Back

Privacy Policy

Information for data subjects

General Information

Information about the controller

Company: Goldstein Studios GbR
Address: Josefine-Clouth-Straße 46, 50733 Köln, Germany

Contact details for data protection officer: email@iitr.de

Usage Data

When you access our website, your browser automatically transmits data to our web server. This includes:

  • Date and time of the request
  • Name of the requested file
  • Page from which the file was requested
  • Access status (file transferred, file not found, etc.)
  • Web browser and operating system used
  • Full IP address
  • Amount of data transferred

These data are temporarily stored for technical security reasons, in particular to defend against attacks. After 30 days at the latest, the data is anonymized by shortening the IP address.

Hosting and Service Providers

For the operation of Retail DI, we use the following technical service providers:

  • Vercel Inc. (USA) – Hosting and deployment of the web application
  • Supabase Inc. (USA / EU) – Database, authentication, and backend infrastructure
  • Google LLC (USA) – AI-powered analysis functions (e.g. image processing)
  • Brevo (Sendinblue GmbH, EU) – Email delivery (e.g. system and notification emails)
  • One.com Group AB (EU) – Domain management and technical infrastructure

Data processing agreements pursuant to Art. 28 GDPR are in place with all of these providers.

Third-Country Transfers

The use of certain services listed above may involve the transfer of personal data to countries outside the European Union, in particular to the USA.

These transfers are based on appropriate safeguards, in particular:

  • EU Standard Contractual Clauses (SCC)
  • Participation in the EU-U.S. Data Privacy Framework (where applicable)

User Accounts / Authentication

Use of the platform may require the creation of a user account.

Data processed:

  • Email address
  • Name (optional)
  • Login credentials (stored encrypted)

Purposes:

  • Providing secure access to the platform
  • Managing user permissions

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Processing of Image and Media Data

Retail DI serves as a digital image database. The following data may be processed:

  • Uploaded image files
  • Metadata (e.g. upload timestamp, user assignment)
  • Content that may relate to individuals

Purposes:

  • Storage, organization, and provision of image material
  • Improving findability and content structure

Note: Users are responsible for ensuring that uploaded content complies with applicable law.

Usage Analytics (Internal Data)

To provide and continuously improve our platform, we process internal usage data. This involves server-side information about how users interact with the platform.

Data collected includes:

  • Views of image content
  • File downloads
  • Favourite/save actions

This information is assigned to individual user accounts and evaluated within an internal analytics dashboard.

Purposes:

  • Ensuring and optimizing platform functionality
  • Improving usability and content quality
  • Analyzing usage in the context of platform operations

Legal bases:

  • Art. 6(1)(b) GDPR (performance of a contract in the context of platform use)
  • Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving the service)

Recipients: Data is processed exclusively internally and not shared with third parties for analytics purposes.

Retention: Data is retained for the duration of the user account or as long as a legitimate interest in the analysis exists.

Note: No tracking cookies or external analytics services are used.

Use of Artificial Intelligence (AI)

AI technologies (e.g. from Google) are used to improve platform functionality. This may involve automated analysis of images, in particular for:

  • Keyword tagging
  • Classification
  • Content structuring

Processing is carried out exclusively for the purpose of system functionality and optimizing the user experience.

Email Communication (Brevo)

Brevo is used for sending emails.

Data processed:

  • Email address
  • Name (where applicable)
  • Communication content

Purposes:

  • System emails (e.g. registration, password reset)
  • Notifications

Legal bases:

  • Art. 6(1)(b) GDPR (contractually required)
  • Art. 6(1)(a) GDPR (consent, for optional messages)

Cookies and Technical Storage

The platform uses technically necessary cookies and similar technologies for:

  • Session management (login)
  • Ensuring platform functionality

Storage occurs only to the extent necessary. Any optional technologies are only used after explicit consent has been given.

Retention Periods

  • User accounts: until account deletion
  • Image data: until deleted by the user or end of project
  • Log data: maximum 30 days
  • Communication data: in accordance with statutory retention obligations

Categories of Recipients

  • Public authorities where required by law
  • Processors in connection with hosting and platform operations
  • Other parties only where consent has been given or a legal basis exists

Rights of Data Subjects

You have the right at any time to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)

To exercise your rights, please contact us at: email@iitr.de

You also have the right to lodge a complaint with a data protection supervisory authority.