Legal & Privacy

01 / Privacy

Controller

Ihor Kostash
Contact details: see the Imprint below.

Website Hosting and Security: Cloudflare

This website is delivered and protected using services from Cloudflare, Inc. When you access the website, Cloudflare may process connection and security data such as your IP address, requested URL, time of access, browser and request information. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the website. Cloudflare also provides the Worker and D1 infrastructure used for the Like feature described below.

Cloudflare operates an international network and may process personal data outside the EEA. Where applicable, international transfers are covered by safeguards including Standard Contractual Clauses and the EU-US Data Privacy Framework. Further information is available in Cloudflare's Privacy Policy.

Inquiries, Bookings and Business Relationships

I process information you provide by email or through the contact and booking forms to answer inquiries, discuss and arrange projects, prepare offers, perform agreed work, and manage invoicing and payment. Depending on the interaction, this may include your name, email address, company or professional role, project details, dates, location, budget, correspondence, attachments and billing or transaction information.

The legal basis is Article 6(1)(b) GDPR where processing is necessary for a contract with you or steps requested before a contract. Article 6(1)(f) GDPR applies to necessary professional communication where you act for a company, agency or another person; the legitimate interest is managing relevant business communications and relationships. Article 6(1)(c) GDPR applies where processing or retention is required by law. Required information must be provided where it is necessary to handle an inquiry or perform a contract; optional fields may be left blank. Where necessary for the relevant purpose, recipients may include the service providers named below, involved business counterparties, payment providers, professional legal or tax advisers, and competent authorities.

Email Communication: Apple iCloud Mail

Business email is provided through Apple iCloud Mail by Apple Distribution International Ltd., Ireland. Apple may process email addresses, message content, attachments, timestamps and related technical information in order to provide the mailbox service. The purposes and legal bases for my use of this correspondence are described above. Apple may process data outside the EEA; where applicable, international transfers are protected by Standard Contractual Clauses. Further information is available in Apple's Privacy Policy.

Contact and Booking Forms: FormSubmit

Contact and booking form submissions are processed through FormSubmit, a Devro LABS product, and forwarded to my iCloud business mailbox. FormSubmit receives the information entered in the relevant form and technical connection data needed to deliver the submission. The legal basis for my processing of the inquiry is described above. FormSubmit states that form submissions are retained for 30 days. You may instead contact me directly by email using the address in the Imprint. Further information is available in FormSubmit's Privacy Policy.

Support and Memberships: Patreon and Ko-fi

If Patreon or Ko-fi provides me with supporter or membership information, I process the data made available by the respective platform to administer the support or membership, provide agreed benefits and, where required, maintain accounting records. The data may include your name or display name, email address, membership or support status, payment-related reference information and messages. The source of the data is the respective platform. The legal bases are Article 6(1)(b) GDPR for agreed benefits and memberships and Article 6(1)(c) GDPR for legally required records. The platforms describe their own processing in the Patreon Privacy Policy and Ko-fi Privacy Policy.

Event Photography

The Events section may contain photographs of identifiable people at conventions, festivals and similar events. Where publication is based on consent, the legal basis is Article 6(1)(a) GDPR. Where documentary event photography is permissible following a balancing of interests, the legal basis is Article 6(1)(f) GDPR; the legitimate interest is documenting professional appearances and activities connected with Impossible Pleasure. Sections 22 and 23 of the German Art Copyright Act (KunstUrhG) also apply to publication of identifiable persons. If you are identifiable in an image and wish to exercise an applicable right, use the contact details in the Imprint.

Media Likes and Browser Storage

The Like feature is activated only when you use a Like control. It then uses a random pseudonymous browser identifier stored in localStorage and transmits that identifier together with the relevant Like information to a Cloudflare Worker and D1 database. Local storage may also remember Like choices for media galleries. The device-side storage is used to provide the interaction you requested and is based on Section 25(2) no. 2 TDDDG. Processing of the pseudonymous Like data is based on Article 6(1)(f) GDPR; the legitimate interest is providing the requested Like function and limiting repeated Likes under the same identifier.

The browser identifier and locally stored Like information remain until they are changed or cleared by you or your browser. Server-side Like records remain until the Like is successfully removed, an identifiable deletion request is fulfilled, or the records are deleted during database maintenance. Clearing browser storage does not itself delete an existing server-side D1 record.

Online print shop

For print orders, Ihor Kostash processes your name, email, delivery address, selected products, quantities, signature/dedication text, new-photo requests, order notes, agreed briefs and their approval records, payment references, transaction status, correspondence, dispatch details, packaging records linked to the order, and withdrawal/refund information. The purposes are concluding and performing the contract (Art. 6(1)(b) GDPR), accounting and legal retention (Art. 6(1)(c)), and proportionate security and legal-claim protection (Art. 6(1)(f)). A customer account, birth date and identity document are not required. Optional address details may be left blank.

Order records, withdrawal statements and transactional-email queues are stored using Cloudflare Workers and D1. The cart, including selected signature/dedication and request text, is saved in necessary localStorage with an expiry of 30 days after the last change; expired data is removed on the next shop visit, to provide the cart you requested under Section 25(2) no. 2 TDDDG. It can survive browser or device restarts, but not clearing site data, private-browsing deletion or browser restrictions. Clear bag removes the local cart. Checkout email and delivery address are not stored in it. When opening the downloaded site as local files, a validated cart state is transferred only in the URL fragment of internal file links, not to payment providers or external sites, and is removed from the current address after reading. The local preview does not call the real shop API. The shop does not add advertising pixels or a marketing newsletter. The personal order link gives access to your order; keep it private.

Depending on your selected and available payment method, payment data and transaction references are processed by Stripe Payments Europe, Ltd. (including the selected Apple Pay or Google Pay wallet where available) or PayPal (Europe) S.à r.l. et Cie, S.C.A. Payment providers also process data for their own legally defined purposes. Full card numbers and CVC codes are entered on the payment provider's interface and are not stored by this shop. See Stripe Privacy and PayPal Privacy.

DHL receives the delivery information necessary to transport the parcel. Tracking notices are sent through the shop; buyer email addresses and phone numbers are not automatically forwarded to DHL for separate notification services. Prints are produced to order, individually or in batches, using ROSSMANN Fotowelt. In this workflow the printer receives print files, not customer shipping addresses.

Questions submitted through the shop question form are sent through the shop Cloudflare Worker and Resend to the business mailbox. They are not stored as separate shop-inquiry records in D1; the temporary email-queue payload is removed after successful delivery according to the queue-retention rule below. The submitted name, email address, optional order reference, topic and message are used only to answer the inquiry and, where relevant, to take steps at your request before or during a contract.

Transactional order, invoice and withdrawal emails are sent using Resend as an email service provider; replies and business correspondence are handled through the iCloud mailbox described above. Resend processes recipient addresses and the message content in the USA. Its data-processing terms include EU Standard Contractual Clauses for relevant transfers. See Resend DPA and subprocessors. The relevant service contracts and transfer safeguards must apply to the configured business accounts.

Unpaid, uncompleted order drafts are deleted after 30 days. Security rate-limit keys are pseudonymous and expire within 48 hours. Successful email-queue payloads are removed after seven days; the necessary order, contractual and invoice records remain subject to the retention periods above. Required accounting records are retained even where a deletion request is made. Data unrelated to an applicable retention or claim purpose is removed when no longer needed. Order-data exports are restricted to the seller's protected administration interface. Your rights and the supervisory-authority contact are described above.

Retention

Personal data is retained only for as long as necessary for the relevant purpose, unless a legal obligation requires longer storage. General inquiries are deleted when no further handling or reasonable follow-up is needed. FormSubmit states that submissions are retained for 30 days. Where Section 147 AO applies, business correspondence is generally retained for six years, invoices and other accounting vouchers for eight years, and the specified books, records and financial statements for ten years. Data needed to establish, exercise or defend legal claims may be retained for the applicable limitation period. Like data and event photographs follow the criteria described above.

Your Rights

Under the conditions of the GDPR, you have the right to access, rectification, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Where processing is based on consent, you may withdraw that consent at any time for the future. To exercise your rights, use the contact details in the Imprint.

You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority for my location is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit). Its official complaint channel is available online.