Privacy Policy (Website incl. Blog)

Name: Dopamin Weddings
Address: München, 81673, DE
Telephone: +49 173 9532253

Status: October 14, 2026

This privacy policy informs you about which personal data we process when you visit our website (including the blog) and use its functions (e.g., contact form), and which rights you are entitled to under the GDPR.

1. Controller

Dopamin Weddings
Owner: Isabell Spieth
St.-Veit-Str. 11a, 81673 Munich, Germany

Phone: +49 173 9532253
Email: info@dopamin-weddings.de

2. Overview of Processing Activities

We process personal data in particular for the following purposes:

Provision of the website (content retrieval, stability, security)
Contact / handling inquiries (contact form)
Reach measurement (Umami Analytics, self-hosted - cookie-free)
Security and abuse protection (Firebase App Check, rate-limiting)
Display of fonts (Google Fonts - hosted locally)
Social media linking (Instagram/LinkedIn; links only)
Communication (Microsoft 365: Exchange/Teams; WhatsApp upon user initiative)

3. Legal Bases

Unless stated otherwise, we process data based on the following legal grounds:

Consent (Art. 6(1)(a) GDPR), e.g., when contacting us via WhatsApp or when signing up for promotions.
Contract / pre-contractual measures (Art. 6(1)(b) GDPR), e.g., for inquiries via the contact form.
Legitimate interests (Art. 6(1)(f) GDPR), e.g., IT security, prevention of abuse, ensuring technical operation, and cookie-free reach measurement.
Legal obligation (Art. 6(1)(c) GDPR), e.g., within the scope of statutory retention periods.

4. Hosting, Website Delivery, and Server Log Files (Firebase Hosting)

Our website is operated via Firebase Hosting. During every visit, technically necessary data is processed to deliver the website and ensure security/stability.

Types of data processed (typical):

IP address, date/time of access
Requested page/file, referrer URL
Browser type/version, operating system
Other technical log data where applicable

Purposes: Provision of the website, error analysis, security.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in safe, stable operation).

Note on data processing / third-country transfer: Firebase is a Google service. Depending on the specific service, transfers to third countries (e.g., USA) cannot be ruled out; please see the notes under section 8 (Firebase App Check).

4.1 Image Delivery (ImageKit)

The photos on our website are delivered via the image CDN ImageKit (ImageKit Private Limited, India). ImageKit converts the images to the appropriate size and a space-saving format so that pages load quickly. When a photo is requested, ImageKit processes technically necessary data such as IP address, date/time, requested file, referrer URL, and browser information. No cookies are set.

Purpose: fast and data-efficient delivery of images.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fast, stable website).

Data processing / third-country transfer: We have concluded a data processing agreement with ImageKit pursuant to Art. 28 GDPR. Image processing takes place in a data center in the EU; due to the global content delivery network (CDN) and the provider's registered office in India, transfers to third countries cannot be ruled out. These are safeguarded by EU Standard Contractual Clauses.

5. Reach Measurement with Umami Analytics (self-hosted)

For reach measurement we use Umami, an open-source analytics software that we host ourselves on a server operated by us in Germany/the EU at https://analytics.dopamin-weddings.de. No data is transmitted to third parties, and no transfer to third countries takes place.

No cookie banner, no consent required: Umami sets no cookies and stores no data on your device (neither local storage nor session storage). The only value read is an opt-out flag you set yourself (umami.disabled), in order to respect an objection. Since no information is therefore stored on or retrieved from your device, this measurement requires neither consent under § 25(1) TDDDG nor a consent banner.

Categories of data processed:

page visited, page title, and referring page (referrer)
date and time of access
browser, operating system, device type, and screen size
browser language setting
country or region, derived from the IP address
triggered events (e.g., "contact form started", "inquiry submitted") - without form content such as name, email address, or message

IP address: Your IP address is not stored. It is processed only briefly in order to derive country/region and to form a daily rotating, irreversible hash value that groups individual page views into a single visit. Recognition across several days or across different devices is thereby ruled out; no user profiles are created.

Purposes: Understanding which content is used, identifying technical problems, and measuring how often our contact form is used.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a data-minimising, anonymous evaluation of how our online offering is used).

Objection: The measurement respects your browser's "Do Not Track" setting. If it is enabled, no data is collected.

6. Google Fonts (locally hosted)

We use fonts ("Google Fonts") that are delivered from our own server or via our hosting, so that no connection to Google servers is required to retrieve the fonts.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a uniform, high-performance presentation).

7. Contact Form / Getting in Touch (incl. Firebase Cloud Functions & Firestore)

When you contact us via the contact form, we process the information provided by you to handle your inquiry.

7.1 What data is processed?

Name, email address, subject, topic (category)
Content of your message or details for a consultation call (preference, availability)
Wedding details if applicable (date / period / status "still open")
Technical metadata for abuse prevention and traceability (IP address, user agent, path; "raw" status as JSON if applicable)

7.2 Technical Processing (Firebase) & Retention/Deletion

The inquiry is processed via Firebase Hosting → Cloud Functions.

We use:

Firebase Cloud Functions (server logic, validation, dispatch)
Firebase Firestore (storage of the inquiry, abuse protection)
Firebase App Check (protection against automated access)

Firestore Storage (TTL): Contact inquiries are stored with a TTL (Time To Live) of 1 year. This TTL applies only to purely informational inquiries without a contract being concluded.

Statutory Retention Periods: If an inquiry results in a contract or documents are relevant for accounting, we store the data notwithstanding the TTL in accordance with legal requirements, in particular 6 years (German Commercial Code - HGB) or 10 years (German Tax Code - AO).

Legal bases:

Art. 6(1)(b) GDPR (pre-contractual / contract)
Art. 6(1)(f) GDPR (IT security)
Art. 6(1)(c) GDPR (legal obligation)

7.3 Sending Notification Emails (Mailjet)

Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France.

Name, email address, subject, and message content are processed.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

8. Firebase App Check (reCAPTCHA v3)

To protect our endpoints and prevent abuse, we use Firebase App Check in conjunction with reCAPTCHA v3.

Purpose & Scope: To determine whether an interaction on our website is performed by a human or an automated program (bot), hardware and software information (e.g., device data, browser properties) as well as IP addresses are transmitted to Google and evaluated there.

Only when the form is used: App Check is loaded only once you start interacting with our contact form - simply reading our content establishes no connection to Google.

Storage access: A cookie set by Google (_GRECAPTCHA) is used; in addition, the Firebase SDK stores a short-lived App Check token as well as technical information about SDK usage locally in your browser (IndexedDB). All of this is technically necessary for abuse prevention and is not used to analyse your behaviour.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of our IT systems and protection against spam) together with § 25(2) no. 2 TDDDG (technically necessary in order to provide the function you requested - submitting the form).

9. Communication via Microsoft 365 (Exchange & Teams)

We use Microsoft 365, particularly Exchange and Teams, for email, telephone, and video communication.

Provider: Microsoft Ireland Operations Limited, Dublin, Ireland (Parent company: Microsoft Corp., USA)

Processed data: Communication content, name, email address, metadata, and, if applicable, image and sound tracks.

Legal basis: Art. 6(1)(b) GDPR as well as Art. 6(1)(f) GDPR.

Third-country transfer: EU-US Data Privacy Framework and Standard Contractual Clauses.

10. Communication via WhatsApp

If you contact us on your own initiative via WhatsApp, we process your mobile number and message content.

Provider: WhatsApp Ireland Limited, Dublin, Ireland (Parent company: Meta Platforms Inc., USA)

Notes:

WhatsApp has access to metadata; end-to-end encryption only protects the content.
Confidentiality: We point out that communication via WhatsApp is less suitable for highly sensitive, confidential information. For such matters, please use communication by email or mail.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(a) GDPR.

Third-country transfer: EU-US Data Privacy Framework and Standard Contractual Clauses.

11. Blog

When reading the blog, the general processing rules (hosting, log files) apply.

12.1 Links (Instagram & LinkedIn)

Our website contains simple links to our social media profiles. The privacy policies of the respective providers only apply once you click on the link.

12.2 Joint Controllership

If you visit our profiles on Instagram or LinkedIn, there is a joint responsibility (Joint Controllership according to Art. 26 GDPR) between us and the respective platform operator for the data processing that occurs there. Information on your data subject rights can be found directly in the privacy policies of the respective providers.

13. Recipients / Data Processing on Behalf

Recipients may include:

Google / Firebase
ImageKit (image delivery)
Mailjet
Microsoft
WhatsApp / Meta
netcup GmbH (server hosting for our Umami instance, data centre in the EU)

Where necessary, Data Processing Agreements (DPAs) according to Art. 28 GDPR have been concluded with the relevant service providers.

14. Your Rights

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)