Hier ist die vollständige englische Übersetzung deiner Datenschutzerklärung vom 31. Oktober 2026. Die Gliederung, Rechtsgrundlagen und inhaltlichen Aussagen bleiben erhalten.

Privacy Policy

Fine Art Editions by Alfred Steffen

Last updated: October 31, 2026

1. Data Controller

The controller responsible for processing personal data on this website is:

Alfred Steffen Photography
Alfred Steffen
Bethlehemer Straße 4a
50126 Bergheim
Germany

Email: info@alfred-steffen.de
Phone: +49 172 4222201

Hereinafter referred to as “we,” “us,” or “our.”

2. General Information on Data Processing

The protection of your personal data is important to us.

We process personal data exclusively in accordance with applicable legal requirements, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Personal data means any information relating to an identified or identifiable natural person.

We process such data in particular when you visit our website, place an order, contact us, or voluntarily use additional features of our online store.

3. Hosting and Technical Infrastructure Provided by Shopify

Our online store is operated using the Shopify e-commerce platform.

Provider:

Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides the technical infrastructure for our online store.

When you use our website, the following data in particular may be processed:

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Pages visited
• Technical device information
• Information about the use of our online store

This processing is carried out to ensure the availability, security, and technical functionality of our website.

The legal basis is Article 6(1)(f) GDPR, insofar as processing is necessary to pursue our legitimate interests in operating a secure and functional online store.

Where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract, Article 6(1)(b) GDPR applies.

Shopify may also process personal data outside the European Union or the European Economic Area.

Where required, appropriate safeguards pursuant to Chapter V GDPR are used, in particular adequacy decisions or Standard Contractual Clauses adopted by the European Commission.

Further information about Shopify’s processing of personal data can be found in Shopify’s privacy information.

4. Collection and Processing of Order Data

When you place an order in our online store, we process the personal data necessary to fulfill the contract.

This includes, in particular:

• First and last name
• Billing address
• Shipping address
• Email address
• Telephone number, where applicable
• Products ordered
• Order number
• Payment status
• Shipping and delivery information

We use this data to process your order, arrange the production and delivery of the artworks you have purchased, and communicate with you about the status of your order.

Legal basis: Article 6(1)(b) GDPR.

Where statutory retention or documentation obligations apply, processing is additionally based on Article 6(1)(c) GDPR.

5. Production and Shipping of Artworks

Our fine art editions are individually produced after an order has been placed.

For production and shipping, we work with specialized service providers, in particular:

WhiteWall Media GmbH
Germany

Where necessary for production and delivery, order data may be transmitted to WhiteWall.

This includes, in particular, information about the artwork ordered, the selected specifications, and the delivery address.

Data is shared only to the extent necessary for fulfilling the contract.

Legal basis: Article 6(1)(b) GDPR.

Additional shipping and logistics providers may be used for transportation. These providers receive the information necessary to deliver the order.

6. Payment Processing

To process orders, we use Shopify Payments and other payment service providers offered during checkout.

Depending on the destination country and technical availability, the following payment methods may be available:

• Credit and debit cards: Visa, Mastercard, American Express, Maestro, and UnionPay
• Apple Pay
• Google Pay
• Shop Pay
• Klarna
• PayPal

The payment methods actually available to you are displayed during checkout.

When processing payments, the personal data required for the transaction is transmitted to the payment service providers involved. This may include your name, billing address, payment amount, order number, transaction data, and payment information.

Payment service providers may process personal data under their own responsibility as independent data controllers. Their respective privacy notices also apply to such processing.

We receive information about payment status and transactions. As a general rule, we do not receive complete credit card details.

Processing is carried out for the performance of the purchase contract pursuant to Article 6(1)(b) GDPR.

Where statutory retention and documentation obligations apply, processing is additionally based on Article 6(1)(c) GDPR.

Where payment service providers process personal data outside the European Union or the European Economic Area, the legal requirements for international data transfers under Chapter V GDPR apply.

7. Contacting Us

If you contact us by email or through the contact form on our website, we process the information you provide.

This includes, in particular:

• Name
• Email address
• Telephone number, where applicable
• Content of your message

We use this data exclusively to respond to your inquiry and for related communication.

Where your inquiry relates to a contract or pre-contractual measures, processing is based on Article 6(1)(b) GDPR.

In other cases, processing is based on our legitimate interest in responding to incoming inquiries pursuant to Article 6(1)(f) GDPR.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure the operation of our online store and provide certain additional features.

Strictly Necessary Cookies

Strictly necessary cookies enable essential functions of our online store, including:

• Shopping cart functionality
• Order processing
• Security and fraud prevention
• Storage of essential session settings

These technologies are used where strictly necessary to provide services expressly requested by the user.

The legal basis for storing information on your device or accessing information already stored on it is Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Where applicable, the associated processing of personal data is based on Article 6(1)(b) or Article 6(1)(f) GDPR.

Optional Cookies

We use Shopify’s integrated cookie and consent management system.

Through our cookie banner, visitors can decide whether to consent to the use of optional cookies and similar technologies.

We distinguish between the following categories:

Personalization: Technologies used to tailor the user experience based on previous interactions.

Marketing: Technologies used to evaluate advertising activities and, where applicable, display personalized advertisements.

Analytics: Technologies that help us analyze the use of our website and improve our services.

These three categories are disabled by default in the cookie settings.

Visitors can accept all optional categories, reject them, or make an individual selection.

Where consent is required, these technologies are used on the basis of Section 25(1) TDDDG. The associated processing of personal data is based on Article 6(1)(a) GDPR.

Withdrawal of Consent

You may withdraw or change your consent at any time with effect for the future.

Shopify’s cookie and consent management system is available for this purpose. It allows you to adjust or completely withdraw your consent for the Personalization, Marketing, and Analytics categories individually.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9. Analytics and Improvement of Our Online Store

We use Shopify’s integrated analytics features to evaluate the use of our online store and improve our services.

This may involve processing information about page views, devices used, shopping cart activity, and orders.

Processing is based on the applicable legal basis in each case. Where consent is required, processing is based on Article 6(1)(a) GDPR.

The Google & YouTube sales channel is connected to our Shopify store. It has permission to access certain store data, particularly product information.

At the time of the review on October 31, 2026, no Google tracking pixel was connected within this integration.

10. Newsletter and Marketing Communications

If you expressly consent to receiving our newsletter or other promotional emails, we use your email address to send you information about our photographic work, editions, publications, and offers.

Legal basis: Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link in a relevant email.

Where we send marketing communications to existing customers in accordance with the statutory requirements of Section 7(3) of the German Act Against Unfair Competition (UWG), the associated data processing is based on Article 6(1)(f) GDPR. You may object at any time.

11. Customer Accounts

Where our online store allows customers to create accounts, we process the personal data necessary to establish and manage those accounts.

This may include, in particular, your name, email address, account settings, and order history.

Processing is carried out to provide the requested account features.

Legal basis: Article 6(1)(b) GDPR.

12. Recipients of Personal Data

We share personal data only where necessary to fulfill a contract, comply with a legal obligation, where appropriate consent has been given, or where another legal basis permits such disclosure.

Recipients may include, in particular:

• Shopify as the platform operator
• Payment service providers
• WhiteWall as a production and fulfillment service provider
• Shipping and logistics companies
• IT and technical service providers
• Tax advisors and accounting service providers
• Public authorities, where legally required

Where service providers process personal data on our behalf, we enter into appropriate data processing agreements pursuant to Article 28 GDPR where required.

13. International Data Transfers

When using Shopify and, where applicable, other service providers, personal data may be transferred to countries outside the European Union or the European Economic Area.

Such transfers take place only in compliance with the legal requirements of the GDPR.

Where required, they are based in particular on:

• Adequacy decisions of the European Commission pursuant to Article 45 GDPR
• Standard Contractual Clauses pursuant to Article 46 GDPR
• Other legally permitted transfer mechanisms

You may request information about the specific safeguards used by contacting us.

14. Data Retention

We retain personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Business records are subject, in particular, to retention periods under German commercial and tax law.

Depending on the type of document, these periods may be six, eight, or ten years.

Order data is retained in accordance with applicable legal obligations.

Data from contact inquiries is deleted once it is no longer necessary to process the inquiry, provided that no statutory retention obligations or other legitimate reasons justify further storage.

Data processed on the basis of consent is deleted following withdrawal of that consent, unless another legal basis permits continued retention.

15. Your Rights

Subject to the applicable legal requirements, you have the following rights:

Right of Access (Article 15 GDPR)

You may request information about the personal data we process concerning you.

Right to Rectification (Article 16 GDPR)

You may request the correction of inaccurate personal data or the completion of incomplete personal data.

Right to Erasure (Article 17 GDPR)

You may request the deletion of your personal data where the statutory requirements are met.

Right to Restriction of Processing (Article 18 GDPR)

Under certain circumstances, you may request that the processing of your personal data be restricted.

Right to Data Portability (Article 20 GDPR)

Where the statutory requirements are met, you may request that certain personal data be provided to you in a structured, commonly used, and machine-readable format.

Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

Following such an objection, your personal data will no longer be processed for direct marketing purposes.

Withdrawal of Consent (Article 7(3) GDPR)

You may withdraw any consent you have given at any time with effect for the future.

The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, please contact us at:

info@alfred-steffen.de

16. Right to Lodge a Complaint with a Supervisory Authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

The supervisory authority generally responsible for our business location in North Rhine-Westphalia is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Düsseldorf, Germany

You may also contact another competent data protection supervisory authority.

17. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or unlawful disclosure.

Our online store uses encrypted connections for data transmission.

However, completely risk-free data transmission over the internet cannot be guaranteed.

18. Minors

Our online store is not specifically directed at children.

We do not intend to collect personal data from children without a required legal basis or, where applicable, the necessary consent of a parent or legal guardian.

19. External Links

Our website may contain links to external websites.

The respective operators are responsible for processing personal data on those external websites.

Their published privacy policies apply.

20. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy if legal requirements, technical features, or the processing of personal data change.

The current version will be published on our website.

21. Data Protection Contact

If you have questions about data protection or wish to exercise your rights, please contact:

Alfred Steffen Photography
Alfred Steffen
Bethlehemer Straße 4a
50126 Bergheim
Germany

Email: info@alfred-steffen.de