Privacy.

1. Controller

You may use the email address above for privacy requests. To prevent unauthorised disclosure, RMU Foto may request suitable proof of identity before responding.

2. Scope and principles

This policy applies to rmufoto.ch, its German- and English-language pages, enquiries, orders, licence reviews, payment confirmations and digital delivery of image files.

• Personal data is processed lawfully, in good faith and transparently.
• Processing is limited to identifiable and necessary purposes.
• Only data required for website operation, security, communication and contract processing is collected.
• Incorrect data is corrected following a substantiated request.
• Data is deleted or anonymised when the purpose and applicable retention duties no longer require it.

4. Contacting RMU Foto

If you contact RMU Foto by email, the sender address, name, message content, time and any attachments are stored to process the enquiry. The information may later be associated with an order or licence agreement.

The information is not reused for newsletters or third-party advertising. Statutory documentation and retention duties, and the establishment, exercise or defence of legal claims, remain reserved.

5. Hosting, server logs and protected order files

According to the current configuration, the website is hosted by:

cyon GmbH
Brunngässlein 12
4052 Basel
Switzerland

When a page is requested, the server may record the IP address, date and time, requested address, referrer, browser and operating-system information, transferred data volume and HTTP status. This supports operation, troubleshooting, abuse prevention and information security.

Orders are additionally stored in access-protected server-side order files and security logs.

7. Security and abuse-prevention data

When the order form is submitted, technical information is processed to prevent automated or manipulated requests:

• IP address, user agent, referrer and timestamps,
• CSRF token, form age and honeypot check,
• a basic technical browser value derived from user agent, language, screen dimensions and time-zone offset,
• rate-limit and security events.

This information is not used for personalised advertising or commercial user profiling. It is used only for system and order security, abuse prevention and preserving evidence.

8. Automated checks

There is no automated licence acceptance and no solely automated decision producing a similarly significant effect. Rule-based security and plausibility checks may block a technically invalid order.

Order approval, payment information and confirmation of payment receipt are initiated by RMU Foto.

10. Disclosure abroad

Hosting and the main website operation are currently configured for Switzerland. Google Fonts, social-media links, email routing or technical service providers may nevertheless involve processing in the EU/EEA, the United States or other countries.

Personal data is disclosed abroad only under the conditions of the Swiss FADP, for example where an adequate level of protection is recognised, appropriate contractual safeguards apply, a statutory exception applies or valid consent has been given.

11. Retention and deletion

• Order, contract and accounting data: generally up to 10 years where statutory documentation and record-keeping duties apply.
• Enquiries: for as long as required to process the request, answer follow-up questions, perform a contract or document legal matters.
• Technical and security data: the internal standard period is 365 days; security incidents, suspected abuse or legal claims may require longer retention.
• LocalStorage: until deleted by the user, until the cart is emptied or — in the case of the cart — until a successful order.

A PHP page does not automatically delete existing server data. These periods must therefore be implemented through regular operational clean-up, hosting settings or technical deletion routines.

12. Rights of data subjects

Depending on the applicable data protection law, you may in particular have the following rights:

• access to the personal data processed and the purposes of processing,
• correction of inaccurate data or completion of incomplete data,
• deletion, destruction, restriction or cessation of unlawful processing,
• objection to certain processing where applicable,
• release or transfer of data in a commonly used electronic format where the statutory requirements are met,
• withdrawal of consent for the future where processing is based on consent.

Requests should be sent to rmufoto@bluewin.ch. RMU Foto may take account of statutory exceptions, overriding interests and retention obligations.

Data subjects may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or pursue the civil-law remedies provided by the applicable legislation.

13. Data security

RMU Foto uses risk-appropriate technical and organisational safeguards, including:

• HTTPS transport encryption, secure session cookies and CSRF protection,
• server-side checks of orders, prices, series paths and image paths,
• access controls for order, log and administration areas,
• HMAC-protected administration actions and confirmation-based status changes,
• rate limits, input limits, logging and abuse detection,
• data minimisation and role-based access.

Despite appropriate measures, transmission of data over the internet cannot be guaranteed to be completely risk-free.

14. Applicable data protection law

The Swiss Federal Act on Data Protection and the related ordinance apply primarily. Where the EU General Data Protection Regulation also applies to a specific matter, processing is carried out, as applicable, for steps requested before entering into a contract, performance of a contract, compliance with legal obligations, legitimate interests or — where required — consent.