Privacy Notice: Information Sheet for Photographers

Contrima is committed to protecting your privacy. With the following information, we provide you with details regarding the processing of personal data by Contrima. This privacy notice explicitly refers to data processing activities that photographers who are or wish to become our subscription customers. They supplement our general privacy policy, which you can find at the following link: Privacy Policy.

I. Data Controller

The data controller is Contrima GmbH, represented by its managing director, Mr. Mark Reinhardt, Enzianweg 29, 71384 Weinstadt (hereinafter “CONTRIMA”).

Contact address: info@contrima.com

II. Processing of Personal Data, Legal Bases

This Privacy Policy informs you, in accordance with Art. 12 et seq. of the GDPR, about the handling of your personal data when you create an account with us or already have one. In particular, it explains what data we collect and for what purposes we use it. We also inform you about how and for what purpose this is done.

We process your personal data in accordance with Article 6(1) of the GDPR, i.e., for the processing of your personal data, we either have your consent or there is another legal basis for doing so. We also work with service providers who process your personal data on our behalf (e.g., hosting the CONTRIMA website).

Personal data is any information relating to an identified or identifiable natural person (hereinafter “data subject”); ; a natural person is considered identifiable if they can be identified, directly or indirectly—in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (see Art. 4(1) of the GDPR). Personal data therefore includes data that can be linked to a specific individual, such as an IP address. Other examples include: title, first name, last name, job title, email address, company, street, ZIP code, and city.

Processing means any operation or set of operations performed on personal data, whether or not by automated means, data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of disclosure, the alignment or linking, restriction, erasure, or destruction (see Art. 4(2) of the GDPR).

III. Purposes and Legal Bases for Data Processing

1. Registration

To use the CONTRIMA platform and the services it offers, we provide the option to create a user account linked to your email address. The actions you perform on the website can then be associated with this account. In order to complete the registration process, you must enter the following personal data: first and last name, email address.

The legal basis for data processing is the user relationship established upon registration (Art. 6(1)(b) GDPR). Providing your data is required for registration, as otherwise a user account associated with you cannot be created. Your data will be stored for the duration of the user relationship and to comply with any applicable retention requirements.

2. Contracts and Subscriptions

To use the services offered by the CONTRIMA platform, you can sign up for a subscription (Personal, Professional) or first click to get a trial account.

When you sign up for a subscription, we will ask you for various additional data, including, in particular, address, billing, and payment information. We use this information to provide the subscription and to bill you. Data processing is legally permitted for the purpose of fulfilling the contract being entered into (Art. 6(1)(b) GDPR). Providing the data we request is required to complete the subscription. Your data record will be stored in our database for the duration of the subscription. Any storage beyond this period is only carried out to comply with the legal retention obligations to which we are subject.

In the case of a trial subscription, the processing of the data we request is permitted for the purpose of fulfilling any resulting contracts as well as to safeguard our legitimate interests (Art. 6(1)(b), (f) GDPR). Providing your data is voluntary, but it is required for the provision of our services.

3. Communication via Your User Account / by Email

In your user account, we will notify you of new information regarding your projects and collections (such as a notification that all claimings have been processed or that a response has been received from a person depicted). The legal basis for this is Art. 6(1)(b) of the GDPR.

Based on the consent you have provided—which you may revoke at any time—we also communicate with you via email for promotional purposes. For this purpose, we use your profile data, in particular your email address, which you entered during registration. The purpose of the sending of emails is to introduce you to new features and to inform you about updates to our range of services. You can revoke your consent to the processing of your data in connection with the notifications described here at any time, with effect for the future, in the settings of your user account, so that you will no longer receive any messages.

IV. Payment

To process payments (such as for a subscription), we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, D02 H210, Dublin, Ireland (hereinafter: “Stripe”). When you sign up for a paid subscription, the data required for payment (e.g., email address, payment or account information) is transmitted directly to Stripe and processed there. The payment methods available depend on the options offered by Stripe and enabled by CONTRIMA at any given time. Please note: We do not store any banking information in our systems. We merely record the amounts due and whether they have been paid.

Stripe may transfer data to the U.S. and is certified under the EU-U.S. Data Privacy Framework. For more information: https://stripe.com/de/privacy.

1. When you make a payment by credit card, you will be prompted to enter payment details (email address, credit card information). The data is transmitted directly to Stripe with a transaction ID and processed there. We receive only a confirmation from Stripe that the payment has been made, as well as the data necessary to assign the payment to your account.

2. Depending on the selected payment method, the data required to process the payment (specifically your name, your billing and, if applicable, shipping address, your email address, the amount to be paid, and order details, as well as your IP address (for fraud prevention and geolocation)) is also transmitted to the respective payment service provider or other parties involved in the payment processing. Please note that these providers may, in some cases, also process personal data in countries outside the EU or the EEA. These providers base such data transfers on appropriate safeguards. Please note that these providers may, in some cases, process personal data in countries outside the EU or the EEA. These providers base such data transfers on appropriate safeguards, such as, for example, binding internal data protection policies or standard contractual clauses, and the service providers are also certified under the EU-U.S. Data Privacy Framework.

   • If you select PayPal as your payment method, the data required for the payment processing is transmitted directly to Stripe and processed there. You will then be redirected to the PayPal website to continue the payment process. The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Stripe transmits the data necessary for the transaction to PayPal. After the payment is completed, PayPal notifies us via Stripe of the successful transaction, as well as your email address and name on file with PayPal. For more information on data protection at PayPal, please see PayPal’s Privacy Policy at: PayPal Privacy Policy.
   • If you select Apple Pay as your payment method, the data required for the payment processing is transmitted directly to Stripe and processed there. You will then be redirected to the Apple Pay page to continue the payment process. The provider of this payment service is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Stripe transmits the data necessary for the transaction to Apple Pay. After successful payment, Apple Pay notifies us via Stripe of the successful transaction, as well as your email address on file with Apple Pay and your name. For more information on Apple’s privacy practices, please see: Apple Privacy Policy.
   • If you select Amazon Pay as your payment method, the data required for the payment processing is transmitted directly to Stripe and processed there. You will then be redirected to the Amazon Pay page to complete the payment process. The provider of this payment service is Amazon Payments Europe S.C.A., 38 avenue John F. Kennedy, L-1855 Luxembourg. Stripe transmits the data necessary for the transaction to Amazon Pay. After successful payment, Amazon Pay notifies us via Stripe of the successful transaction, as well as your email address and name on file with Amazon Pay. For more information on Amazon’s privacy practices, please visit: Amazon Payments Europe Privacy Policy – Personal Accounts.
   • If you select Klarna as your payment method, the data required for the payment processing is transmitted directly to Stripe and processed there. You will then be redirected to the Klarna website to complete the remaining steps of the payment process. The provider of this payment service is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Stripe transmits the data necessary for the transaction to Klarna. After successful payment, Klarna notifies us via Stripe of the successful transaction, as well as your email address and name on file with Klarna. For more information on data protection at Klarna, please visit: Privacy Policy | Klarna Germany.

V. Your Rights as a Data Subject

1. Right to Withdraw Consent: You may withdraw your consent to the processing of personal data, which was granted pursuant to Art. 6(1)(a) of the GDPR, at any time by notifying us. Please note that the withdrawal is effective only for the future. Processing that took place prior to the withdrawal is not affected by this. To withdraw your consent, an informal notification—e.g., via email—to us at info@contrima.com is sufficient.

2. Right to Object: You have the right, under the conditions set forth in Article 21 of the GDPR—specifically, in cases of processing based on legitimate interests pursuant to Article 6(1)(f) of the GDPR—to object to the processing of your personal data, in which case we must cease processing your personal data. The right to object applies only within the limits set forth in Article 21 of the GDPR. In addition, our interests may preclude a cessation of processing, meaning that despite your objection, we are still entitled to process your personal data. We will act on an objection to any direct marketing measures immediately and without further weighing of the existing interests.

Information about your right to object under Art. 21 of the GDPR: You have the right to object at any time to the processing of your data that is based on Art. 6(1), sentence 1, (f) of the GDPR (data processing based on a balancing of interests) or Article 6, Paragraph 1, Sentence 1, (e) of the GDPR (data processing in the public interest), if there are grounds for doing so arising from your specific situation. If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. The objection may be submitted in any form and should, if possible, be addressed to: info@contrima.com

3. You have the right to request confirmation from us as to whether we process personal data concerning you. If this is the case, you have the right to access this personal data to the extent provided by law (Art. 15 GDPR in conjunction with § 34 BDSG).

4. You also have the right to request the rectification of any incorrect personal data concerning you, and, where applicable—taking into account the purposes of the processing—to request the completion of incomplete personal data, including by means of a supplementary statement (Article 16 of the GDPR). In the cases specified in Article 17(1)(a) through (f) of the GDPR, you are also entitled to

5. In the cases specified in Article 17(1)(a) through (f) of the GDPR, you are also entitled to the right to erasure of personal data, provided that no exception under Article 17(3) of the GDPR applies, as well as, in the cases covered by Article 18(1) of the GDPR, a right to restriction of the processing.

6. In the cases specified in Article 20(1) of the GDPR, you also have the right to data portability.

7. You have the right to lodge a complaint with a supervisory authority, if you believe that the processing of your personal data violates the GDPR. The competent lead supervisory authority for us is: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), P.O. Box 10 29 32, 70025 Stuttgart, email: poststelle@lfdi.bwl.de, Website: baden-wuerttemberg.datenschutz.de.