Privacy Policy
PRIVACY POLICY
Last updated: 11 November 2026
1. CONTROLLER
The controller responsible for processing personal data on this website is:
Cecilia Mlayeh
trading as The Edit Stories
Voltastraße 79
60486 Frankfurt am Main
Germany
Email: hello@theeditstories.com
Phone: +49 176 60968439
2. GENERAL INFORMATION
We take the protection of your personal data seriously. This Privacy Policy explains what personal data we collect when you visit our website or contact us, why we process it and what rights you have under the General Data Protection Regulation (“GDPR”).
Personal data means any information relating to an identified or identifiable individual, including names, email addresses, telephone numbers, IP addresses and information contained in an enquiry.
We only process personal data where there is a valid legal basis and only for as long as it is required for the relevant purpose.
3. WEBSITE HOSTING: SQUARESPACE
This website is created and hosted using Squarespace.
The service provider for users located outside the United States is:
Squarespace Ireland Limited
Squarespace House
Ship Street Great
Dublin 8, D08 N12C
Ireland
When you visit this website, Squarespace may process technical information required to display, operate and protect the website. This may include:
your IP address
browser and device information
operating system
date and time of access
pages and files requested
referring website
diagnostic, security and log data
This processing is necessary to provide a secure and functional website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient operation of our website.
Squarespace may also process data outside the European Economic Area. Where required, such transfers are protected by appropriate safeguards, including adequacy decisions, the EU–US Data Privacy Framework or Standard Contractual Clauses.
Further information is available in the Squarespace Privacy Policy:
https://www.squarespace.com/privacy
4. DOMAIN AND EMAIL HOSTING: IONOS
Our domain and email services are provided by:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany
IONOS processes technical and communication data where this is necessary to provide our domain and email services. When you contact us by email, your email address, the content of your message and any additional information you provide are processed through IONOS systems.
The legal basis is Article 6(1)(b) GDPR where your message relates to a potential or existing contract. For general communication, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to enquiries and maintaining professional communication.
Further information is available in the IONOS Privacy Policy:
https://www.ionos.de/terms-gtc/privacy-policy/
5. COOKIES AND CONSENT MANAGEMENT
This website uses cookies and similar technologies. Some cookies are technically necessary for the website to function. Other cookies are used for analytics and are only activated after you have given your consent.
We use the integrated Squarespace cookie banner and restrict non-essential cookies until consent has been provided.
Technically necessary cookies are used on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (“TDDDG”) and Article 6(1)(f) GDPR.
Analytics and other non-essential cookies are used only with your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can refuse non-essential cookies without affecting the essential functionality of the website. You can also withdraw or change your consent at any time through the “Cookie Settings” link available on this website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
6. SQUARESPACE ANALYTICS
We use Squarespace Analytics to understand how visitors interact with our website. Depending on your consent settings, Squarespace Analytics may process information such as:
visited pages
number and duration of visits
approximate location
referring websites
browser and device information
interactions with website content
cookie and session identifiers
Non-essential Squarespace analytics and performance cookies are restricted until you provide your consent.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings.
Information collected through Squarespace Analytics is retained only for as long as required for the stated analytical purposes and in accordance with the retention settings and contractual arrangements applicable to our Squarespace account.
7. GOOGLE ANALYTICS
With your consent, we use Google Analytics to understand how our website is used and to improve its content and performance.
The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics may process information including:
visited pages
date, time and duration of visits
approximate geographic location
browser, device and operating system information
referring websites
interactions with website content
online and cookie identifiers
IP address and technical connection data
Google Analytics is connected through Squarespace and is only activated in accordance with the consent choices made through our cookie banner.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings.
Google may process information on servers outside the European Economic Area, including in the United States. Where applicable, transfers are protected by the EU–US Data Privacy Framework and Standard Contractual Clauses.
Analytics information is retained only for as long as necessary for the purposes described above and in accordance with the retention settings configured in our Google Analytics account.
You can find further information here:
https://policies.google.com/privacy
https://policies.google.com/technologies/partner-sites
Google also provides a browser add-on for disabling Google Analytics:
https://tools.google.com/dlpage/gaoptout
8. INSTAGRAM CONTENT
We use the integrated Squarespace Instagram block to display content from our professional Instagram account.
Instagram is operated in the European Economic Area by:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
When Instagram content is displayed or when you interact with it, technical data such as your IP address, browser and device information may be transmitted to Meta. If you are logged into Instagram, Meta may be able to associate your visit or interaction with your Instagram account.
Meta may process data outside the European Economic Area, including in the United States. Where applicable, transfers are protected by the EU–US Data Privacy Framework or other appropriate safeguards.
Where consent is legally required, the processing is based on Article 6(1)(a) GDPR. You may withdraw your consent through the cookie settings. Where the content can be provided without accessing information on your device or requiring consent, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest is presenting our current photographic work and social media content.
Further information is available in Meta’s Privacy Policy:
https://privacycenter.instagram.com/policy/
9. GOOGLE FONTS
This website uses fonts provided through the Squarespace integration with Google Fonts in order to display the website consistently and in line with our visual design.
The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When font files are retrieved, Google may receive technical information such as your IP address, browser, network and device information.
The processing is carried out for the consistent and technically reliable presentation of our website. Where the fonts are loaded from Google servers and consent is required, the legal basis is Article 6(1)(a) GDPR. Otherwise, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in the consistent and accessible presentation of our website.
Google may process data in countries outside the European Economic Area. Appropriate safeguards may include the EU–US Data Privacy Framework and Standard Contractual Clauses.
Further information is available at:
https://policies.google.com/privacy
10. CONTACT BY EMAIL
You can contact us directly by email. If you do so, we process the information you provide, which may include:
your name
email address
wedding date and location
information about your celebration
the content of your message
any files or photographs you send us
We process this information to respond to your enquiry, communicate with you and, where applicable, prepare an individual proposal.
Where your enquiry concerns a possible or existing booking, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to messages addressed to our business.
If your enquiry does not result in a booking, we generally delete the correspondence six months after the communication has concluded, unless legal obligations or legitimate interests require longer storage.
If a booking is made, relevant information may be retained for the duration of the contractual relationship and subsequently in accordance with applicable statutory retention obligations.
11. CONTACT THROUGH WHATSAPP BUSINESS
Our website contains a direct link to our WhatsApp Business account. No data is transmitted to WhatsApp merely because you visit our website. A connection to WhatsApp is established only when you actively click the WhatsApp link.
The provider for users in the European Region is:
WhatsApp Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
If you contact us through WhatsApp, we process your telephone number, profile information, message content and any files or other information you send us.
This processing is based on Article 6(1)(b) GDPR where the communication relates to a potential or existing booking. For other communication, it is based on Article 6(1)(f) GDPR. Our legitimate interest is offering a convenient communication channel.
Using WhatsApp is voluntary. You can contact us by email instead at any time.
WhatsApp may process data outside the European Economic Area, including in the United States. According to WhatsApp, such transfers are based, where applicable, on adequacy decisions, the EU–US Data Privacy Framework and Standard Contractual Clauses.
If your enquiry does not result in a booking, we generally delete the conversation six months after communication has concluded, unless a longer retention period is legally required.
Further information is available in WhatsApp’s Privacy Policy:
https://www.whatsapp.com/legal/privacy-policy-eea
12. INTERNAL ACCESS TO PERSONAL DATA
Personal data received through enquiries may be accessed by authorised members of The Edit Stories who require the information to respond to the enquiry, prepare a proposal or perform an agreed photography service.
All individuals with access to personal data are required to treat it confidentially. Personal data is not shared with other parties unless this is necessary to provide our services, comply with a legal obligation or protect legitimate legal interests.
13. RECIPIENTS AND SERVICE PROVIDERS
We may share personal data with service providers acting on our behalf, including providers of website hosting, email hosting, analytics and technical infrastructure.
These providers may process personal data only in accordance with the applicable contractual and legal requirements.
We may also disclose information where required by law, a court order or a lawful request from a public authority.
14. INTERNATIONAL DATA TRANSFERS
Some of the providers mentioned in this Privacy Policy may process personal data outside the European Union or the European Economic Area.
Where personal data is transferred to a country for which the European Commission has issued an adequacy decision, the transfer is based on that decision. This may include transfers to US organisations certified under the EU–US Data Privacy Framework.
Where no adequacy decision applies, transfers may be protected by European Commission Standard Contractual Clauses and additional safeguards where required.
15. DATA RETENTION
We retain personal data only for as long as necessary for the purpose for which it was collected.
The applicable retention period depends on the nature of the data, the purpose of processing, contractual requirements and statutory obligations. Once the relevant purpose no longer applies and no legal retention obligation remains, the data will be deleted or anonymised.
16. YOUR RIGHTS
Under the GDPR, you have the following rights, subject to the applicable legal requirements:
the right to obtain information about your personal data
the right to have inaccurate data corrected
the right to request deletion of your data
the right to restrict processing
the right to data portability
the right to object to processing based on legitimate interests
the right to withdraw consent at any time
the right to lodge a complaint with a supervisory authority
If processing is based on your consent, withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, please contact:
hello@theeditstories.com
17. RIGHT TO OBJECT
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.
We will then stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or unless the processing is required for the establishment, exercise or defence of legal claims.
18. RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany
Postal address:
Postfach 3163
65021 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de
19. AUTOMATED DECISION-MAKING
We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.
20. SECURITY
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
However, internet-based communication cannot be guaranteed to be completely secure. We therefore recommend that you do not send highly sensitive information through unencrypted email or WhatsApp.
21. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy when our website, services, providers or legal requirements change.
The current version is always available on this website.