Privacy Policy

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

When this website is accessed, technical data necessary for delivering and securing the website may be processed. This may include, in particular, IP address, date and time of access, requested resource, browser and device information, referring page and technical connection information.

The website is hosted using Vercel. Processing is carried out for the purpose of securely and reliably providing the website, detecting technical faults and protecting the service against misuse.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest consists in the secure, stable and efficient operation of the website.

Technical information may be processed by Vercel and its subprocessors. Where data is transferred outside the European Economic Area, the respective provider's applicable safeguards for international transfers apply.

epm.visuals uses Supabase for database services, authentication and file storage.

Depending on the function used, Supabase may process technical identifiers, authentication information, database records and files required for operating the gallery, collaborations, downloads and administration area.

Public visitors do not receive access to private high-resolution image storage. High-resolution files are stored in a private storage bucket and are made available only through time-limited download links where the applicable requirements are met.

Processing is based on Art. 6(1)(b) GDPR where it is required to provide a requested contractual service, and otherwise on Art. 6(1)(f) GDPR for the secure technical operation of the website.

epm.visuals uses its own first-party analytics system to understand how the website and its content are used.

Depending on the interaction, the system may store an event type, the visited path, optional internal gallery or collaboration identifiers, a purchase amount where applicable and the time of the event.

The analytics database is not designed to store names, email addresses, advertising identifiers or device fingerprints. epm.visuals does not use this analytics system to create individual advertising profiles.

The purpose is to evaluate the performance and use of the portfolio and to improve content and website functionality. Processing is based on Art. 6(1)(f) GDPR. The legitimate interest consists in improving and operating the website on the basis of aggregated usage information.

Analytics records are retained only for as long as they are required for these evaluation purposes and are deleted when they are no longer required, subject to any applicable legal retention obligations.

If you contact epm.visuals through the contact form or by email, the information you provide is processed in order to handle and respond to your request.

This may include your name, email address, message and other information voluntarily included in your enquiry.

Website messages are transmitted using Resend and may subsequently be processed within the email infrastructure used by epm.visuals, including Google Workspace.

Where the enquiry relates to a contract or steps requested before entering into a contract, processing is based on Art. 6(1)(b) GDPR. For other enquiries, processing is based on Art. 6(1)(f) GDPR, based on the legitimate interest in responding to communications.

Messages are retained for as long as necessary to process the enquiry and any reasonable follow-up. Longer retention may occur where required by law or where necessary for the establishment, exercise or defence of legal claims.

Payments for supported digital offerings are processed using Stripe.

When Stripe Checkout is used, information required for the payment transaction is processed by Stripe. This may include payment details, transaction information, billing information and technical information required for fraud prevention and payment processing.

epm.visuals does not receive or store complete payment card details. Payment card information is entered directly into Stripe's payment environment.

epm.visuals receives information necessary to verify the transaction, such as the Stripe checkout session, payment status, transaction-related identifiers and the purchased gallery item.

Processing is based on Art. 6(1)(b) GDPR insofar as it is necessary for processing and fulfilling the transaction. Data may additionally be processed where required to comply with legal obligations under Art. 6(1)(c) GDPR.

Where a digital image download is provided following a payment or another permitted download action, internal gallery identifiers and transaction information may be processed in order to determine whether access to the requested file is permitted.

Private high-resolution files are not exposed through a permanently public file address. Where applicable, access is provided through temporary signed URLs.

The legal basis is Art. 6(1)(b) GDPR for the performance of the requested digital service and Art. 6(1)(f) GDPR for preventing unauthorised access and protecting copyrighted material.

epm.visuals does not currently use advertising cookies or third-party marketing tracking technologies.

Technically necessary cookies or comparable storage mechanisms may be used where required for essential functionality, security or authentication, for example within the protected administration area.

If additional non-essential tracking or marketing technologies are introduced in the future, this privacy policy and, where legally required, the consent mechanism will be updated before those technologies are activated.

Personal data is disclosed only where this is necessary for operating the website, providing a requested service, processing payments, responding to enquiries, complying with legal requirements or where another legal basis permits the disclosure.

Depending on the function used, recipients may include providers in the following categories:

• hosting and content delivery — Vercel
• database, authentication and storage — Supabase
• payment processing — Stripe
• transactional email delivery — Resend
• email infrastructure — Google Workspace

Some service providers used by epm.visuals are based outside Austria or may use infrastructure or subprocessors located outside the European Economic Area.

Where a transfer of personal data to a third country takes place, it is carried out only where the requirements of Chapter V GDPR are met, for example on the basis of an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Personal data is retained only for as long as necessary for the respective purpose.

Where statutory retention obligations apply, relevant information may be retained for the duration required by law. Data may also be retained for an appropriate period where necessary for the establishment, exercise or defence of legal claims.

Technical provider logs are subject to the respective service provider's operational and contractual retention settings.

Subject to the requirements of the GDPR, data subjects have in particular the right to request access to their personal data, rectification, erasure, restriction of processing and data portability.

Where processing is based on a legitimate interest, you may also have the right to object to the processing under the conditions of Art. 21 GDPR.

Where processing is based on consent, consent can be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Requests concerning data protection can be sent to:

contact@epmvisuals.com

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

epm.visuals does not currently use personal data collected through this website for automated decision-making or profiling within the meaning of Art. 22 GDPR.

This privacy policy may be updated where the website, the services used or the applicable legal requirements change.

The current version is published on this page.