the service’s actual cleanup/backup cycles. No unverified fixed automatic deletion period is promised. You may request access or deletion using the contact address.

Delivery statistics and technical processing

For SVDW, I do not use personal analysis of whether individual recipients open newsletters or which links they click. This rule concerns the engagement analysis I use; it does not mean that all technically necessary delivery, security or abuse-prevention processing by the delivery provider ceases.

The website itself loads no Mailchimp tracking SDK or open/click pixels. For delivery, error handling and abuse prevention, the service processes technical information such as times, IP/connection information and delivery status. Provider link redirects and technical processing are not thereby excluded. Retention criteria are closure of the relevant delivery/security process, necessary consent/suppression evidence, specific claims and the service’s deletion/backup cycles. SVDW’s policy remains no personal open/click analysis. This does not claim that every Mailchimp system is entirely tracking-free.

8. Images, rights enquiries and depicted persons

I process image and associated project data needed for publication and records of usage and publication rights. The legal basis depends on the relationship, such as valid consent, necessary contract performance or a lawful balancing of interests. Statutory image and personality rights remain applicable. Commissioning work does not by itself constitute blanket consent to my promotional use.

For concerns about an image, please send the relevant link. I review the concern and request only proportionate information needed for identification and entitlement, not identity-document copies as a routine. Rights and contract evidence is retained as necessary for the relevant use, statutory obligations and establishing or defending claims. Where use actually relies on consent, it may be withdrawn for the future; other lawful bases are assessed separately.

9. Links and other services

Ordinary links to social networks, partners or other websites do not load their plugins on this website. Following a link makes the respective provider’s information relevant. Merely naming Instagram, Facebook/Meta, X, LinkedIn, Leica Academy or WhiteWall does not mean their tracking, payment or production services are integrated into this website.

Google Maps

The “The Art of Elegance” workshop page offers a map of TOPEINS studio. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only a local placeholder is displayed before your separate map permission. Once the map loads, Google receives in particular your IP address, browser/device information, referring page and any map interactions. The bases are your consent under Article 6(1)(a) GDPR and section 165(3) TKG. Withdrawal through privacy settings removes loaded maps. It does not retrospectively delete Google’s storage; Google’s usage, security and account purposes, deletion rules and any account settings apply. The website does not request access to your device location.

Google Analytics and Meta Pixel are disabled. Fonts and preview images are delivered locally. There is no payment processing or additional website contact form. The newsletter form and permission-controlled video/map content are described above.

10. Recipients, processors and international transfers

Access is limited to people and providers needing data for the stated purposes. Processing on our instructions requires the arrangements under Article 28 GDPR. Not every provider processes all data exclusively as a processor; independent purposes and responsibilities must be considered separately.

Cloudflare, Inc., USA: hosting/connection data; processor for customer data under the DPA incorporated into the terms, with some independent responsibility for network security and abuse prevention. Its DPA contains the relevant standard contractual clauses for transfers outside the EEA; exclusively European processing is not promised.
easyname GmbH, Austria: domain/email service under the account-specific processor agreement of 19 October 2026. The agreement provides generally for EU/EEA service delivery and separately governs authorised subprocessors. Data-centre, support and domain partners receive data only as needed for the relevant service; any authorised third-country processing requires compliance with Articles 44 et seq. GDPR. The agreement and service-specific annexes are internal evidence, not public downloads.
Mailchimp / The Rocket Science Group LLC, USA: newsletter contact, consent/confirmation and delivery data; processor under the incorporated DPA and standard contractual clauses, alongside independent provider security and statutory purposes.
Google Ireland Limited / Google LLC: video/map content loaded after permission, technical usage data and possible account association; Google processes data for its own service purposes. Google identifies the EU-US Data Privacy Framework for transfers to Google LLC and also uses standard contractual clauses. See Google transfer safeguards. These safeguards do not replace the required prior device/content consent.

Transfers outside the EEA must satisfy Articles 44 et seq. GDPR. An adequacy decision applies only to recipients and processing within its scope. Reliance on the EU-US Data Privacy Framework requires valid, relevant certification of the actual US entity. Otherwise, valid standard contractual clauses with the necessary transfer assessment and supplementary measures may be appropriate. Ordinary cookie or newsletter consent does not replace this assessment. Information and, where applicable, a copy of relevant safeguards are available at contact@van-der-werf.com, subject to legitimate protection interests.

11. Retention and security

Retention follows the relevant purpose and periods or criteria stated above. When the purpose ends and there is no retention basis, data is deleted or irreversibly anonymised. Access restrictions, secure transmission and necessary technical and organisational measures seek to protect data against unauthorised access. This does not promise absolute security or full control of independent platforms.

12. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction and data portability. Consent can be withdrawn at any time for the future. Generally, a message to contact@van-der-werf.com is sufficient to make a request. Further identity information is requested only where reasonable doubts exist and only to the extent necessary.

Objection: You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct-marketing processing at any time without giving a reason, including related profiling.

You may complain to a data protection supervisory authority, particularly in the place of your habitual residence, work or a suspected infringement. In Austria this is the Austrian Data Protection Authority. You do not have to contact me first. Requests are generally handled within one month; you will be informed promptly of any legally permitted extension and its reasons.

13. Automated decisions and changes

The website does not use decisions based solely on automated processing producing legal or similarly significant effects, including relevant profiling. Providers’ technical delivery and abuse prevention are distinct; newsletter processing is described in section 7.

This notice is adapted to actual changes in functions, providers or legal bases. A revised notice does not replace any required new consent. Version date: 19 October 2026.