Privacy Policy

Fine Art Editions by Alfred Steffen

Last updated: November 4, 2026

1. Data Controller

The controller responsible for processing personal data on this website is:

Alfred Steffen Photography
Alfred Steffen
Bethlehemer Straße 4a
50126 Bergheim
Germany

Email: info@alfred-steffen.de
Phone: +49 172 4222201

Hereinafter referred to as “we,” “us,” or “our.”

2. General Information on Data Processing

The protection of your personal data is important to us.

We process personal data exclusively in accordance with applicable legal provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Personal data means any information relating to an identified or identifiable natural person.

We process such data in particular when you visit our website, place an order, contact us, or voluntarily use additional features of our online store.

3. Hosting and Technical Infrastructure Provided by Shopify

Our online store is operated using the Shopify e-commerce platform.

Provider:

Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides the technical infrastructure for our online store.

When you use our website, the following data may be processed in particular:

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Pages visited
• Technical device information
• Information about the use of our online store

This processing is necessary to ensure the availability, security, and technical functionality of our website.

The legal basis is Article 6(1)(f) GDPR, insofar as processing is necessary for our legitimate interests in operating a secure and functional online store.

Where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract, Article 6(1)(b) GDPR applies.

Shopify may also process personal data outside the European Union or the European Economic Area.

Where necessary, appropriate safeguards under Chapter V GDPR are applied, in particular adequacy decisions or Standard Contractual Clauses adopted by the European Commission.

Shopify Network Intelligence and Enhanced Services

Our online store is operated through Shopify. We have enabled the “Shopify Network Intelligence” feature.

As part of this feature, Shopify may process personal data from our customers’ interactions and transactions with our online store together with data from other Shopify stores and Shopify services.

This processing is intended to provide and improve additional Shopify services. These may include personalized shopping experiences, analytics, advertising services, and measures to optimize online stores.

Personal data may be transferred to Shopify and other participating service providers. Processing outside the European Union or the European Economic Area is possible.

Further information about Shopify’s processing of personal data, the applicable legal bases, and your data protection rights can be found in Shopify’s Consumer Privacy Policy.

Where provided by law, you may object to the processing of your personal data for certain purposes or exercise relevant privacy choices. Shopify provides information about these options in its privacy notices and privacy settings.

Further information about data processing by Shopify can be found in Shopify’s privacy documentation.

4. Collection and Processing of Order Data

When you place an order in our online store, we process the personal data necessary to fulfill the contract.

This includes, in particular:

• First and last name
• Billing address
• Shipping address
• Email address
• Telephone number, where applicable
• Products ordered
• Order number
• Payment status
• Shipping and delivery information

We use this information to process your order, produce and deliver the purchased artworks, and communicate with you regarding your order status.

Legal basis: Article 6(1)(b) GDPR.

Where statutory retention or documentation obligations apply, processing is additionally based on Article 6(1)(c) GDPR.

5. Production and Shipping of Artworks

Our fine art editions are individually produced after an order has been placed.

For production and shipping, we cooperate with specialized service providers, in particular:

WhiteWall Media GmbH
Germany

Where necessary for production and delivery, order information may be transferred to WhiteWall.

This includes, in particular, information about the ordered artwork, the selected configuration, and the delivery address.

Data is shared only to the extent necessary for fulfilling the contract.

Legal basis: Article 6(1)(b) GDPR.

Additional shipping and logistics providers may be used for transportation. These providers receive the information necessary to deliver the order.

6. Payment Processing

We use Shopify Payments and other payment service providers offered during checkout to process orders.

Depending on the delivery country and technical availability, the following payment methods may be available:

• Credit and debit cards: Visa, Mastercard, American Express, Maestro, and UnionPay
• Apple Pay
• Google Pay
• Shop Pay
• Klarna
• PayPal

The payment methods actually available will be displayed during checkout.

For payment processing, the necessary personal data is transmitted to the participating payment service providers.

This may include:

• Name
• Billing address
• Payment amount
• Order number
• Transaction data
• Payment information

Payment service providers may process personal data under their own responsibility as independent data controllers.

Their respective privacy policies apply additionally to such processing.

We receive information about payment status and transactions. As a rule, we do not receive complete credit card details.

Processing is carried out for the performance of the purchase contract pursuant to Article 6(1)(b) GDPR.

Where statutory retention and documentation obligations apply, processing is additionally based on Article 6(1)(c) GDPR.

Where payment service providers process personal data outside the European Union or the European Economic Area, the legal requirements for international data transfers under Chapter V GDPR apply.

7. Contacting Us

If you contact us by email or through our website’s contact form, we process the information you provide.

This may include:

• Name
• Email address
• Telephone number, where applicable
• Content of your message

We use this information exclusively to respond to your inquiry and for related communication.

Where your inquiry relates to a contract or pre-contractual measures, processing is based on Article 6(1)(b) GDPR.

In other cases, processing is based on our legitimate interest in responding to inquiries pursuant to Article 6(1)(f) GDPR.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure the operation of our online store, analyze its use, and provide additional features.

Strictly Necessary Cookies

Strictly necessary cookies enable essential functions of our online store, including:

• Shopping cart functionality
• Order processing
• Security and fraud prevention
• Storage of essential session settings
• Management of your privacy preferences

These technologies are used where strictly necessary to provide services explicitly requested by users.

The legal basis for storing information on your device or accessing information stored on it is Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

The associated processing of personal data is based, where applicable, on Article 6(1)(b) or Article 6(1)(f) GDPR.

Optional Cookies and Similar Technologies

We use Shopify’s integrated cookie and consent management system.

Through our cookie banner, visitors can decide whether to consent to the use of optional cookies and similar technologies.

We distinguish between the following categories:

Personalization: Technologies used to adapt the user experience based on previous interactions.

Marketing: Technologies used to evaluate advertising activities and, where applicable, display personalized advertising.

Analytics: Technologies that help us analyze website usage and improve our services.

Visitors may accept or reject optional categories or make individual selections.

Where consent is required, these technologies are used on the basis of Section 25(1) TDDDG.

The associated processing of personal data is based on Article 6(1)(a) GDPR.

Withdrawal of Consent

You may withdraw or modify your consent at any time with effect for the future.

Our online store provides cookie and consent management tools for this purpose.

You can individually adjust or completely withdraw your consent for the Personalization, Marketing, and Analytics categories.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9. Analytics and Improvement of Our Online Store

We use Shopify analytics features and Google Analytics 4 to analyze the use of our online store and improve our services.

9.1 Shopify Analytics

We use Shopify’s integrated analytics features to evaluate the use of our online store.

The following information may be processed in particular:

• Page views
• Devices and browsers used
• Sources of website traffic
• Shopping cart activities
• Orders and revenue
• Technical usage information

This information helps us monitor the functionality of our online store, improve our offerings, and evaluate business performance.

Where consent is required, processing is based on Article 6(1)(a) GDPR.

Otherwise, where legally permitted, processing is based on Article 6(1)(f) GDPR.

Our legitimate interest lies in the economic and technical optimization of our online store.

9.2 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google.

For users in the European Economic Area and Switzerland, the responsible provider is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics enables us to statistically evaluate the use of our online store.

The following information may be processed in particular:

• Pages and products viewed
• Time and duration of website visits
• Devices and browsers used
• Approximate geographic location
• Interactions with our online store
• Shopping cart and purchase events, where technically recorded
• Technical identifiers and usage information

Google Analytics uses cookies and similar technologies where these are enabled by the relevant consent and technical configuration.

The information collected is used exclusively to analyze and improve our online services and evaluate their use.

Legal basis: Where consent is required, processing is based on Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Consent may be withdrawn at any time with effect for the future through the cookie settings of our online store.

Google Analytics 4 uses IP addresses for technical processing.

According to Google, IP addresses are not permanently logged or stored in Google Analytics 4.

When using Google Analytics, personal data may also be processed outside the European Union or the European Economic Area.

Further information can be found in Section 13 of this Privacy Policy.

Information about Google’s data protection practices can be found in Google’s Privacy Policy.

Data Retention

In our Google Analytics 4 property, the retention period for event data is set to two months, and the retention period for user data is set to fourteen months.

The retention period for certain user-related data is reset when the user becomes active again.

These settings primarily concern data associated with cookies, user identifiers, or advertising IDs.

Aggregated statistical reports may remain available beyond these periods.

9.3 Google & YouTube and Google Merchant Center

Our online store is connected to Google services through Shopify’s Google & YouTube sales channel.

This integration enables, in particular, the synchronization of product information with Google Merchant Center.

The following information may be transmitted:

• Product names and descriptions
• Product images
• Prices
• Availability
• Product categories
• Shipping information

As a rule, this product information does not contain personal customer data.

In addition, conversion tracking is enabled within the Google & YouTube integration.

This feature is used to evaluate the effectiveness of product listings and, where applicable, advertising activities.

Where personal data is processed or information is stored on or accessed from users’ devices and consent is required, processing is based on Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Processing takes into account the privacy preferences selected through our cookie management system.

10. Newsletter and Marketing Communications

If you expressly consent to receiving our newsletter or other promotional emails, we use your email address to send you information about our photographic works, editions, publications, and offers.

Legal basis: Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link included in the relevant email.

Where we send promotional communications to existing customers in accordance with the statutory requirements of Section 7(3) of the German Act Against Unfair Competition (UWG), the associated data processing is based on Article 6(1)(f) GDPR.

You may object to such processing at any time.

11. Customer Accounts

Where our online store allows customers to create accounts, we process the personal data necessary to establish and manage those accounts.

This may include:

• Name
• Email address
• Account settings
• Order history

Processing is carried out to provide the requested account features.

Legal basis: Article 6(1)(b) GDPR.

12. Recipients of Personal Data

We disclose personal data only where necessary to fulfill a contract, comply with a legal obligation, where appropriate consent has been obtained, or where another legal basis permits such disclosure.

Recipients may include, in particular:

• Shopify as the platform operator
• Google in connection with Google Analytics 4 and the Google & YouTube integration
• Payment service providers
• WhiteWall as our production and fulfillment service provider
• Shipping and logistics companies
• IT and technical service providers
• Tax advisors and accounting service providers
• Public authorities where legally required

Where service providers process personal data on our behalf, we enter into data processing agreements pursuant to Article 28 GDPR where required.

Where service providers process personal data under their own responsibility as independent data controllers, their respective privacy policies apply additionally.

13. International Data Transfers

When using Shopify, Google Analytics 4, and potentially other service providers, personal data may be transferred to countries outside the European Union or the European Economic Area.

This particularly concerns possible data processing in the United States of America.

International data transfers are carried out in compliance with the legal requirements of the GDPR.

The following legal bases and safeguards may apply in particular:

• Adequacy decisions adopted by the European Commission pursuant to Article 45 GDPR
• The EU–US Data Privacy Framework, where the respective data recipient is appropriately certified and meets the requirements of the adequacy decision
• Standard Contractual Clauses adopted by the European Commission pursuant to Article 46 GDPR
• Other legally permitted transfer mechanisms

The applicable safeguards depend on the service provider involved, the recipient, and the specific processing activity.

You may request information about the safeguards specifically applied.

14. Data Retention

We retain personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Business records are subject, in particular, to retention periods under German commercial and tax law.

Depending on the type of document, these periods may be six, eight, or ten years.

Order data is retained in accordance with applicable legal obligations.

Data relating to contact inquiries is deleted once it is no longer required to process the inquiry, provided that no statutory retention obligations or other legitimate grounds justify continued storage.

Data processed on the basis of consent is deleted following withdrawal of consent unless another legal basis permits its continued retention.

15. Your Rights

Subject to the applicable legal requirements, you have the following rights:

Right of Access (Article 15 GDPR)

You may request information about the personal data we process concerning you.

Right to Rectification (Article 16 GDPR)

You may request the correction of inaccurate personal data or the completion of incomplete personal data.

Right to Erasure (Article 17 GDPR)

You may request the deletion of your personal data where the statutory requirements are met.

Right to Restriction of Processing (Article 18 GDPR)

Under certain circumstances, you may request that the processing of your personal data be restricted.

Right to Data Portability (Article 20 GDPR)

Where the statutory requirements are met, you may request that certain personal data be provided to you in a structured, commonly used, and machine-readable format.

Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

Following such an objection, your personal data will no longer be processed for direct marketing purposes.

Withdrawal of Consent (Article 7(3) GDPR)

You may withdraw your consent at any time with effect for the future.

The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, please contact us at:

info@alfred-steffen.de

16. Right to Lodge a Complaint with a Supervisory Authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

For our registered business location in North Rhine-Westphalia, the generally competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Düsseldorf
Germany

You may also contact another competent data protection supervisory authority.

17. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or unlawful disclosure.

Our online store uses encrypted connections for data transmission.

However, completely risk-free data transmission over the internet cannot be guaranteed.

18. Minors

Our online store is not specifically directed at children.

We do not intend to collect personal data from children without an appropriate legal basis or, where required, the necessary consent of their parents or legal guardians.

19. External Links

Our website may contain links to external websites.

The respective operators are responsible for the processing of personal data on those external websites.

Their published privacy policies apply.

20. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if legal requirements, technical features, or the processing of personal data change.

The current version will be published on our website.

21. Data Protection Contact

For questions concerning data protection or to exercise your rights, please contact:

Alfred Steffen Photography
Alfred Steffen
Bethlehemer Straße 4a
50126 Bergheim
Germany

Email: info@alfred-steffen.de