Last updated: September 28, 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
Simon Gaffke
Email: info@simon.photo
If you have any questions regarding privacy or the processing of personal data on this website, you can contact me using the email address above.
2. General Information
simon.photo is a privately operated photography website.
I aim to collect and process as little personal data as reasonably possible. The website does not use advertising networks, Google Analytics, Meta Pixel or comparable marketing and tracking services.
Personal data is processed only where this is necessary to provide, secure and technically operate the website or to obtain privacy-friendly, aggregated website statistics.
Where processing is based on legitimate interests, the legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR).
3. Hosting
This website is hosted by:
checkdomain GmbH
Große Burgstraße 27/29
23552 Lübeck
Germany
checkdomain operates its web hosting servers exclusively in Germany. checkdomain
When you access this website, technical information is automatically processed by the hosting infrastructure. Server log files may contain information such as:
- IP address
- date and time of access
- requested page or file
- amount of data transferred
- referring page
- browser and operating system
- HTTP status and error information
This processing is necessary for the secure and reliable operation of the website, including error analysis and the detection and prevention of misuse.
According to checkdomain, server log files are stored temporarily and deleted after no more than 14 days. Where technically possible and appropriate, IP addresses are anonymized after 24 hours. checkdomain
The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, stable and reliable operation of this website.
4. Privacy-Friendly Website Statistics
This website uses WP Statistics to obtain basic information about website usage.
WP Statistics is configured in a privacy-focused manner. In particular:
- no analytics cookies are used
- no browser local storage is used for analytics tracking
- IP addresses are anonymized before storage
- anonymized IP information is additionally hashed
- the hash uses a daily-changing salt
- the full user-agent string is not stored
- logged-in WordPress users are excluded from statistics
- the browser’s Do Not Track preference is respected
- analytics data is stored locally in the WordPress database
- visitor analytics data is not transmitted to WP-Statistics.com
- anonymous usage data sharing with the plugin developer is disabled
WP Statistics states that its privacy-friendly configuration works without cookies or persistent browser identifiers and keeps analytics data on the website owner’s own server. WP Statistiken
Data processed for statistics
Depending on the visit, the statistics may contain information such as:
- page or post viewed
- referring website
- approximate country
- simplified browser information
- device category
- operating system
- date and time of the visit
The visitor’s complete IP address is not stored by WP Statistics in the configuration used on this website.
Before hashing, the IP address is shortened. A daily-changing salt is then combined with the anonymized IP information and browser information to create a non-reversible identifier used to count unique visitors for that day. Because the salt changes daily, the identifier is not intended to track visitors across different days. WP Statistiken
The purpose of this processing is to understand general website usage, such as which photographs or pages are viewed most often, without creating persistent individual visitor profiles.
The legal basis is Article 6(1)(f) GDPR. The legitimate interest is obtaining privacy-friendly statistics about the use and technical performance of the website.
5. Retention of Statistics
Detailed WP Statistics data is retained for 180 days.
After that period, older analytics data is automatically aggregated. Summary information such as the total number of visitors and page views for the website and individual pages is retained, while detailed information such as referrers, location information, devices, operating systems and browsers is removed. WP Statistiken
This reduces both the amount and duration of detailed analytics data stored on the server.
6. Geolocation
WP Statistics uses a locally stored geolocation database to derive an approximate geographic location from connection information.
This is used for general statistics such as the visitor’s country. No GPS location or precise physical location is collected.
The geolocation database itself is stored on the website server.
7. Protection Against Unauthorized Login Attempts
This website uses Limit Login Attempts Reloaded to protect the WordPress administration area against brute-force attacks and unauthorized login attempts.
For this purpose, information relating to login attempts may be processed, including:
- IP address
- attempted login name
- time of the attempt
- number of attempts
- temporary lockout information
The free, locally operated version of the plugin is used. According to the plugin developer, IP information in the free version is stored locally on the WordPress server rather than being transmitted to its cloud service. Limit Login Attempts Documentation
This information is processed exclusively for website security.
The legal basis is Article 6(1)(f) GDPR. The legitimate interest is protecting the website, its administrative accounts and its infrastructure against unauthorized access and automated attacks.
8. Cookies and Similar Technologies
This website does not use cookies or similar technologies for advertising, cross-site tracking or marketing analytics.
WP Statistics is configured to operate without analytics cookies, browser cache identifiers or local storage identifiers. WP Statistiken
Technically necessary cookies may be used in restricted areas of WordPress, for example when an authorized administrator logs into the website. These cookies are required for authentication, security and administration and are not used to track ordinary visitors for advertising purposes.
9. Local Website Resources
Images, fonts, stylesheets, JavaScript files and the image lightbox used by this website are provided locally from the website’s own hosting environment wherever possible.
The website currently does not intentionally use external advertising or analytics resources that automatically create visitor profiles.
Merely following a link to another website may result in data being processed by the operator of that external website. The privacy policy of the respective external provider applies after leaving simon.photo.
10. Contact by Email
You can contact me at:
If you contact me by email, the information contained in your message, including your email address and any information you voluntarily provide, will be processed for the purpose of answering your request.
Depending on the nature of the communication, the legal basis may be Article 6(1)(b) GDPR for contractual or pre-contractual communication or Article 6(1)(f) GDPR for general correspondence.
Email correspondence is retained only for as long as necessary to process the request or to comply with applicable legal obligations.
11. Recipients and Processors
Personal data is only disclosed to service providers where this is necessary for the operation and security of the website or where disclosure is required by law.
In particular, checkdomain processes technical hosting data as the hosting provider.
checkdomain provides an agreement for commissioned data processing pursuant to Article 28 GDPR through its customer area. checkdomain
No sale of visitor data takes place.
12. International Data Transfers
The website is hosted on servers in Germany.
The locally collected website statistics described above are stored on the website’s own hosting environment and are not intentionally transferred to third countries for analytics purposes.
13. Your Rights Under the GDPR
Subject to the applicable legal requirements, you have the right to:
- obtain information about personal data processed concerning you
- request correction of inaccurate or incomplete data
- request deletion of personal data
- request restriction of processing
- object to processing based on legitimate interests
- receive data you have provided in a portable format where the legal requirements for data portability apply
- lodge a complaint with a competent data protection supervisory authority
To exercise your rights, please contact:
14. Right to Object
Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation in accordance with Article 21 GDPR.
Following an objection, the personal data concerned will no longer be processed unless compelling legitimate grounds for the processing can be demonstrated which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.
15. Encryption
This website uses HTTPS/TLS encryption.
This protects data transmitted between your browser and the website against unauthorized access during transmission.
16. Changes to this Privacy Policy
This Privacy Policy may be updated if the website, the technologies used on it or applicable legal requirements change.
The current version of this Privacy Policy is always available on this page.