Privacy Policy

This privacy policy explains how Studio Hanselmann GmbH (represented by Sven Hanselmann, Haldenhof 3, 9000 St. Gallen, Switzerland) processes your personal data. It is based on the revised Swiss Federal Act on Data Protection (FADP) and, where applicable, the European Union's General Data Protection Regulation (GDPR). Under the FADP's transparency obligations, data subjects must receive enough information to exercise their rights. This includes, in particular, information about the controller, the purposes of processing, the categories of recipients, the categories of data disclosed and any transfers abroad.

1. Controller

Studio Hanselmann GmbH
Sven Hanselmann
‍Haldenhof 3
9000 St. Gallen
Switzerland

sven@studio-hanselmann.ch

Representative in the EU (if required)  
For processing covered by the GDPR, a suitable representative in the EU will be appointed where required by law.

2. Personal data we collect

We only process the data necessary for the respective purposes and follow the principles of purpose limitation, proportionality and data minimisation. Depending on how you interact with us, the following data may be collected:

• Master data for contract performance. This includes name, company, address, telephone number, email address and project and appointment details.
• Communication data. The content of enquiries and correspondence.
• Technical data. This includes IP address, device identifiers, browser information, usage behaviour, log data and location data, collected through cookies and analytics tools. Using cookies for personalised advertising can constitute high-risk profiling and therefore requires express consent, especially where third parties have access to the data.
• Newsletter and marketing data. This includes email address, opt-in and opt-out status, interactions with marketing emails (such as open rates) and preferences.
• Form and security data. This includes information from contact or booking forms as well as spam filter information (IP address, timestamp, content) used to detect misuse.

3. Purposes of processing and legal bases

3.1 Contract performance and communication

We use your master data, project details and communication data to prepare, perform and handle service contracts – for example planning and carrying out photo and video shoots – and to communicate with you. Processing takes place for contractual reasons or on the basis of a legitimate interest, as it is necessary to provide our services.

3.2 Accounting and legal obligations

To meet legal obligations, such as retention requirements under the Swiss Code of Obligations, we keep billing and contract data for ten years. Information on tax and retention periods can be found in Swiss legislation.

3.3 Website operation and optimisation

We use various tools to provide and optimise our website (see Section 5) and to evaluate usage data. In doing so, we rely on our legitimate interest in a technically stable and user-friendly website. For tracking and marketing technologies, we also obtain your consent. Under the current FDPIC cookie guidelines, consent is required in particular where cookies are used for personalised advertising or location data is used for profiling.

3.4 Marketing and newsletters

With your voluntary consent, we occasionally send you information about new services or promotions by email. You can withdraw your consent at any time and unsubscribe via the link in every marketing message.

3.5 Security and misuse prevention

We use security solutions such as spam filters, firewalls and Google reCAPTCHA to prevent misuse. This processing is based on our overriding interest in the security of our systems and on legal obligations.

3.6 Legal bases under the FADP

The revised FADP does not require a legal basis for every processing activity. Private controllers only need an express justification if processing breaches the processing principles or sensitive data is disclosed without consent. Depending on the case, we rely on contract performance and pre-contractual measures, legal obligations, overriding legitimate interests and consent for marketing, analytics and tracking cookies or the processing of sensitive data.

4. Disclosure and international transfers

4.1 Service providers

We work with carefully selected service providers, who process your data only on our instructions and under data processing agreements. Our service providers include:

• Hosting and infrastructure providers. These include Hoststar and Webflow, which provide server infrastructure, email hosting and content management.
• Analytics and marketing providers. These include Google Analytics, Microsoft Clarity, Google Ads, Google Tag Manager, Google Search Console, CookieScript and Klaviyo.
• Security and spam filtering services. These include Basin (usebasin), Zapier and Google reCAPTCHA.
• CDN and font providers. This includes Fontshare.
• Multimedia platforms. This includes YouTube.

Beyond this, we only disclose data where necessary to perform a contract, where you have consented or where we are legally obliged to do so. Disclosures to authorities or courts are made on the basis of legal obligations.

4.2 Transfers to third countries

The FADP only permits cross-border transfers of personal data under certain conditions. In principle, data may be transferred abroad if the destination country ensures adequate data protection. For countries without an adequate level of protection, such as the USA, appropriate safeguards such as standard contractual clauses must be agreed, or an exception under Article 17 FADP must apply. For every international transfer, we inform you of the destination country and the safeguards used.

In particular, when using US providers, we use standard contractual clauses or rely on the Swiss-US Data Privacy Framework where a provider is certified. These include Google LLC (Analytics, Ads, Tag Manager, reCAPTCHA), Microsoft Corporation (Clarity), Zapier Inc., Klaviyo Inc., Basin and Fontshare. If you do not want your data to be transferred to the USA, you can block certain services by rejecting the corresponding cookies.

5. Third-party tools in detail

Below, we describe the individual tools used on our website. They are only used with your consent or on the basis of an overriding interest in improving the website. You can adjust your preferences at any time via our cookie banner (CookieScript).

5.1 Hosting and infrastructure

• Hoststar. Our main Swiss hosting provider stores website and email data on servers in Switzerland, so no international transfer takes place. Hoststar processes connection and communication data, such as IP addresses and log files, to ensure operation.
• Webflow hosting. We use Webflow, a US provider, to design and deliver certain pages. Data such as IP address, technical information and any form entries may be transferred to the USA. Webflow is certified under the Swiss-US Data Privacy Framework, or we use standard contractual clauses. This processing enables us to provide our website professionally.

5.2 Analytics and marketing services

• Google Analytics 4. For statistical analysis of how our website is used, we use Google Analytics 4 from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google uses cookies and similar technologies to collect information about your use of our website, in particular IP address, browser type, device information, time on site, pages visited and interactions. We have enabled IP anonymisation, so your IP address is shortened within Switzerland or the EU. Processing takes place exclusively on the basis of your consent via our cookie banner; Google Analytics is not activated without it. Data may be transferred to the USA. Google LLC is certified under the Swiss-US Data Privacy Framework, or appropriate safeguards such as standard contractual clauses under Article 16 ff. FADP are in place. For more information, see https://policies.google.com/privacy.
• Google Tag Manager. Google Tag Manager, a service of Google Ireland Ltd., Dublin, Ireland, is used to manage website tags, in particular tracking and marketing scripts. Tag Manager itself does not store personal data or set cookies, but it can load other services that process personal data. We use it on the basis of our legitimate interest in managing our website services efficiently. Information about the services loaded via Tag Manager can be found in the relevant sections of this privacy policy.
• Google Ads conversion tracking. We use Google Ads conversion tracking from Google Ireland Ltd., Dublin, Ireland, to measure the effectiveness of our online advertising. It records whether a user reached our website via a Google ad and took certain actions, such as contacting us. Cookies and a pseudonymised ID are used for this purpose. Processing takes place exclusively on the basis of your consent via our cookie banner; no conversion tracking takes place without it. Data may be transferred to the USA. Google LLC is certified under the Swiss-US Data Privacy Framework, or appropriate safeguards such as standard contractual clauses under Article 16 ff. FADP are in place. For more information, see https://policies.google.com/privacy.
• Google Search Console. We use Google Search Console to monitor the technical status and visibility of our website in Google Search. It only provides aggregated search performance data and does not process personal data of our website visitors.
• Microsoft Clarity. We use Microsoft Clarity from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, to analyse the usability of our website. Clarity creates heatmaps and session replays, recording mouse movements, scrolling, clicks, IP address, device and browser information. Processing takes place exclusively on the basis of your consent via our cookie banner; Microsoft Clarity is not activated without it. Data may be transferred to the USA. Microsoft is certified under the Swiss-US Data Privacy Framework, or appropriate safeguards such as standard contractual clauses under Article 16 ff. FADP are in place. For more information, see https://privacy.microsoft.com.
• Meta Pixel (Facebook Pixel). We use the Meta Pixel from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. It helps us understand how users behave after reaching our website via an ad on Facebook or Instagram, so we can evaluate and optimise our advertising. Meta uses cookies and similar technologies to collect information about your use of our website, in particular IP address, device information, browser type, pages visited, interactions and, where applicable, conversion data. Meta may link this data to existing user profiles if you are logged in to a Meta service. Processing takes place exclusively on the basis of your consent via our cookie banner; the Meta Pixel is not activated without it. Data may be transferred to the USA. Meta Platforms Inc. is certified under the Swiss-US Data Privacy Framework, or appropriate safeguards such as standard contractual clauses under Article 16 ff. FADP are in place. For more information, see https://www.facebook.com/privacy/policy.

5.3 Marketing and newsletters

• Klaviyo. We use Klaviyo to send newsletters and marketing campaigns. Klaviyo processes email addresses, names and interaction data such as opens and clicks. Data may be transferred to the USA. To ensure an adequate level of data protection, we have agreed standard contractual clauses with Klaviyo, which form part of Klaviyo's data processing addendum and terms of use. We use the double opt-in process and document the time of your consent and the exact wording of the notice you saw when signing up. If no explicit opt-in can be verified for older profiles, we will not contact you without first consulting our legal advisers. Our forms use Klaviyo's GDPR-compliant forms with multiple checkboxes, allowing separate consent for different marketing channels. In the small print, we explain clearly why we need your data, which third-party providers we use and that you can withdraw your consent at any time.

5.4 Spam filtering and automation

• Basin (usebasin). We use Basin to handle form submissions and detect spam. Basin stores form content, IP address and technical information to prevent spam and misuse. Data may be transferred to servers in the USA. This processing is based on our legitimate interest in the security and functionality of the website.
• Zapier. Zapier automates workflows, such as forwarding form enquiries to our email or CRM systems, and connects Basin with other applications. Zapier only processes data on our instructions and may transfer data to the USA. We have concluded standard contractual clauses.

5.5 Fonts and design

• Fontshare and fonts. For modern web fonts, we mainly use Fontshare. Fonts may be loaded via a content delivery network, in which case your IP address is transmitted to the CDN. However, we aim to host fonts locally on our server so that no third parties are involved. We do not use Google Fonts, as loading them from Google servers would transmit your IP address to Google, and IP addresses are personal data under the GDPR. Instead, we use fonts from Fontshare or Klaviyo, which do not require your IP address to be sent to Google.

5.6 Cookie banner and consent management

• CookieScript. We use CookieScript to obtain and document your consent to cookies and tracking services. CookieScript stores your choices in a cookie with a consent ID and may process anonymised usage data, which is stored on CookieScript servers. Transfers abroad are possible. Processing is based on our legitimate interest in complying with the legal obligation to obtain consent.

5.7 Video hosting

• YouTube. We embed videos on our website via YouTube. When a video is accessed, data such as IP address, device information, interactions and, where applicable, location data is transmitted to Google. We use the privacy-enhanced mode, which only sets cookies when a video is played. By giving your consent, you activate YouTube, which transfers data to the USA.

5.8 Security tools

• Google reCAPTCHA. We use reCAPTCHA to verify that entries are made by a human. The service analyses your usage behaviour, such as mouse movements, scrolling and IP address, and transmits this data to Google. The legal basis is our legitimate interest in protecting the website from automated misuse.

6. Retention periods

We only store personal data for as long as necessary for the purposes described. The data is then deleted or anonymised. Business records and tax-relevant data are kept in line with legal obligations, usually for ten years. Usage data for analytics is stored anonymised or pseudonymised and deleted regularly once it is no longer needed.

7. Your rights

Under the revised FADP and, where applicable, the GDPR, you have the following rights:

1. Right of access. You can ask us at any time whether and which personal data we process about you. This includes information on the purpose of processing, the categories of data, the recipients and any international transfers.
2. Right to rectification. Incorrect or incomplete data will be corrected at your request.
3. Right to erasure (right to be forgotten). You can request the deletion of your data unless legal retention obligations apply.
4. Right to object. You can object to the processing of your data on grounds relating to your particular situation. We will then only continue processing if there are compelling reasons.
5. Right to restriction of processing. If the accuracy of the data is disputed or the processing is unlawful, you can request that processing be restricted.
6. Right to data portability. You can request that we provide the data you have given us to you or another controller in a common electronic format.
7. Right to withdraw consent. You can withdraw your consent at any time with effect for the future.
8. Right to object to marketing. You can object to the processing of your data for marketing purposes at any time. Every communication contains an unsubscribe option for this purpose.
9. Rights relating to automated decisions. If we make decisions solely by automated means, you have the right to have the decision reviewed by a natural person.
10. Right to lodge a complaint. You can lodge a complaint with the competent data protection authority, in particular the Federal Data Protection and Information Commissioner (FDPIC).

Requests can be sent in writing to the address above or by email. We may ask for additional information to verify your identity.

8. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse. These measures include in particular:

• Encryption. We use SSL/TLS encryption for data transmitted via our website.
• Access restrictions. Only authorised persons who need personal data for the respective purpose have access to it.
• Data minimisation and logging. We only store necessary data and keep records of processing, for example log files. The FADP requires controllers and processors to ensure an appropriate level of security through suitable technical and organisational measures.
• Pseudonymisation and anonymisation. Where possible, personal data is processed in pseudonymised or anonymised form.

9. Cookies and tracking

Cookies and similar technologies may be used when you visit our website. Cookies necessary for operating the website are stored on the basis of our legitimate interest. For all other cookies, such as analytics, marketing and personalisation, we obtain your consent via the cookie banner. Under the FDPIC cookie guidelines updated in October 2025, consent is required in particular where cookies are used for personalised advertising or location data is processed, as this is usually considered high-risk profiling. Our CookieScript solution documents your choices, and you can change them at any time.

10. Automated decision-making and profiling

Automated decisions with legal effect or significant impact only take place with your consent. Profiling for marketing purposes only takes place with consent and is limited to what is necessary. Under the FADP, data subjects have the right to state their point of view on automated decisions and to request a review by a natural person.

11. Changes to this privacy policy

We reserve the right to amend this privacy policy at any time, in particular in response to new legal requirements or the introduction of new services. The current version is published on our website. We will inform you appropriately of any significant changes.

12. Contact and supervisory authority

If you have any questions about data protection or wish to exercise your rights, please contact us using the details above. Complaints can be addressed to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch).