Privacy

The controller responsible for data processing on this website is:

Marcel Zirpins & Norman Zirpins GbR
trading under the business name VZN Brothers
Bei der Lutherbuche 45
22529 Hamburg
Germany

Email: team@vznbrothers.com
Phone: +49 152 2635 1091

We have not appointed a data protection officer, as we are not legally required to do so.

Under the GDPR you have the following rights in relation to your personal data:

To exercise any of these rights, write to team@vznbrothers.com. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit).

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

The servers running this website are located in Frankfurt am Main, Germany (region “fra1”), as is the Neon database (region “eu-central-1”), so your data is processed within the European Union. Because Vercel is a US company and access from the United States cannot be ruled out in every case, a data processing agreement pursuant to Art. 28 GDPR is in place, which incorporates the EU Standard Contractual Clauses for such cases.

When you visit the site, the provider's servers automatically record information that your browser transmits. This includes the browser type and version, the operating system used, the referrer URL, the host name of the accessing device, the time of the server request and the IP address.

This data is not merged with other data sources and is not forwarded to third parties — no log forwarding to external services is configured. Retention follows Vercel's own log retention; we keep no log files beyond that. Processing is based on Art. 6 (1) (f) GDPR: we have a legitimate interest in the technically error-free presentation and security of our website.

The photographs, films and PDF documents on this website are not stored on the same server as the site itself, but in Cloudflare R2 object storage. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The storage area we use is pinned to the provider's EU jurisdiction, so the files are held within the European Union.

When you open a page containing images or video, your browser fetches those files directly from there. Your IP address is transmitted to Cloudflare in the process, along with the file requested, the time and your browser identification. Without that transmission the files could not be delivered.

The legal basis is Art. 6 (1) (f) GDPR: we have a legitimate interest in serving a website built around photography and film quickly and reliably. The data processing agreement under Art. 28 GDPR is incorporated into Cloudflare's terms of service.

This site uses TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the address line of your browser changing from “http://” to “https://” and by the lock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

When you submit the contact form, a server function on our hosting infrastructure receives your details, stores them in our database and additionally sends them as an email to our mailbox. Three processors are therefore involved: Vercel Inc. for running the server function (Frankfurt, Germany), Neon Inc. for the database (Frankfurt, Germany) and Resend for sending the mail (Ireland, technically via Amazon SES). Your message is also retained in the sending service's delivery log.

We also record which channel brought you to us: the referring website, or the marking we attach ourselves to links we post, for example on Instagram. That tells us which of our channels actually lead to enquiries. It is a single word such as Google, Instagram or direct, it is stored only together with an enquiry you send, and it says nothing about you as a person. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR.

All three processing steps take place within the European Union. Data processing agreements pursuant to Art. 28 GDPR are in place with all of them; where a provider is based in the United States and access from there cannot be ruled out in every case, those agreements incorporate the EU Standard Contractual Clauses. The message is then held in that mailbox, as any email would be.

If you send us an enquiry using the contact form, the details you provide — including your name, company, email address, the type of project, the date, the location, a budget range and your message — are stored so that we can process the enquiry and answer any follow-up questions.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract or to pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR, based on our legitimate interest in responding to enquiries addressed to us.

The data you send remains with us until you ask us to delete it, withdraw your consent, or the purpose for storing it no longer applies — for example once an enquiry has been dealt with and no booking followed. Statutory retention periods, in particular under tax and commercial law, remain unaffected.

The same applies to enquiries you send us directly by email, telephone or via Instagram or LinkedIn.

We do not use the data from enquiries for advertising, and we do not operate a newsletter.

When we photograph or film you, we obtain your consent through a form on this website — either consent to be photographed or a release for individual images to appear in our portfolio.

As evidence of that consent we store your name, the occasion, the date and place of the shoot, the permissions you ticked, the language you chose, the time of submission, your IP address and your browser identification. The IP address and browser identification serve only to show that consent was actually given; we do not analyse them and do not combine them with anything else.

The legal basis for the recordings and their publication is your consent under Art. 6 (1) (a) GDPR. The legal basis for storing the record of it is Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR — we must be able to demonstrate that consent was given.

You may withdraw your consent at any time with effect for the future, in full or for individual images. An email to team@vznbrothers.com is enough. We note the withdrawal against the record and remove the content from our own channels. Anything already printed cannot be recalled.

We keep the record for as long as we use the recordings, and afterwards for as long as claims arising from them can be made.

The Switzer and Montserrat typefaces used on this website are stored on our own server and delivered from there. No connection is made to Google Fonts or any other external font provider, so no data about your visit is transmitted to third parties for this purpose.

Our work involves photographing people at events, at work and in private settings. Where we photograph on assignment, the client is responsible for informing those present that photography is taking place.

Photographs published on this website are shown either with the consent of the people depicted (Art. 6 (1) (a) GDPR) or on the basis of a written agreement with the client who commissioned the work. For images from public events and gatherings we additionally rely on § 23 (1) no. 3 of the German Art Copyright Act (KUG). Where a person is recognisable and individually the subject of an image, we obtain consent.

If you appear in an image on this website and would like it removed, write to team@vznbrothers.com. We will take it down without asking for a reason.

Original files from commissioned work are stored on encrypted drives and are not published or passed on to third parties without the client's instruction.

We use Vercel Web Analytics to see how often our pages are opened and which of them are read. It is provided by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, who also host this website; the Art. 28 GDPR data processing agreement therefore covers this processing as well.

The measurement works without cookies. Nothing is stored on your device and nothing is read from it, which is why this site has no cookie banner. No profile is built across sessions, sites or devices, and the data cannot be traced back to you personally: your IP address and browser details are used only to form a checksum that identifies a visit for one day and is then discarded. Recorded are the page called up, the referring page, and coarse information such as country, device type and browser.

The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR in understanding which of our work reaches people. You may object to this processing at any time under Art. 21 GDPR — a message to the address given above is enough.

Beyond the reach measurement described above we use no analytics tools, no tracking pixels, no advertising networks and no social media plug-ins. No cookies are set for analysis or marketing purposes. Links to Instagram and LinkedIn are plain hyperlinks — no data is transmitted to those platforms until you click them.

We may update this privacy policy so that it continues to reflect current legal requirements or changes to our services. The version published here always applies to your visit.

Last updated: September 2026.