Skip to main content

Privacy Policy

1. Controller

FOTOHOF – Association for the Promotion of Author Photography
Inge Morath Platz 2
5020 Salzburg, Austria

Phone: +43 662 84 92 96
Email: fotohof@fotohof.at
Website: https://fotohof.at

2. Principles of Data Processing

We only process personal data to the extent necessary for providing our website and services. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). We do not collect data beyond what is necessary and do not share data with third parties for advertising purposes.

3. Hosting

This website is hosted on a server operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The servers are located within the European Union. When you visit our website, the web server automatically collects technical access data (so-called server log files):

  • IP address of the accessing device
  • Date and time of access
  • Page or file accessed
  • Amount of data transferred
  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)

This data is technically necessary to deliver the website and ensure its security. It is typically deleted automatically after 14 days and is not combined with other data sources.

Legal basis: Legitimate interest pursuant to Art. 6(1)(f) GDPR (security and operation of the website).

4. Cookies

Our website only uses technically necessary cookies. When using forms (e.g. the submission form or newsletter sign-up), a security token (CSRF cookie) is set to protect against fraudulent form submissions. This cookie does not contain any personal data. No tracking, advertising, or other non-essential cookies are used.

Legal basis: Legitimate interest pursuant to Art. 6(1)(f) GDPR (technically necessary operation).

5. Web Analytics with Umami

We use Umami, a privacy-friendly web analytics tool that we operate ourselves on a server managed by us (under the domain data.fotohof.at). No cookies are set in this process.

Umami collects the following data in anonymised form:

  • Pages visited
  • Referring website (referrer)
  • Browser type and screen resolution
  • Browser language setting
  • Country of access

IP addresses are not stored in plain text by Umami. The analysis serves exclusively to improve our website. No data is shared with third parties. Umami respects the "Do Not Track" setting of your browser – if this is enabled, no data is collected.

Legal basis: Legitimate interest pursuant to Art. 6(1)(f) GDPR (improvement of the website).

6. Open Call Submission Form

Through our submission form, artists can submit projects for our open calls. The following data is collected:

Required information:

  • First name and last name
  • Email address
  • Year of birth
  • Place of residence and country
  • Project title, project year, project status
  • Project description and biography
  • Image files (JPEG, max. 12)

Optional information:

  • Phone number
  • Website
  • Instagram username

Consent:

  • Consent to data processing (required)
  • Granting of publication rights (required)
  • Newsletter sign-up (optional)

The submitted data is stored in our database and is accessible only to the jury and the administration. Consent records are stored immutably.

Purpose: Conducting and evaluating open call submissions.
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR and pre-contractual measures pursuant to Art. 6(1)(b) GDPR.
Storage period: Data is stored for the duration of the respective open call and subsequent project processing. Once the purpose has been fulfilled, or upon your request, data will be deleted unless statutory retention obligations apply.

7. Newsletter

You can subscribe to our newsletter via our newsletter form. We use Listmonk, a self-hosted newsletter application running on a server managed by us (newsletter.fotohof.at).

Data collected:

  • Email address (required)
  • Name (optional)
  • Language preference (German/English)

Newsletters are sent via Amazon Simple Email Service (Amazon SES), an email delivery service provided by Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg). Amazon SES processes your email address for the purpose of delivery. Processing is based on a data processing agreement, and data is processed on servers within the European Union.

Newsletter subscription requires your explicit consent. You can unsubscribe at any time – an unsubscribe link is included in every newsletter.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR.
Storage period: Your data is stored until you withdraw your consent (unsubscribe).

8. Email Delivery

For sending emails related to our services (e.g. confirmations, system notifications), we also use Amazon SES. Only your email address is transmitted to Amazon SES to the extent necessary for delivery.

Legal basis: Legitimate interest pursuant to Art. 6(1)(f) GDPR (operation of the website) or contractual performance pursuant to Art. 6(1)(b) GDPR.

9. No Disclosure to Third Parties

Apart from the use of Amazon SES for email delivery and Hetzner for hosting, no personal data is disclosed to third parties. All other services (web analytics, newsletter management) are operated by us on servers within the EU. No data is transferred to countries outside the European Union.

We do not use external fonts (e.g. Google Fonts), external tracking services, social media plugins, or advertising services. All resources (fonts, JavaScript libraries) are served directly from our server.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Access (Art. 15 GDPR): You may request information about whether and which personal data we process about you.
  • Rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
  • Erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
  • Restriction of processing (Art. 18 GDPR): Under certain conditions, you may request the restriction of processing.
  • Data portability (Art. 20 GDPR): You may request to receive your data in a commonly used, machine-readable format.
  • Objection (Art. 21 GDPR): You may object to the processing of your data based on legitimate interest at any time.
  • Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent given at any time with effect for the future.

To exercise your rights, please contact: fotohof@fotohof.at

11. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
Phone: +43 1 521 52-25 69
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

12. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or our services. The current version published on this website shall always apply.

Last updated: February 2026