Jump to content
dpa Picture-Alliance

Data Privacy Policy

Information on data protection

When visiting our website www.picture-alliance.com we process your personal data (hereinafter also referred to as “data”). Therefore, we would like to provide you with an overview of the processing by means of the following information to ensure that you fully comprehend how and to what extent your personal data is processed by us. In addition, this privacy policy informs you about your rights under the EU General Data Protection Regulation (GDPR).

For our business contacts, our privacy policy for business contacts applies in addition. You can find this privacy policy at https://www.dpa.com/en/privacy-policy-of-the-dpa-group-for-business-contacts

1. Controller / Contact

dpa Picture-Alliance GmbH
Gutleutstrasse 110
60327 Frankfurt am Main

Phone: +49 69 2716-0
Telefax.: +49 69 2716-34269
Email: mail@picture-alliance.com

(hereinafter also referred to “we”, “us“ or “dpa”)

If you have any questions or suggestions regarding any data protection matter, including this privacy policy; or if you would like to contact us to exercise your data subject rights, please contact us using the contact details above. In the case of using the image database of dpa Picture-Alliance GmbH through the integration of VIDIS for use in schools, the following applies as an exception to the above-mentioned regulations: the processing of personal data is carried out by us as a data processor, while the responsible entity is your school or the school authority.

2. Data Protection Officer

You may contact our data protection officer at:

dpa Picture-Alliance GmbH
Data Protection Officer
c/o dpa Deutsche Presse-Agentur GmbH
Mittelweg 38
20148 Hamburg
Germany

Email: datenschutz@dpa.com

3. Automated Data Processing

Whenever you access our website, your device automatically transmits data for technical reasons. These data are stored separately from other data, which you may transmit to us under certain circumstances:

  • browser type/ -version,
  • operation system used,
  • the website you access,
  • URL of the website visited prior to access (referrer-URL),
  • IP-address,
  • date and time of access; and
  • HTTP-status code.

The processing of these data is necessary to provide the website and the associated services. This is also our legitimate interest, Art 6 (1)(f) GDPR.

In addition, your data are processed for the following purposes:

  • ensuring the security of our IT systems, e.g., to counter specific attacks on our systems and detect attack patterns; and
  • ensuring proper operation of our website and our IT systems, including error analysis and safeguarding the functionality of our website.

The processing is based on our aforementioned legitimate interests, Art 6 (1)(f) GDPR. Any storage of your above mentioned data will not take place in this context.

4. Hosting of our Website

We host our website on servers provided by our web host, Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland.

This web host processes personal data on our behalf, meaning exclusively in accordance with our instructions (see Art. 4(8) and 28 of the GDPR).

Your data is also transferred to Google, LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google LLC”). This involves the transfer of personal data to the United States, specifically to Google LLC, and to third countries for which no adequacy decision has been issued by the European Commission.

Google LLC is certified under the EU-U.S. Data Privacy Framework. The EU-U.S. Data Privacy Framework is an adequacy decision by the European Commission, under which an adequate level of data protection is ensured in the United States for personal data processed by companies that hold EU-U.S. Data Privacy Framework certification, even without supplementary security measures. Furthermore, Google will use the Standard Data Protection Clauses approved by the European Commission pursuant to Article 46(2)(c) of the GDPR to ensure an adequate level of data protection.

5. Creating your Account / Login

To be able to order images on our website, your prior registration and login is required. Where certain image material is only visible for users who have logged into our website, your registration is necessary to grant you access to such images.

5.1 Creating your new account

For your registration it is mandatory that you as our customer provide the following information:

  • your company name
  • your company address
  • your salutation,
  • your name,
  • your e-mail address,
  • your self-chosen password,
  • your telephone number,
  • your preferred language, and
  • your country.

In addition, you have the option to provide information on

  • the department in which you work,
  • a different email address for sending invoices, if applicable,
  • the URL of the company’s website,
  • the VAT identification number, and
  • commercial register number of your company

After your registration, you will receive an e-mail from us with your  names at the e-mail address submitted, with which we first ask you to actively confirm your registration by means of the so-called double-opt-in procedure. We use the information about your confirmation and the time of this confirmation to document and verify your registration.

5.2 Registration / Login with the dpa ID

Alternatively, you can also register or log in with your dpa ID. Kindly note that the following privacy policy applies to the processing of your data in relation to your registration and use of the dpa-ID: https://account.dpa-id.de/privacy-service.

When you register or log in to our website with your dpa ID, we automatically query the dpa ID database

  • to verify whether you are a registered and authenticated user, and
  • collect the registration data stored for your dpa ID, which is required for the login or registration. This includes your name, your e-mail address, your company including contact details and a telephone number.  
  • in addition you are required to submit the country in which you are resident or in which your company is based.
     

5.3 Purposes and legal basis

The processing of mandatory information is necessary in order to set up and manage your user account for you, and, to provide you with the order and download functionalities of our image database so that you or your company have the possibility to purchase rights of use relating to the content provided therein in accordance with our General Terms and Conditions (GTC). Insofar as certain image material can only be researched and accessed after prior log-in, the processing of this information is also necessary to provide you access to such image material.

We process additional information to assign your user account to an existing company account and to set up rights allocation according to the associated company account.

In the event of a completed order, we also process the aforementioned data for invoicing purposes, to clarify any queries related to your order, and to provide you with information and messages relating to your use of the image database.

The legal basis for processing is Art. 6 (1) (f) of the GDPR when you, as an employee of a company, create a user account with us. The processing is necessary for the initiation and performance of the contractual relationship with the respective company. This is also our legitimate interest.

If you yourself are our contracting party, the legal basis for processing this data is Art. 6 (1) (b) of the GDPR. In this case, the processing is necessary for the initiation and performance of the contractual relationship with you.

We also process your data related to the login for the purpose of authenticating your login. We have a legitimate interest in granting access to the registration-required area of our website only to authorized individuals, Art. 6 (1) (f) of the GDPR.
 

6. Evaluation of Registration Data

We also process the user data that we collected during registration to analyze the usage of our image database. In particular, we analyse which companies and industries make use of our image database in order to tailor it to the target audience. Such processing of your data is generally based on our legitimate interest in improving our products and measuring the success of our business operations, Art. 6 (1) (f) of the GDPR
 

7. Downloads and Lightboxes

Within your user account, you have the option to download content selected by you and to manage your image selections or compilations in our lightbox functionality. For this purpose, we store the corresponding settings and your image selections.

The legal basis for this processing is Art. 6 (1) (f) of the GDPR if you have a user account with us as an employee of a company. The processing is necessary for the performance of the contractual relationship with the respective company. This is also our legitimate interest.

If you yourself are our contracting party, the legal basis for the processing of this data is Art. 6 (1) (b) of the GDPR. In this case, the processing is necessary for the performance of the contractual relationship with you.
 

8. Storage of Your Log Data in Connection with the Download of Image Files

When you download image files in your user account, we store your log data and associate them with your user account. The processing is necessary for the detection of unlawful and abusive downloads as well as for legal prosecution. Therein also lies our legitimate interest, Art. 6 (1) (f) of the GDPR.
 

9. Marking Contact /Inquiries and Orders

9.1 Contacting us via our contact details

If you contact us regarding any inquiries or placement of orders, using the contact details provided in Section 1 above (particularly by email, phone, telefax or postal mail) or by using the contact details provided on our website, we process

  • your name
  • time and date of your inquiry resp. order and any further information that you provide us in such communication or order,

and, depending on the method of communication you choose and / or the contact information you provide:

  • your email address, and/or
  • your phone number and / or your fax number; and / or
  • your address.

9.2 Contacting us via our contact forms

If you submit a request for an offer for image material via our contact form, we process the specific details regarding the image material you requested as well as relating to the intended use, the date and time of your request, your email address as well as your prename and surname and the name of the company that you belong to.

You have the option of requesting an offer for a specific image. When using the respective form, your request will be sent to Picture Alliance’s sales team that will get back to you using the contact details (e-mail) submitted in your request for offer. You may select between the options “Only request for offer” or “Send now and register subsequently”. If you select the option with subsequent registration, you will be forwarded to our registration screen for access to our image portal in the next step (see section 5 above). This means that we will receive your request for quotation even if you do not yet decide to complete the registration process. If you select the option with subsequent registration, you will be forwarded to our registration form for access to our image portal in the next step (see section 5 above). This means that we will receive your request for quotation even if you do not yet decide to complete the registration process.

9.3 Via the ordering function of our image database

If you place an order through the ordering function of our image database we also process, in addition to the data mentioned in Section 9.2 above, information about the selected delivery method. Furthermore, the order requires prior registration as set out in Section 5.
 

9.4 Contacting Us via LinkedIn

On our Contact page, you also have the option to send us a direct message via LinkedIn by clicking on the LinkedIn icon embedded there. If you contact us via the LinkedIn icon, you will be redirected to the LinkedIn service operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn Ireland”).

Depending on whether the LinkedIn app is installed on your device or you are using it in your browser, a pre-populated LinkedIn direct message will open with the contact person you selected.

If you send us an inquiry in this manner, we will process the content and data you provide (in particular, your displayed LinkedIn profile information, your display name, the time and date of your contact, as well as any additional information and, if applicable, contact details you provide in your direct message) for the purposes specified in Section 9.7.

In this context, LinkedIn Ireland processes your data (such as account data, connection data, and usage data) under its own responsibility as part of the provision and use of LinkedIn and for the delivery and hosting of your direct message to the contact you have selected. 

For more information, please see LinkedIn’s Privacy Policy at https://de.linkedin.com/legal/privacy-policy. There you will also find information about the settings options for your LinkedIn profile.

LinkedIn Ireland uses cookies and similar technologies. LinkedIn Ireland provides information on this at https://de.linkedin.com/legal/cookie-policy and in its Privacy Policy at https://de.linkedin.com/legal/privacy-policy. 

9.5 About the chatbot on our website

If you provide us with your contact information (specifically your email address) via the chatbot (see Section 15) on our website to contact us directly, we will process the contact information you enter, the time and date of your inquiry, and any additional details you provide in your inquiry for the purposes specified in Section 9.7.

9.6 Purposes and Legal Bases for Processing

We process the aforementioned personal data to receive and process your inquiry. For inquiries related to contracts, we process your personal data to enable the initiation and performance of the respective contractual relationship. The legal basis for the processing is Article 6(1)(f) of the GDPR if you contact us as an employee of a company. The processing is necessary for the performance of the contractual relationship with the respective company. This also constitutes our legitimate interest. If you are our contractual partner, the legal basis for processing this data is Article 6(1)(b) of the GDPR. In this case, the processing is necessary for the performance of the contractual relationship with you.

10. Web Sessions

We offer web sessions to provide you with an insight into our portal, with an overview of its most important functions as well as tips for searching in our image database and other aspects that are relevant to the use of images.

10.1 Registration for a Web Session

To participate in the web session, you must register via Eventbrite, a platform of the provider Eventbrite, Inc., 155 5th Street, Floor 7, San Francisco, CA 94103, USA ("Eventbrite"). Eventbrite processes your data as part of the registration process for the web session on our behalf and in accordance with our instructions, Art. 4 no. 8, 28 DSGVO.

For registration, you will be redirected to our organizer website at Eventbrite. There, it is necessary to provide your name, email address, and to specify which web session you wish to attend. After registering for the web session, Eventbrite will send you a confirmation of registration on our behalf. Subsequently, we will send the dial-in details for the web session to the email address that you provided.

Eventbrite also carries out processing on its own responsibility, for example when you register with Eventbrite. Eventbrite also evaluates your usage data under its own responsibility. Further information can be found in Eventbrite's privacy policy at https://www.eventbrite.de/help/de/articles/460838/datenschutzrichtlinien-von-eventbrite.

When registering through Eventbrite, your data will be processed in the USA. For data transfers to the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA. Eventbrite is certified under the EU-U.S. Data Privacy Framework
 

10.2 Conducting Web Sessions

We use Microsoft Teams, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”), to conduct the web sessions. Microsoft processes your personal data on our behalf and in accordance with our instructions (see Art. 4(8) and 28 of the GDPR).

Microsoft primarily operates its services for us within the so-called “EU Data Boundary”; in certain circumstances, such as during maintenance and support operations or to defend against security threats, processing may take place outside the EEA. In such cases, your data may be transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft Corporation”), as well as to other Microsoft group companies.

For data transfers to the U.S., the European Commission has issued an adequacy decision pursuant to Article 45(1) of the GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the U.S. Microsoft Corporation is a company certified under the Data Privacy Framework.

When you participate via Microsoft Teams, we process your first and last name, email address, password, IP address, additional information about your device, meeting ID, and, if applicable, other login credentials, the start and end times of your participation, and the topic of the online meeting—in this case, the web session.

In addition, you have the option to provide your phone number, details about your role or your company or organization, and your profile picture.

If you dial in via phone, we process your phone number, the country code, and, if applicable, additional connection data such as the IP address of your device.

Our web sessions take place in a webinar format. As a participant, you do not transmit either video or audio. If you use the question-and-answer feature (“Q&A feature”) during the web session, your display name (first name and, if applicable, last name) and your text entries will be processed in order to display and answer your question during the web session. We also analyze your questions to tailor our web session offerings to participants’ needs.

In addition to the processing carried out on our behalf, Microsoft processes certain data on its own behalf. This includes, in particular, diagnostic and telemetry data, as well as pseudonymized system- and usage-related log data, for the purposes of providing, operating, further developing, and ensuring the security of the service. If you participate in the web session using your own Microsoft account, Microsoft also processes the associated account and profile data on its own behalf. For more information, please see Microsoft’s Privacy Statement at https://privacy.microsoft.com/de-de/privacystatement.

We delete your data in accordance with Section 25 below.

10.3 Recording of Web Sessions

We record our web sessions and make the recording available to you afterward so that you can review the presentation and its content.

The recordings include the presenters as well as the presentation slides and content shared by the presenters. Questions asked via the Q&A feature are not included in the recording. However, if a presenter addresses your question during the web session, its content may become part of the recording.

10.4 Purposes and Legal Bases

The legal basis for processing data to conduct the web sessions—including answering questions submitted via the Q&A feature and providing you with the recording or any presentation materials—is Article 6(1)(b) of the GDPR. The processing is necessary to fulfill our event contract with you. To the extent that we analyze Q&A questions to optimize our web session offerings, this is based on our legitimate interest in being able to offer web sessions tailored to your needs, pursuant to Article 6(1)(f) of the GDPR.

10.5 Purposes and Legal Bases

The legal basis for the processing is Article 6(1)(b) of the GDPR. The processing is necessary for the performance of our event contract with you.

11. Newsletter and Newsletter Tracking

For the distribution of our newsletters, including newsletter tracking, we use the services of the newsletter mailing service provider Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Sendinblue GmbH processes your personal data on our behalf, and solely in accordance with our instructions (within the meaning of Art. 4 No 8, 28 GDPR).

11.1 Newsletter

If you have given your consent, we will inform you by email at regular intervals about image selections as well as current offers, products, dates relating to the themes selected by you. For this purpose, we process,

  • your salutation,
  • your name and
  • your email address,
  • the information on the themes submitted by you for which you would like to receive image selections or other information.

We verify your consent by means of the so-called double opt-in process. After submitting the form while accepting the pre-formulated newsletter consent we will send an email to the email address you have provided to ask you to actively confirm your consent. Only after you have klicked on the confirmation link we will send our newsletter to you. When registering for the newsletter we also store your IP address as well as the date and time of your registration for the purpose of demonstrating that you have provided your consent.

11.2 Newsletter Tracking

To measure the performance of our newsletters, these contain tracking pixels (also called web beacons) that connect with the servers of SendinBlue whenever a newsletter is opened by its recipient. This enables us to determine whether any newsletter has been opened. In addition, we collect technical information (e.g., time of retrieval, IP address, browser type, and operating system). This information cannot identified with the respective newsletter recipient. It is used solely for the statistical analysis of newsletter campaigns. We use the results of these analyses to better tailor future newsletters to the interests of the recipients.

11.3 Legal basis and storage period

The legal basis for the processing of your personal data as well as for the receipt of our newsletter, including newsletter tracking, is your consent, Art 6 (1) (a) GDPR. The use of the tracking pixels, including the resulting storage of information on your device as well as access to this information is likewise based on your consent, § 25 (1) of the German Act on the Regulation of Data Protection and the Protection of Privacy in Telecommunications and Telemedia (Gesetz zur Regelung des Datenschutzes und des Schutzes der Privatsphäre in der Telekommunikation und bei Telemedien - "TTDSG"), Art 6 (1) (a) GDPR.

You can withdraw your consent at any time with effect for the future by using the opt-out or unsubscribe option provided in each respective newsletter, or by contacting us at the contact details provided in Sec 1.

The legal basis for the processing of your personal data for the purposes of the double opt-in as well as demonstration of your given consent is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR. It is our legal obligation to demonstrate that you have provided your consent.

In this context, your data will be processed until the purpose of the processing no longer applies or you withdraw your consent. We store data to demonstrate your consent for as long as this is necessary for this purpose, in any case for a period of three years.

12. Surveys

In addition, we use your name and email address to send you invitations to surveys by e-mail at regular intervals. The purpose of these surveys is to determine your satisfaction with our services and offers and to obtain your feedback. Participation in these surveys is voluntary.

If you do not want to participate in such surveys, you have the right to object to this at any time without incurring any costs other than the transmission costs according to the basic rates. You can exercise your right to object by using the opt-out or unsubscribe option in the respective email or by contacting us using the contact details provided in Section 1.

The processing of your data collected in the scope of the surveys is based on our legitimate interest in ensuring a high level of quality management and customer satisfaction, Art. 6 (1) f) GDPR, § 7 (3) of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb –“UWG”).

Your data will be processed until the purpose of the processing no longer applies or you object to the receipt of invitations to surveys.

13. Surveys on our Website

From time to time we ask you on our website for your feedback to our offers and services. Participation in these surveys is voluntary. We process your data from the survey in pseudonymized form for the purpose of evaluating our users’ the satisfaction with our offers and services and to tailor and optimize our services and offers accordingly.

The processing takes place on the basis of our legitimate interest in the needs-based and interest-oriented design of our offers and services, Art. 6 (1) f) GDPR.

To conduct the surveys, we use the open source software LimeSurvey, which is hosted on the servers of our service provider, dpa-IT Services GmbH, Mittelweg 38, 20148 Hamburg ("dpa-IT").

dpa-IT processes the personal data on our behalf, i.e. solely in accordance with our instructions (see Art. 4 No. 8, 28 GDPR).

14. CRM System

For the management of our customer relationships, in particular for the management and configuration of user accounts and the creation of offers and invoices, we store the personal data that you have provided to us in the course of your registration, ordering and/or in connection with your inquiries, in our CRM system.

The processing is based on Art. 6 (1) b) GDPR as well as on our legitimate interests in managing our customer relationships, Art 6 (1) f) GDPR.

For the operation of the CRM System we use the services of our service provider Sodatech AG, Himmelrych 4a, 5612 Villmergen, Switzerland. Sodatech AG processes personal data on our behalf, i.e. solely in accordance with our instructions (see Art. 4 No. 8, 28 GDPR).

For Switzerland, there is an adequacy decision by the EU Commission in accordance with Art. 45 GDPR. Accordingly, Switzerland offers an adequate level of data protection. 

15. Melibo Chatbot

We have integrated the Melibo chatbot service of the provider ThinkingTech GmbH & Co. KG, Darmstädter Str. 5, 64625 Bensheim, Germany ("Melibo") on our website. Melibo processes your personal data on our behalf and in accordance with our instructions (see Art. 4 No. 8, 28 GDPR).

The Melibo chatbot is a program that answers your queries entered during use in form of a dialogue; this is done fully automatically on the chatbot side. The chatbot is limited to providing information about our services as well as services in connection with our website respectively image database and other offers.
When you send us an inquiry via the Melibo chatbot, we process

  • the information you provide,
  • the time and date of your request and
  • your IP address

You also have the option of entering your e-mail address if you would like us to contact you directly.

We process your data on the basis of our legitimate interests in providing the chatbot service, in efficient and user-friendly communication and in responding to your inquiries. If you provide your e-mail address, we will process this information to contact you for the purpose of clarifying your request. Therein also lies our legitimate interest, Art. 6 (1) f) GDPR.

After your communication with the chatbot has ended, the dialogues are saved in protocol files. Your IP address is removed before storage. These log files are used by us for troubleshooting and to improve the chatbot. This is also our legitimate interest, Art. 6 para. 1 f) GDPR.

The protocol files will be deleted after 30 days.

16. Google reCAPTCHA

We use reCAPTCHA v2, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes your personal data on our behalf and in accordance with our instructions (see Art. 4(8) and 28 of the GDPR).

reCAPTCHA v2 helps us distinguish between humans and computers to prevent machines, computer programs, or malware (hereinafter “bots”) from automatically filling out input or registration forms on our website. We therefore use reCAPTCHA v2 to protect against fraudulent activities, spam, and abuse as part of our website’s technical security measures.

To this end, so-called CAPTCHAs—small tasks that are easy for human users to solve but not for bots—are displayed. Specifically, users are prompted to click a checkbox and, if necessary, complete additional tasks.

When you visit a page or an input form on our website where we have integrated a CAPTCHA, we collect device-related and personal data from you. To do this, reCAPTCHA v2 tracks your interactions with our website, including mouse movements, keystrokes, and the duration of your visit. In addition, your IP address, the referrer URL (the address of the website you previously visited), information about your operating system and your device settings—in particular your language settings and location data—as well as the timestamp of the request and the hostname of the website where the reCAPTCHA was solved, are processed.

Based on this data, reCAPTCHA v2 performs a risk analysis and uses a probability value to determine whether access to our website is being made by a human user or a bot. We use this analysis to evaluate the corresponding interaction on our website.

To provide the risk analysis, we place a cookie in your browser. For more information on cookies, see Section 19.

Your data is also transferred to Google, LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google LLC”). This involves the transfer of personal data to the United States, specifically to Google LLC, and to third countries for which there is no adequacy decision by the European Commission. For data transfers to the United States, there is an adequacy decision by the European Commission pursuant to Article 45(1) of the GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the United States. Furthermore, Google will use the Standard Data Protection Clauses approved by the European Commission pursuant to Article 46(2)(c) of the GDPR to ensure an adequate level of data protection.

The use of Google reCAPTCHA and the resulting storage of information on your device or access to such information, if applicable, are absolutely necessary to ensure the security of our website and the associated services. Pursuant to Section 25(2)(1) of the TDDDG, consent is therefore not required. The associated processing of personal data is based on our legitimate interest in protecting ourselves and our users from abusive behavior on our website and in connection with our services, Article 6(1)(f) of the GDPR.

17. Embedded Content and Third Party’s Service

17.1 YouTube

On our website, we have embedded YouTube Videos. YouTube is a service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

These YouTube videos are loaded from YouTube's servers so that your device transmits certain technically necessary data to Google. In particular, it cannot be excluded that YouTube may take notice of your IP address. Where personal data is processed in this context, you can find further information on this in Google's privacy policy at https://policies.google.com/privacy 

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). You can find Google’s privacy policy at https://policies.google.com/privacy

Please note, that Google may share personal data within their corporate group (particularly with Google LLC in the USA) as well as with other third parties. That sharing can entail that personal data are transferred to the U.S. and third countries for which no adequacy decision of the EU Commission exists. For data transfers to the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA. Google LLC is certifies under the EU-U.S. Data Privacy Framework. For the rest, Google will rely on the standard clauses clauses adopted by the EU Commission in accordance with Art 46 (2)(c) GDPR.

You can also find information on the settings options for your Google account in Google's privacy policy. Please be aware, that your Google account may be in use for various different Google services (e.g., Gmail, YouTube, Google Search), and YouTube or Google, respectively, may combine your personal data relating to each Google service you use depending on the settings of your Google account.

The embetting by us is based on our legitimate interests in being able to provide you with the corresponding content and functionalities, Art. 6 (1) f) GDPR. 

17.2 Applications

You can find our current job postings under the “Jobs” section. If you would like to apply for a position with us, you will be redirected to the online application portal of dpa Deutsche Presse-Agentur GmbH, Mittelweg 38, 20148 Hamburg. Alternatively, you can also apply using the contact information for dpa Deutsche Presse-Agentur GmbH provided in the “Jobs” section. Applications within the dpa Group are processed centrally by dpa Deutsche Presse-Agentur GmbH.

For information on data protection in connection with your application, please visit: www.dpa.com/de/datenschutzhinweise.

18. Cookies and similar technologies

We use so-called “cookies” and similar technologies, which allow us to offer you certain features of our website and the image database and to optimise the use of these services website and to analyse and better understand users of our website and their interests. Cookies are small files that are stored on your end device, with the aid of your browser. Similar technologies we use are local storage. With these, data is stored locally in the cache of your browser, which remains there and can be read by us even after closing the browser window or exiting the program - unless you delete the cache (hereinafter collectively referred to as "cookies and similar technologies").

For the consent management on our website we use the OneTrust Consent Manager of our processor (within the meaning of Art. 4 No 8, 28 GDPR) OneTrust Technology Limited, 82 St John St, Farringdon, London EC1M 4JN, UK (“OneTrust”).
For the UK, there exists an adequacy decision of the EU Commission in accordance with Art 45 (1) GDPR, according to which the UK provides an adequate level of data protection.

As our processor (see Art. 4 No. 8, 28 GDPR), OneTrust processes the cookie preferences or preferences for similar technologies set by you and for the associated data processing, including the consent you have given, refused or withdrawn, for the purpose of legally compliant consent management. To store your preferences, including the status of your consent, we use OneTrust to store the cookies that are absolutely necessary for this on your end device.

We use the following categories of cookies and similar technologies:
 

18.1 Strictly necessary cookies

This category includes the cookies and similar technologies that are strictly necessary for the operation and functions of our website and image database. These cookies are used to make the website and image database technically accessible and available and to provide essential and basic functionalities.

These cookies are used to store the language settings, your login data and user settings and ensure that your cookie settings are saved. Without these cookies, our website cannot function properly and the image database cannot be used properly by you
We use the following strictly necessary cookies on our website:

Name: Local Storage

  • Function / purpose: Storage of your language and user settings, authentication of logged-in users
  • Provider / Service: dpa
  • Storage period: unlimited

Name: OptanonAlertBoxClosed

  • Function / purpose: Ensures that the consent dialog (cookie banner) is only displayed until you have made your cookie selection. As soon as you have either consented to the use of cookies or rejected them, the banner will not be displayed again.
  • Provider / service: OneTrust
  • Storage period: 1 year

 
Name: OptanonConsent

  • Function / purpose: Storage of your cookie settings, in particular information on whether or not consent has been given.
  • Provider / Service: OneTrust
  • Storage period: 1 year

 
Strictly necessary cookies are used without your consent pursuant to Sec 25 (2) No 2 TTDSG. Any processing of personal data in connection with these cookies is carried out for the aforementioned purposes and to ensure that our website and the related functions are accessible and available. Insofar as the processing takes place to make our website and our image database technically accessible and usable, the legal basis for the processing is Art. 6 para. 1 b) GDPR. The legal basis for processing operations that are necessary to correctly store your cookie preferences, in particular your consent or lack of consent to the use of cookies, is Art. 6 (1) c), § 25 TTDSG. In addition, in the aforementioned purposes also lies our legitimate interest, Art. 6 para. 1 f) GDPR.

18.2 Analysis cookies

These cookies are used to analyze your usage of the website. This enables us to better understand and improve the use of our website and services. Your usage behaviour can also be tracked across different websites, browsers or end devices using a user ID (unique identifier).

Specifically, we use the following analysis cookies:

Name: Google Tags

  • Function / purpose: Google tags for the integration of the Google Analytics service. The tags enable us to place the following cookies from the Google Analytics service and to collect personal data.
  • Provider / Service: Google Ireland Limited ( Google Tag Manager)
  • Storage period:

Name: _gid

  • Function / purpose: Stores and counts the number of page views
  • Provider / Service: Google Ireland Limited (Google Analytics)
  • Storage period: 1 day

Name: _ga

  • Function / purpose: Used to track the use of our website for the analytics report. For this purpose, this cookie assigns you as a user a randomly generated number
  • Provider / Service: Google Ireland Limited (Google Analytics)
  • Storage period: 2 years

Name: _gat

  • Function / purpose: Used to throttle the request rate.
  • Provider / Service: Google Ireland Limited (Google Analytics
  • Storage period: 1 minute

In accordance with Sec 25 (1) TTDSG, we use cookies that are not strictly necessary solely on the basis of your consent (Art 6 (1)(a) GDPR). If personal data are processed in connection with these cookies, such processing is also based on your consent.

You can withdraw your consent at any time with effect for the future by accessing and changing your cookie settings. You can open your cookie settings via the green and white cookie floating icon. The floating icon is located at the bottom left-hand side of the website.

In the following, we would like to describe the service we use as part of the analysis cookies in more detail:
 

19. Google Analytics and Google Tag Manager

19.1 Google Tag Manager

We use the Google Tag Manager. This service is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") on our behalf and in accordance with our instructions (see Art. 4 No. 8, 28 GDPR).

Google Tag Manager is a service that we use to integrate Google Analytics on our website. The Google Tag Manager is used to manage and play out the technologies integrated via it, such as tracking codes and associated code fragments (through so-called tags). This means that the Google Tag Manager itself does not create any user profiles, does not store any cookies and does not carry out any independent analyses.

However, the Google Tag Manager records your IP address, which may also be transferred to Google's parent company, Google LLC in the USA, and to third countries outside the European Economic Area for which there is no adequacy decision by the EU Commission. For data transfers to the USA, there is an adequacydecision of the EU Commission pursuant to Art. 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA. Google LLC is certifies under the EU-U.S. Data Privacy Framework. For the rest, Google will rely on the standard clauses clauses adopted by the EU Commission in accordance with Art 46 (2)(c) GDPR.

The legal basis for the use of Google Tag Manager is your consent, Art. 6 para. 1 a) GDPR, § 25 para. 1 TTDSG. In addition to the processing of your personal data, this also relates to the subsequent setting of cookies and the associated access to information in your end device or the storage of information on your end device.

You can revoke your consent at any time with effect for the future by accessing and changing your cookie settings via the floating icon at the bottom left of the website. By changing the settings, you can also withdraw your consent at any time. Withdrawal does not affect the lawfulness of the processing carried out prior to your withdrawal.

19.2 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics collects pseudonymous data about your use of our website, including your shortened IP address, and uses cookies.

This data may be transferred by Google to Google servers in the USA or other third countries and stored there. For the USA, there is currently no adequacy decision by the EU Commission that the USA has an adequate level of data protection. In this case, Google will use the standard data protection clauses approved by the EU Commission in accordance with Art. 46 para. 2 c) GDPR.

Google Analytics cookies enable website operators to measure how users interact with website content. When a user navigates between websites, Google Analytics provides website operators with JavaScript tags (libraries) to record information about the page a user has seen. This includes, for example, the address (URL) of the page.

Google will use this information to evaluate your use of the website for us, to compile reports on the use of our website and to generate further analyses and evaluations associated with the use of our website and the Internet. We use these analyses and evaluations to tailor and optimize our website and services to the interests of our users.

Google may also link this data with other data about you, such as your search history, your personal account, usage data from other devices and other data that Google has stored about you. Google may also transfer this information to third parties where required to do so by law (e.g. in response to a request for information from a public authority) or where such third parties process the information on Google's behalf.

Your data will be stored by Google Analytics for a period of 26 months. After this period, the data will be deleted and only aggregated statistics will be retained.

You can find more information about how Google uses your data in Google's privacy policy: www.google.com/policies/privacy.

You can deactivate Google Analytics using a browser add-on if you do not want the analyses on our website. You can download this here: http://tools.google.com/dlpage/gaoptout?hl=de. You can also object to the use of Google Analytics by clicking here.

Google Analytics is used in accordance with Section 25 (1) GDPR on the basis of your consent, Art. 6 (1) a) GDPR.

You can withdraw your consent to the use of Google Analytics at any time with effect for the future by adjusting your cookie settings. You can access and adjust your cookie settings via the green and white floating icon. You will find the floating icon at the bottom left of our website.

20. Our Social Media Presences

We maintain various social media accounts on the platforms of the respective operators. For some processing activities, we are therefore jointly responsible with the respective platform operators, in accordance with Article 26 of the GDPR. You can find out which processing activities are affected by this in the explanations provided in our privacy notices for our social media accounts, which are available at https://www.dpa.com/de/datenschutzhinweise-social-media. Please direct any inquiries or comments regarding the dpa Picture-Alliance’s social media accounts to the contact information listed in Section 1 above.

You can find our Facebook page at: https://www.facebook.com/picturealliance

You can find our Instagram page at: https://www.instagram.com/accounts/login/?next=/dpa_picturealliance/

You can find our YouTube page at: https://www.youtube.com/c/picturealliance

You can find our X (formerly Twitter) page at: https://twitter.com/picturealliance

You can find our LinkedIn page at: https://de.linkedin.com/company/picture-alliance

You can find our XING page at https://www.xing.com/pages/dpapicture-alliancegmbh

21. LinkedIn Insight Tag

We use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company on our website. Through this tool, LinkedIn processes certain technical data, such as a truncated or hashed IP address, browser and device information, timestamps, pages visited, and referrer URLs. The processing is carried out by LinkedIn itself. We receive only aggregated and anonymized reports on the use of our website and on the effectiveness of our marketing measures; we are unable to identify individual persons. Visitors who are not LinkedIn members are not associated with a profile. Processing is based on your consent pursuant to Article 6(1)(a) of the GDPR, which you may revoke at any time via our consent tool. LinkedIn provides further information in its Privacy Policy and Cookie Policy.
 

22. Further Processing of your Data

We will process the same data that we have collected for the purposes mentioned above also for the following purposes:

  • enabling criminal prosecution, averting of dangers and/or legal prosecution in any event of specific indications of a criminal offense;
  • providing evidence and for the establishment, exercise or defence of legal claims;
  • administrative purposes and internal business processes; and
  • compliance with our legal obligations.

The processing is based on our legitimate interests in maintaining our business activities, the performance of our tasks, the establishment, exercise or defence of legal claims, Art 6 (1)(f) GDPR or, as the case may be, based on our legal obligation, Art 6 (1)(c) GDPR.

23. Provision of your Personal Data

You are not required to provide your personal data to us, neither by contract nor by law. Notwithstanding, the provision of your personal data is to some extent necessary to access the sections of our website requiring registration and to use the associated services, features and functions. Particularly, the provision of your personal data is necessary, so that

  • you can make downloads and submit orders in our image database and acquire rights of use to the image materials, and
  • you can register for and participate in our web sessions.

Without the provision of this data, it is not possible to conclude a corresponding contract.
In addition, the provision of your data is necessary for that

  • we can manage and configure your account;
  • we can receive and process your requests; and
  • you receive our newsletters and surveys.

Where it is necessary to provide certain data to us, we will mark such data as mandatory items. Provision of any other data is voluntary. In the event that you do not provide mandatory data to us we will be unable to provide the relevant services and features to you.

In other cases, the consequence of you not providing your data may be that we will not be capable to provide the relevant features and services or the full usual scope of them.
 

24. Sharing of your Data

Except as set out in this privacy policy we will only share or otherwise disclose your personal data in the following events:

  • As necessary, to investigate any illegitimate use of our website, our services, or for enforcement of our rights, in particular of rights and claims in connection with any use of our image material, we will share personal data with external consultants (e.g., lawyers), law enforcement agencies and, where applicable, with any third parties; in each case provided that specific indications for illegal or abusive conduct exist. Moreover, we will share your data as necessary to enforce our terms and conditions of use or for the establishment, exercise or defence of legal claims. Furthermore, we are required by law to provide information to certain public authorities upon their request, including law enforcement agencies, other authorities that prosecute regulatory offences which are subject to fines and fiscal authorities.

    Your personal data may also be shared by us with others if third parties make claims against us which include the disclosure of your data, particularly, without limitation, claims by data subjects who are exercising their rights under Chapter III of the GDPR. 

    The legal basis for sharing your data is our legitimate interest in combating any misuse; in prosecuting criminal offences; and in securing, establishing and enforcing claims, Art. 6 (1)(f) GDPR, or, as the case may be, a legal obligation, according to Art. 6 (1)(c) GDPR.

  • For providing our services and related functionalities and services, we sub-contract (by agreement) certain services in whole or in part to third-party companies and third-party service providers, so called “processors” (within the meaning of Art 4 No 8, 28 GDPR). In such event, we share your personal data with these processors for further processing on our behalf and in accordance with our instructions.

    In addition to the processers that are specified in this privacy policy, we engage the following categories of processers:

    • IT service providers
    • Cloud service providers
    • Software service providers
       

  • Within our administrative processes, organization of our business operations, financial accounting activities, and in order to comply with legal obligations, such as archiving obligations, we may disclose or transfer your personal data to fiscal authorities, consultants (such as tax advisors or auditors) and to payment -, postal and shipping service providers and similar providers.

    Such transfer is based on our legitimate interest in the proper operation of our business, the performance of our obligations, establishing, exercising of or defending against claims, Art 6 (1)(f) GDPR, or ,as the case may be, a legal obligation according to Art 6 (1)(c) GDPR.

  • Future development of our business may result in a change of our the company structure by means of a change of its legal form; by establishing, sale of, or acquisition of any subsidiaries, business units or corporate components. In the event of such transactions, personal data will be passed on, together with the portion of the business that will be transferred and we shall ensure that such data will be shared in accordance with applicable data protection law.

    The legal basis for such sharing of personal data is our legitimate interest in changing the legal form and structure of our company in accordance with the economic and legal development, Article 6(1)(f) GDPR.

25. Third country transfers

We also process personal data in so-called third countries or transfer this data to recipients in third countries. Third countries are all countries outside the European Economic Area (EEA). Please note that there is currently no adequacy decision by the EU Commission that these third countries generally have an adequate level of data protection. In particular, there is currently no corresponding adequacy decision by the EU Commission for the USA.

When we transfer personal data to third countries, we ensure that one of the following prerequisites are met:

  • There is an adequacy decision by the EU Commission in accordance with Art. 45 GDPR.
  • We have concluded the standard contractual clauses adopted by the EU Commission in accordance with Art. 46 (2) c) GDPR and have taken additional measures in accordance with the criteria of the European Court of Justice (Schrems II judgment).
  • There are other appropriate safeguards within the meaning of Art. 46 (1) GDPR to establish an adequate level of data protection.
  • There is an exception in accordance with Art. 49 GDPR, e.g. if you have given your consent for the transfer (Art. 49 para. 1 sentence 1 a) GDPR), the transfer is necessary for the performance of a contract with you (Art. 49 para. 1 sentence 1 b) GDPR) or for the assertion, exercise or defense of legal claims (Art. 49 para. 1 sentence 1 e) GDPR).

For information on the appropriate safeguards we have put in place to protect your personal data, including a copy of any standard data protection clauses concluded, please contact us using the contact details set out in Sec. 1 above.

26. Deletion of your data

Unless set out otherwise in this privacy policy, we erase or anonymize your personal data when they are no longer required for the purposes for which we have collected and / or further processed them in accordance with this privacy policy. As a general rule, we will store your data for the duration of your usage of our website and / or the duration of the contractual relationship. Where we process your data based on your consent, such data will be deleted upon your withdrawal of consent; or at an earlier if such data are no longer required for the purpose for which we collected them.

We store your personal data for a longer period of time only to the extent:

  • that we are bound by law to retain your data, we will store your data throughout the time period prescribed by law (Art 6 (1)(c) GDPR). In particular, such legal obligations to store your data may result from retention periods under the “Handelsgesetzbuch” (Commercial Code) or the “Abgabenordnung” (German Fiscal Code). The retention period under these laws is regularly between 6 and 10 years, starting from the end of the year in which the relevant process or operation was completed, e.g., when we have fully processed your request.
  • the data is still needed for criminal prosecution or for the establishment, exercise of or defence against legal claims, which also explains our legitimate interest, Art 6 (1)(f) GDPR. In these cases, the data are stored until the corresponding process has been completed plus the statutory retention period.

If data must be retained for the purposes detailed above, processing will be restricted. The data will then no longer be available for any other use.

27. Your Rights

You have the rights set out below concerning the processing of your personal data. In addition to any options already described in this privacy policy, you may exercise your rights by sending a request by letter or e-mail using the contact details provided in Sec 1 above.

27.1 Right of access

Within the scope of Art 15 GDPR and § 34 Federal Data Protection Act (“BDSG”), you have the right to obtain from us, information on and access to the personal data that is being processed by us.

27.2 Right to rectification

You have the right to obtain from us the rectification of any inaccurate personal data concerning you without undue delay.

27.3 Right to erasure

Under the prerequisites set out in Art 17 GDPR and § 35 BDSG, you have the right to obtain from us the erasure of personal data concerning you.

27.4 Right to data portability

You have the right to receive from us the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format pursuant to Art 20 GDPR.

27.5 Right to Object

Pursuant to Art 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to any processing of personal data concerning you, that, inter alia, is based on Art 6 (1)(f) GDPR. We shall then no longer process your personal data, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data are being processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. Upon your objection, we will no longer process your data for these purposes. 

27.6 Withdrawal of consent

In accordance with Art 7 (3)(1) GDPR, you have the right to withdraw your consent at any time. Withdrawal of your consent does not affect the lawfulness of any processing that is based on your consent before your withdrawal.

28. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a data protection authority.

29. Data Processed when you Exercise your Rights

Finally, we hereby advise, that we process the personal data transmitted by you, when you exercise your rights under Art 7 (3)(1) and Art 15 to Art 22 GDPR for the purpose of complying with these rights and to be able to demonstrate such compliance. Further, we will process your personal data to defend our legal position.

In this context your personal data is stored as long as necessary to demonstrate that we have fully and compliantly processed your data subject right request.

Such processing for the purpose of fulfilling your data subject rights and proof of a legally compliant fulfillment is based on our legal obligation according to Art. 6 (1)(c) GDPR in connection with Art. 7 (3) sentence 1 and Art. 15 to Art 22 GDPR and § 34 (2) German Federal Act on Data Protection (Bundesdatenschutzgesetz - BDSG). Insofar that we process your personal data to defend our legal position this also explains our legitimate interest, Art 6 (1)(f) GDPR.

You are not required to provide your personal data to us, neither by contract nor by law, notwithstanding, we may refuse to fulfil your request concerning your data subject rights pursuant to Art 12 (2)(2) GDPR if you do not provide us, though being requested to do so, with the data necessary for your identification.

30. Changes to this Privacy Policy

You can access the current version of this privacy policy at any time at https://www.picture-alliance.com/cms/23

[Version: September 2025]