Privacy policy
This website is a photography portfolio. It collects as little data as a website can: no accounts, no newsletter, no shop. What it does process is described here, in plain language, as required by the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Controller
Johnny Be Good GmbH
Schüttelstraße 77A, 1020 Vienna, Austria
Managing director: Florian Kozak
hey@johnnybegood.at, +43 1 26 77 3 77
We have not appointed a data protection officer, as we are not legally required to. Questions about data protection go to the address above.
Hosting and server logs
The website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany, on servers located in Germany. When you open a page, the server records the IP address of your device, date and time, the requested page, the amount of data transferred, the browser and operating system and the page you came from. We need this to deliver the website, to keep it secure and to find errors. The legal basis is our legitimate interest in a working and secure website (Art. 6 (1) (f) GDPR). Log files are deleted automatically after a few days; Raidboxes processes them on our behalf under a data processing agreement.
Consent management
We use clickskeks (mein.clickskeks.at), a consent management service operated from Austria, to ask for your consent to cookies and tracking and to document your choice. For this, clickskeks stores a cookie with your decision and processes your IP address in shortened form, the time of your decision and the browser you use. The legal basis is our legal obligation to obtain and prove consent (Art. 6 (1) (c) GDPR together with § 165 (3) TKG 2021). You can change or withdraw your decision at any time through the fingerprint button at the bottom left of every page.
Cookies and similar technologies
Technically necessary cookies are set without consent, everything else only after you agree. The list below is generated by our consent tool and always reflects what is currently in use on this website.
Google Tag Manager and Google Analytics
We use Google Tag Manager to load measurement tools, and Google Analytics 4 to understand how the website is used: which pages are opened, how long visitors stay and roughly where they come from. Both are services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself sets no cookies and collects no personal data beyond the technically necessary request to Google’s servers. Google Analytics only runs after you have consented in the cookie banner; until then Google Consent Mode keeps all storage switched off. Analytics processes a pseudonymous client ID, shortened IP addresses, device and browser information and your interactions on the site. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time via the fingerprint button. Reports are kept for 14 months.
Contact form
If you write to us through the contact form, we process your name, your email address, your message and the time it was sent. The form is provided by the WordPress plugin WPForms, which runs on our own server; your message is stored in our WordPress installation and sent to us by email. We use it only to answer you. The legal basis is your consent given by ticking the box (Art. 6 (1) (a) GDPR) and, if the conversation leads to a job, the preparation of a contract (Art. 6 (1) (b) GDPR). We delete messages once the request is settled, at the latest twelve months after your last message, unless they belong to a commissioned job that we have to keep for accounting reasons.
If you email us directly, we keep the correspondence as long as it is needed to handle your request and as long as we are legally obliged to keep business letters (seven years under Austrian tax law for anything related to an order).
Fonts and media
The fonts on this website (Inter and Bebas Neue) are stored on our own server; no fonts are loaded from Google or any other third party. Photographs and videos are also served from our own server. We embed no content from social networks.
Security
To protect the website against attacks we use the security plugin Wordfence by Defiant Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA. It analyses requests to the website and may block IP addresses that behave maliciously; for this it processes IP addresses, request data and the time of access and compares them with Defiant’s threat lists, which involves a transfer of IP addresses to the USA under standard contractual clauses. The legal basis is our legitimate interest in a secure website (Art. 6 (1) (f) GDPR).
Links to other websites
We link to Instagram, LinkedIn and johnnybegood.at. These are plain links; no data is passed on until you click and leave this website. From then on, the privacy policy of the respective operator applies.
Your rights
You have the right to information about the personal data we hold about you, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. Where processing is based on your consent, you can withdraw it at any time with effect for the future. To exercise any of these rights, write to hey@johnnybegood.at. If you believe we process your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
Changes
We update this policy when the website or the law changes. This version is dated October 2026.