PRIVACY POLICY

1. Controller

The controller responsible for the processing of personal data in connection with the Wedding Venue Catalog is:

Nikolai Simon
Simon Fotografie
Zum Zault 11
40627 Düsseldorf
Germany

Email: a.simon.fotografie@gmail.com
Phone: +49 179 5360889

This Privacy Policy applies specifically to the Wedding Venue Catalog available within:

en.simonfotografie.com/wedding-venues/

The remaining parts of en.simonfotografie.com may involve different processing activities and are subject to the privacy information applicable to the main Simon Fotografie website.

2. General information

The Wedding Venue Catalog is an editorial directory of wedding venues.

The public catalog does not provide user accounts, public authentication, favourites, reviews, venue booking or availability functions, user-generated content, payments, location tracking, public AI functions, or venue inquiry forms.

Personal data is processed only to the extent necessary to securely and technically provide the website and where otherwise described in this Privacy Policy.

The principal legal framework for such processing is the General Data Protection Regulation (GDPR) and, where applicable, the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Website access and technical log data

When you access the Wedding Venue Catalog, technical information is necessarily transmitted by your browser and processed in order to deliver the requested content and maintain the security and stability of the website.

This information may include, in particular:

• IP address;
• date and time of the request;
• requested URL and files;
• HTTP method and response status;
• referring URL, where transmitted;
• browser and device information;
• operating system information;
• language and similar request headers;
• network and routing information; and
• information generated in connection with security, firewall, abuse-prevention or error-detection mechanisms.

The processing is necessary for the delivery, security, availability, integrity and technical operation of the website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient provision of the Wedding Venue Catalog and the prevention and investigation of misuse, attacks and technical failures.

We do not use these technical request data to create advertising profiles of visitors.

Technical data is retained only for as long as necessary for the respective operational, security or troubleshooting purpose, subject to any longer retention required by law or necessary for the establishment, exercise or defence of legal claims.

4. Cloudflare

We use services provided by Cloudflare, Inc. and its affiliated companies for the delivery, operation, performance and protection of the Wedding Venue Catalog.

Depending on the request and the services involved, Cloudflare may provide services including:

• DNS and reverse-proxy functionality;
• content delivery and caching;
• network and application security;
• protection against malicious traffic and denial-of-service attacks;
• firewall and request filtering;
• Cloudflare Workers;
• Cloudflare Pages;
• Cloudflare D1; and
• Cloudflare R2.

Because traffic to the Wedding Venue Catalog passes through Cloudflare infrastructure, Cloudflare may process technical information relating to website requests, including IP addresses, routing information, request metadata, security information and other traffic data.

Where Cloudflare processes Customer Logs, Customer Content or other personal data on our behalf, Cloudflare acts as a processor under the applicable data-processing agreement.

Cloudflare may also process certain network, security and service data under its own responsibility in accordance with its privacy documentation.

The use of Cloudflare is based on Article 6(1)(f) GDPR. We have a legitimate interest in securely, reliably and efficiently providing the website and protecting it against attacks and misuse.

Cloudflare operates a global network. Accordingly, personal data may be processed in countries outside the European Economic Area, including the United States.

Where required by applicable data-protection law, international transfers are protected by appropriate safeguards, including the mechanisms provided for in Cloudflare's Data Processing Addendum and the applicable Standard Contractual Clauses.

5. Cloudflare Workers and Pages

Parts of the Wedding Venue Catalog are delivered and processed using Cloudflare Workers and Cloudflare Pages.

Incoming website requests may therefore be technically processed by Cloudflare infrastructure in order to determine the requested page, deliver content, apply routing rules and perform security or application logic.

No visitor accounts or advertising profiles are created through these services by the Wedding Venue Catalog.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in the secure and efficient technical operation of the website.

6. Cloudflare D1

Cloudflare D1 is used for internal application and content-related data required for the operation and administration of the Wedding Venue Catalog.

The public catalog is not designed to use D1 to create visitor profiles, maintain public user accounts, store reviews, process bookings or store visitor submissions.

If the use of D1 is expanded in the future in a way that results in additional processing of personal data, this Privacy Policy will be updated accordingly before or when such processing is introduced.

For the Wedding Budget Planner Page Opens statistic described in section 10, Cloudflare D1 stores only the calendar day, the fixed planner-page path and the aggregate number of recorded openings. It does not store IP addresses, visitor identifiers, individual opening records, budget projects or PDF contents for this statistic.

7. Cloudflare R2

Cloudflare R2 may be used as private object storage for media and other files required by the Wedding Venue Catalog.

R2 is not used by the public catalog to provide personal cloud storage to visitors or to create user profiles.

Files stored in R2 may include photographs and related content or rights-management information used for publication in the catalog.

Where photographs contain identifiable individuals, their publication is handled in accordance with the applicable legal basis and image-use rights.

8. Photographs, image sources and credits

The Wedding Venue Catalog may contain photographs produced by Simon Fotografie and photographs supplied by wedding venues or other rights holders with permission for publication.

Image-related information may include the name of a photographer, venue, rights holder or other source where a credit is required or appropriate.

Such attribution information is published for copyright, licensing, source-transparency and rights-management purposes.

Where a credit itself contains personal data, processing is based, depending on the circumstances, on Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

Our legitimate interests include complying with licensing arrangements, identifying the source and authorship of material, documenting usage rights and providing transparent editorial attribution.

9. Cookies and similar technologies

The Wedding Venue Catalog does not currently use cookies or comparable browser-storage technologies for advertising, behavioural tracking or personalised marketing.

Cloudflare may, where technically required by activated security functionality or in response to suspicious traffic, use strictly necessary cookies or comparable mechanisms in order to protect the website, verify legitimate requests, prevent abuse or maintain security functionality.

Such technologies are used only insofar as necessary for the requested service or website security.

Where access to information stored on a user's device or storage of information on that device is strictly necessary to provide the requested digital service, consent is not required under Section 25(2) TDDDG.

The Page Opens counter described in section 10 introduces no analytics cookie, browser-storage identifier or additional request from your device. Saving your budget project in your browser is a separate functional feature. Existing Cloudflare Web Analytics is described separately in section 10. The security exception above is not a general exemption for analytics.

If additional non-essential analytics, advertising, personalisation or similar technologies beyond those described in this policy are introduced, the relevant information and, where required, a consent mechanism will be implemented before those technologies are activated.

10. Usage statistics and advertising

Wedding Budget Planner Page Opens

We use a server-side Page Opens counter to understand how often the free Wedding Budget Planner page is delivered and to plan its maintenance. A Page Open is an eligible successful HTML navigation response recorded by the server. It is not a count of unique visitors or proof that a person read the page. Repeat requests, including reloads and new tabs, can count again. Openings served entirely from the browser cache or offline may be missing. Recording failures and the exclusion of requests without the required navigation information may also reduce the count. Bot filtering is approximate.

The counter evaluates the requested page, response status, navigation/prefetch headers, ordinary user-agent information and existing bot signals transiently. It does not read the source IP address for this measurement, create a visitor identifier or retain those request/header values. It does not introduce an analytics script, cookie, browser-storage identifier, fingerprint or additional request from your device. Existing saving of your budget project in your browser is separate from this statistic.

We store only the calendar day in Europe/Berlin, the fixed planner-page path and its numeric count. Names, contact details, IP addresses, HMACs, cookies, individual opening records, budgets, guest numbers, selected venues, wedding dates and PDF contents are not stored for Page Opens. The counter applies the same eligibility rules in all regions, including the EU. Requests with Do Not Track set to 1 or Global Privacy Control set to 1 are excluded when those signals reach the server. Identifiable prefetch/technical requests and explicit technical-test requests are excluded. Known bots are excluded where detected; some automated requests may still be counted.

Aggregate totals are available in our non-public administration area, protected by the existing Cloudflare Access authentication described in section 11. The statistic is not linked to individual PDF exports or used to build advertising profiles, measure individual behaviour or make decisions about visitors. Where personal data is transiently processed for this limited usage measurement, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is assessing aggregate use to maintain and plan the free planner.

You may object to processing based on this legitimate interest on grounds relating to your particular situation, using the contact details in section 16. We assess and respond to objections in accordance with Article 21 GDPR, including its conditions for any continued processing. You can also send the privacy signals described above; the counter excludes requests carrying those signals without saving a visitor preference.

An individual visitor's contribution cannot be identified, extracted or reliably subtracted from an already formed daily aggregate: it contains no visitor identifier or separate opening record. We do not create identifiers or reconstruct individual activity to locate a contribution. This limitation does not remove your right to object to future processing of personal data or your rights concerning personal data processed separately for other purposes, including the delivery and security processing described in this policy. Contact us as described in section 16 to exercise those rights.

We retain daily aggregates while the feature operates, subject to a documented necessity review by the controller or a person designated by the controller. The first review is due within 12 months of activation and subsequent reviews at least every 12 months; a change in purpose, data, access or provider arrangements triggers an earlier review. We check whether the statistic is still used and whether older daily detail and the All time total remain necessary, record the decision and next review date, and delete data no longer needed within 30 days of that decision. We delete the feature's aggregates within 30 days after its retirement.

Cloudflare D1 recovery history may retain earlier aggregate versions for up to 7 or 30 further days after deletion, depending on the service plan. No visitor identifier is present in those aggregate records. General delivery/security processing by Cloudflare, which may involve IP addresses and technical logs, is described separately in sections 3–5 and 15; this counter does not remove or replace that processing.

Existing Cloudflare Web Analytics

Separately, the existing Cloudflare Web Analytics configuration excludes visitor data from the EU. Where active for other traffic, its existing JavaScript measurement provides page-view, visit and performance information. It is subject to browser blocking, network conditions and provider sampling. It is separate from Page Opens and does not supply unique-person counts for this planner. We do not change its EU exclusion by introducing the server counter. Cloudflare describes this service as avoiding visitor identification through analytics cookies, localStorage or fingerprinting; the provider's existing processing and safeguards remain relevant.

We do not use these statistics for behavioural advertising or cross-site advertising profiles. If additional analytics or advertising technologies are introduced, we will update this policy and implement any legally required consent mechanism before activation, as described in section 9.

11. Internal administration area and Cloudflare Access

The Wedding Venue Catalog has a non-public internal administration area.

Access to this administrative environment is restricted and protected using Cloudflare Access.

Cloudflare Access may process information concerning authorised administrators, including identity and authentication information, IP addresses, access events and security information.

For authenticated administrators, Cloudflare Access uses technically necessary authentication mechanisms, including the CF_Authorization cookie, in order to verify identity and authorisation.

The administration area and its authentication mechanisms are not part of the ordinary public visitor experience of the Wedding Venue Catalog.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interests are restricting administrative systems to authorised persons, protecting website infrastructure and preventing unauthorised access.

Where processing is necessary in connection with a contractual or employment-related relationship with an authorised administrator, additional legal bases may apply.

12. External links

The Wedding Venue Catalog contains links to websites operated by wedding venues and other third parties.

When you follow an external link, you leave our technical environment. The operator of the destination website is responsible for the processing of personal data on that website.

We do not control the cookies, analytics tools, tracking technologies or other data-processing activities used by third-party websites.

The inclusion of an external link does not mean that personal data is automatically transferred to the linked website merely because the link is displayed. Data is generally transmitted to the third party only when you actively follow the link, except where separately disclosed.

13. No automated decision-making

The Wedding Venue Catalog does not use automated decision-making within the meaning of Article 22 GDPR in relation to public visitors.

14. Recipients of personal data

Personal data may be made available to service providers and other recipients only where this is necessary for the purposes described in this Privacy Policy, required by law, or otherwise permitted under applicable data-protection law.

Relevant categories of recipients may include:

• hosting, network and infrastructure providers;
• IT and security service providers;
• professional advisers where necessary;
• public authorities where disclosure is legally required; and
• other recipients where necessary for the establishment, exercise or defence of legal claims.

Cloudflare is the principal infrastructure provider used specifically for the Wedding Venue Catalog.

15. International data transfers

The technical provision of the Wedding Venue Catalog may involve processing outside the European Economic Area.

Where personal data is transferred to a country for which the European Commission has not adopted an applicable adequacy decision, we rely on appropriate safeguards where required, in particular contractual safeguards such as the Standard Contractual Clauses approved by the European Commission.

16. Your rights under the GDPR

Subject to the applicable statutory requirements, you may have the right to:

• obtain access to personal data concerning you;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of processing;
• receive personal data in a portable format where the legal requirements for data portability are met;
• object to processing based on Article 6(1)(f) GDPR; and
• withdraw consent at any time with effect for the future where processing is based on consent.

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation in accordance with Article 21 GDPR.

To exercise your rights, contact:

a.simon.fotografie@gmail.com

17. Right to lodge a complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority.

The supervisory authority responsible for our establishment in North Rhine-Westphalia is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

You may also contact another competent supervisory authority in accordance with Article 77 GDPR.

18. Visitors from Canada and the United States

The Wedding Venue Catalog is intended in particular for an international audience, including visitors from the United States and Canada.

Depending on the circumstances, visitors may have additional rights under privacy laws applicable in their jurisdiction.

The Wedding Venue Catalog does not currently sell personal information, provide public user accounts, operate behavioural advertising profiles, or intentionally share visitor personal information for cross-context behavioural advertising.

Requests concerning personal information may be sent to:

a.simon.fotografie@gmail.com

19. Changes to this Privacy Policy

We may update this Privacy Policy where the technical architecture, services used by the Wedding Venue Catalog, applicable law, or our processing activities change.

The version published on this page at the time of access applies.

Last updated: 16 October 2026