This is an English translation for your convenience. Only the German version of this privacy policy (Datenschutzerklärung) is legally binding. In the event of any discrepancy, the German version shall prevail.
On your first visit, our cookie banner asks which cookies and services you want to allow. Technically necessary cookies are always active. Statistics, analytics and marketing services only run with your consent.
Changing your settings or withdrawing your consent: You can do this at any time. Simply click the “Cookie – Manage consent” tab at the bottom of your screen. The cookie banner will appear again, and you can change your selection or withdraw your consent completely.
You can also block or delete cookies directly in your browser. To find out how, see your browser’s help pages or: en.wikipedia.org, www.allaboutcookies.org. Please note that some features of the website may then be restricted.
As of: October 2026
Protecting your personal data is particularly important to us. We process your data exclusively on the basis of the statutory provisions (GDPR and the Austrian Telecommunications Act 2021, TKG 2021). The following are jointly responsible for data processing on this website:
Agnes Tovari and
Jozsef Vas
(both as sole traders, jointly under the brand Woodland Stories)
Hütteldorfer Straße 259/31, 1140 Vienna, Austria
Phone: +43 (0) 699 1709 5740
Email: office@woodlandstories.at
Legal notice (Impressum, in German): www.woodlandstories.at/impressum/
We run Woodland Stories together and jointly decide on the purposes and means of data processing (joint controllership under Art. 26 GDPR). We have agreed between ourselves who fulfils which obligations. You can exercise your rights against either of us, most easily via the email address above.
If personal data relating to you are processed, you are a data subject within the meaning of the GDPR. After successful identification, you have the following rights against us:
Withdrawing consent: Many data processing operations are only possible with your express consent. You can withdraw any consent you have given at any time and without any formalities, by email to office@woodlandstories.at or by post to Woodland Stories, Hütteldorfer Straße 259/31, 1140 Vienna, Austria. The lawfulness of processing carried out before the withdrawal remains unaffected (Art. 7(3) GDPR).
Complaints: You have the right to lodge a complaint with the data protection authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at, or with another data protection supervisory authority in the EU, in particular in the place where you live or work.
Advertising by third parties: We hereby object to the use by third parties of the contact details published in our legal notice for sending advertising and information material that has not been expressly requested. We reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.
Our website and our email mailboxes (e.g. office@woodlandstories.at) are operated by easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria (www.easyname.at). easyname provides us with infrastructure, computing capacity, storage space, database and email services, as well as security and maintenance services. In doing so, easyname processes master data, contact data, content data, usage data and meta and communication data of customers, prospective customers and visitors on our behalf. The legal basis is our legitimate interest in the efficient and secure operation of our online offering (Art. 6(1)(f) GDPR) in conjunction with a data processing agreement (Art. 28 GDPR).
Our website is based on WordPress with the Elementor page builder. For multilingual content (WPML), caching (WP Rocket) and the online shop (WooCommerce), we use plugins that run on our web space at easyname.
Our hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:
For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is required for evidence purposes are exempt from deletion until the incident in question has been finally clarified. We do not combine these data with other data sources. Processing is based on our legitimate interest (Art. 6(1)(f) GDPR).
For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the change in your browser’s address bar from “http://” to “https://” and by the padlock symbol. When encryption is active, the data you send to us cannot be read by third parties.
Our website uses cookies. These are small text files that your browser stores on your device. We use technically necessary cookies on the basis of our legitimate interest (Art. 6(1)(f) GDPR). We only use all other cookies (e.g. for statistics, analytics and marketing) with your consent (Art. 6(1)(a) GDPR and TKG 2021).
We manage your choices with Complianz. Complianz stores your privacy settings and consents so that we can take them into account and demonstrate them on future visits. This is done to fulfil a legal obligation (Art. 6(1)(c) GDPR) and on the basis of our legitimate interest (Art. 6(1)(f) GDPR). How to change your selection is explained at the very top under “Your cookie settings”.
You can also prevent Google Analytics from collecting the data generated by cookies by installing this browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en
If you contact us via the form on our website, by email, phone or WhatsApp, we store your details in order to process your enquiry and in case of follow-up questions. The legal basis is pre-contractual measures or the performance of a contract (Art. 6(1)(b) GDPR), and beyond that our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR). We do not pass these data on to third parties without your consent. Exceptions are service providers that support us technically, such as easyname as our hosting and email provider. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
If you have booked a photoshoot with us, we may occasionally write to you, even without separate consent, with information about your images or with offers relevant to your booking (§ 174(4) TKG 2021, legitimate interest under Art. 6(1)(f) GDPR). We send these messages individually from our mailbox. You can object to this at any time, informally by email to office@woodlandstories.at (for example by replying “Unsubscribe”), and you will then receive no further messages of this kind.
To run our online shop, we use WooCommerce, an e-commerce solution from Automattic Inc. Personal data are processed in connection with orders to the extent necessary to perform the contract. This concerns in particular: first and last name, billing address, email address, phone number (if provided), order information and payment information. Order data are stored to perform the contract, for invoicing and accounting, and to comply with statutory retention obligations. Processing is based on Art. 6(1)(b) GDPR to carry out pre-contractual measures and to perform the contract.
To process payments in our online shop, we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When a payment is made, the personal data required to process the payment are transmitted to Stripe. This concerns in particular: name, email address, billing address, order information and payment data. Stripe may also transfer data to affiliated companies and technical service providers for fraud prevention, payment processing and compliance with legal requirements. Processing is based on Art. 6(1)(b) GDPR. Further information: https://stripe.com/at/privacy
When vouchers are purchased via our online shop, the personal data required to perform the contract are processed. After successful payment, the purchased voucher is automatically provided as a PDF file and sent electronically. To manage the order, we process in particular the order number, billing data and voucher data. Processing is based on Art. 6(1)(b) GDPR.
We collect, process and use personal data to the extent necessary for establishing, defining the content of or changing the contractual relationship (master data). This is done on the basis of Art. 6(1)(b) GDPR. After the assignment has been completed and the statutory (e.g. tax-related) retention periods have expired, the data are deleted.
We process the photos taken during your photoshoot in order to make them available for you to choose from, to edit the selected images (retouching and, for Digital Christmas Worlds, additional graphic design) and to deliver the finished images to you (Art. 6(1)(b) GDPR). We only pass on your photos to the service providers named in this policy.
We make your images available to you in a password-protected online gallery under the domain pixieset.com. Pixieset is operated by the Canadian company Pixieset Media Inc. Only you have access to the gallery. By default, Pixieset temporarily stores your IP address and stores your email address in order to send you the download link to your images once the assignment has been completed. Pixieset’s privacy policy applies: https://pixieset.com/privacy/
To edit and design our images – for all photoshoots and packages, including fine art images – we use AI-assisted tools, currently:
Processing may also be carried out by companies of the providers in the USA and in Singapore.
Legal basis: We use these tools to edit and design your images. This is part of the performance of the contract (Art. 6(1)(b) GDPR). In addition, we have a legitimate interest in efficient, high-quality image editing (Art. 6(1)(f) GDPR). Where data are transferred to a third country, we rely on standard contractual clauses (SCC) or, where the provider is certified, on the EU-US Data Privacy Framework.
Your right to object: If you do not want your images to be processed with these tools, please let us know before the photoshoot (Art. 21 GDPR). We will then check whether we can edit your images without these tools.
After the finished images have been delivered (download link sent), we keep your image files for 6 more months. After that, they are deleted. We therefore recommend backing up the images in several places after downloading them, for example on an external hard drive and additionally in a cloud. Storage serves to allow re-delivery in case of loss and to deal with complaints (Art. 6(1)(b) and (f) GDPR). Images that we have published with your consent are exempt from this (see below).
We only publish images of you (e.g. on our website, on social media or in advertising) with your express written consent (Art. 6(1)(a) GDPR). We publish nothing without your consent. You can withdraw your consent at any time (see section 2). From the time of withdrawal, we will no longer use the images.
We use the following services only with your consent (Art. 6(1)(a) GDPR), which you give in the cookie banner and can withdraw at any time. Without your consent, they are not loaded.
We use Complianz to manage consents for cookies and similar technologies. Complianz stores the privacy settings and consents you have chosen so that they can be tracked on future visits. Processing is carried out to fulfil a legal obligation (Art. 6(1)(c) GDPR) and on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics allows us to analyse the use of our website in order to continuously improve our offering. By default, Google Analytics 4 does not store IP addresses. The data may be transferred to Google servers in the USA. Further information: https://policies.google.com/privacy
We use Google Ads conversion tracking by Google Ireland Limited. This allows us to see whether visitors have carried out certain actions on our website, for example sent an enquiry, bought a voucher or booked an appointment. Further information: https://policies.google.com/privacy
We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It is used to integrate tracking and statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any analyses of its own. It merely serves to manage and deliver the tools integrated through it.
This website uses the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. This allows us to understand how visitors behave after they have reached our website via a Facebook or Instagram advertisement. Further information: https://www.facebook.com/privacy/policy/
We use Microsoft Clarity, an analytics service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us how visitors use our website, for example through heatmaps (where people click and scroll) and anonymised recordings of visits. In the process, cookies may be set and data such as device type, browser, approximate location, clicks and mouse movements may be processed. Entries in form fields are masked. Clarity runs in consent mode, meaning the service is only used with your consent. The data may be transferred to Microsoft servers in the USA. Further information: https://privacy.microsoft.com/en-gb/privacystatement
To protect our forms against spam and abusive automated requests, we use Google reCAPTCHA by Google Ireland Limited. In the process, data may be transmitted to Google. Processing is based on our legitimate interest in protecting our website against automated attacks and spam (Art. 6(1)(f) GDPR). Further information: https://policies.google.com/privacy
On our website, we offer the option of contacting us via WhatsApp. When you use this function, personal data (e.g. phone number, message content, metadata) are transmitted to WhatsApp and processed there. The privacy policy of WhatsApp Ireland Limited or Meta Platforms Ireland Ltd. applies: https://www.whatsapp.com/legal/privacy-policy-eea
We maintain online presences on social networks in order to communicate with customers, prospective customers and users active there and to inform them about our services. When you access the networks, the terms and conditions and data processing policies of the respective operators apply. We only process your data there to the extent that you communicate with us within the networks, e.g. by writing posts or sending us messages.
Some of the services mentioned (e.g. Google LLC, Meta Platforms, Inc., Microsoft, Stripe, Adobe Inc., OpenAI, TRUESIGHT PTE. LTD. with Amazon Web Services as sub-processor, and Pixieset Media Inc.) may process personal data in the USA, in Singapore, in Canada and in other third countries. The transfer is based on the EU-US Data Privacy Framework or on standard contractual clauses (SCC), with which our providers guarantee an adequate level of data protection. Where necessary, we additionally rely on your consent (Art. 49(1)(a) GDPR), which you give in the cookie banner. Under “Cookie – Manage consent” you will find more detailed information about the individual services and cookies. You can manage your consent separately for each purpose and each provider and withdraw it at any time. Please note that not all functions of the site may then be available.
We only store personal data for as long as is necessary for the respective purposes or as required by statutory retention obligations.
| Data | Period |
|---|---|
| Enquiries and correspondence (form, email, WhatsApp) | until the enquiry has been dealt with, then a maximum of 26 months |
| Booking, order, contract, invoice, voucher and payment data | seven years (statutory retention obligation, § 132 of the Austrian Federal Fiscal Code, BAO) |
| Photos, image files and online galleries | 6 months after delivery of the finished images, then deletion |
| Images published with your consent and the proof of consent | until you withdraw your consent, then only as far as necessary as proof |
| Images in AI tools | Evoto: preview images deleted after processing, intermediate results up to 8 days. ChatGPT: conversations are deleted once editing is complete. Adobe: in accordance with Adobe’s information. |
| Server log files | a maximum of 7 days |
| Cookie and analytics data | in accordance with your settings in the cookie banner and the providers’ information |
We always endeavour to respect the copyrights of others and to use works we have created ourselves or licence-free works. The content and works created by us on this website are subject to copyright. Contributions by third parties are marked as such. Reproduction, editing, distribution and any kind of exploitation beyond the limits of copyright law require the written consent of the respective author. Downloading and copying the photos used is not permitted.
We reserve the right to update this privacy policy from time to time in order to adapt it to changes in the legal framework or to technical developments. You will always find the current version on this page. You can reach us using the following contact details: Woodland Stories, Agnes Tovari and Jozsef Vas, Hütteldorfer Straße 259/31, 1140 Vienna, Austria, email: office@woodlandstories.at, phone: +43 (0) 699 1709 5740
