Introduction
This Privacy Policy explains how personal data is collected and processed when you visit Create23.at, contact Create23, request information about a project, work with Create23 on photography, video or visual content, or otherwise interact with us.
The controller responsible for the processing of personal data described in this Privacy Policy is:
Create23
Operated by Filip Nikitovic
1230 Vienna, Austria
Email: [email protected]
Website: Create23.at
For questions concerning privacy or the processing of your personal data, please contact us by email.
This Privacy Policy applies to personal data processed in connection with:
- visits to Create23.at;
- inquiries submitted through the website or by email;
- website and visual-content project inquiries;
- photography;
- portrait and business photography;
- photography created for websites;
- video production;
- short-form video content;
- drone photography and video where offered;
- planning and preparation of visual-content projects;
- photo and video editing;
- AI-assisted editing where used;
- delivery of photographs and videos;
- invoicing and business administration;
- customer communication;
- portfolio use where legally permitted;
- website security and technical operation.
The personal information we process depends on how you interact with Create23.
3.1 Information You Provide to Us
When you contact Create23 through the website, by email or through another communication channel, we may process information such as:
- your name;
- email address;
- telephone number, if provided;
- company or organisation name;
- information about your website or project;
- requested photography or video requirements;
- preferred dates;
- locations;
- project details;
- messages and questions;
- other information you voluntarily provide.
We use this information primarily to respond to your inquiry and discuss the requested project.
If an inquiry develops into a project, we may process additional information necessary to organise and perform the work.
This may include:
- your name;
- company information;
- billing information;
- project requirements;
- agreed services;
- dates and locations;
- correspondence;
- pricing information;
- invoice information;
- payment information;
- information necessary to prepare or deliver photographs, videos or other visual content.
The primary legal basis for this processing is Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract or to perform a contract.
When Create23 creates photography or video content, the resulting material may constitute personal data where individuals can be identified.
This may include:
- a person's image;
- facial appearance;
- clothing;
- professional environment;
- workplace;
- surroundings;
- activities;
- objects associated with an individual;
- technical image metadata;
- date and time information;
- location information where recorded by the equipment.
The purpose of this processing is primarily to create and deliver the visual content requested as part of the relevant project.
A project may involve people other than the person who originally contacted Create23.
For example, photography may include:
- employees;
- business owners;
- team members;
- customers;
- models;
- family members;
- event participants;
- other individuals participating in a planned shoot.
Where a client organises photography involving other people, the client should ensure that those participants are appropriately informed about the photography.
Where required, separate permission or consent may be obtained for particular uses of the resulting images.
Create23 may create photographs and visual content specifically for use on websites.
This may include:
- portraits;
- team photographs;
- workplace photography;
- business interiors;
- products;
- service-related photographs;
- lifestyle imagery;
- video;
- drone imagery;
- website backgrounds and supporting visual material.
Personal data contained in such materials is processed for the purpose of producing the agreed website or visual-content project.
Where the content is intended to be published publicly on a client's website, the purpose and intended use of the images form part of the project context.
Additional care is taken where photography or video includes children.
Where legally required, permission from a parent or legal guardian should be obtained before photographing a child or publishing identifiable images of a child.
Create23 does not intentionally use identifiable photographs of children for advertising or promotional purposes without an appropriate legal basis and, where necessary, parental or guardian permission.
Create23 may process personal data for purposes including:
- responding to inquiries;
- discussing potential projects;
- preparing quotations;
- planning projects;
- scheduling photography or video work;
- communicating with clients;
- performing agreed services;
- taking photographs;
- recording video;
- creating drone imagery where applicable;
- editing and retouching;
- delivering finished files;
- handling revisions;
- maintaining project records;
- issuing invoices;
- fulfilling accounting and tax obligations;
- operating and securing Create23.at;
- preventing abuse and security incidents;
- protecting legal rights;
- establishing, exercising or defending legal claims;
- publishing portfolio material where legally permitted.
We do not use personal data for unrelated purposes without an appropriate legal basis.
Under the GDPR, personal data is processed only where an appropriate legal basis exists.
Contract and Pre-Contractual Measures
Article 6(1)(b) GDPR may apply when processing is necessary to:
- respond to a specific project request;
- prepare an offer;
- arrange a project;
- perform agreed services;
- communicate about the project;
- deliver photographs or videos.
Legal Obligations
Article 6(1)(c) GDPR may apply where processing is required to comply with legal obligations, including:
- bookkeeping;
- accounting;
- taxation;
- legally required business records.
Legitimate Interests
Article 6(1)(f) GDPR may apply where processing is necessary for legitimate business interests.
These may include:
- securing the website;
- preventing fraud or misuse;
- maintaining reasonable business records;
- customer communication;
- protecting Create23's legal rights;
- establishing or defending legal claims.
Where legitimate interests are relied upon, the interests and fundamental rights of the affected person are taken into consideration.
Consent
Article 6(1)(a) GDPR may apply where you have given consent for a particular form of processing.
Examples may include:
- certain portfolio uses;
- promotional publication of identifiable photographs;
- optional analytics;
- optional marketing technologies;
- other processing for which consent is required.
Consent may be withdrawn at any time for future processing.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Providing photography or video services does not automatically mean that Create23 may use every photograph publicly for advertising.
Selected project material may be displayed in places such as:
- Create23.at;
- Create23 portfolios;
- social media;
- presentations;
- promotional material;
- examples of previous work.
Where consent or another specific legal basis is required, Create23 will obtain the necessary permission before such use.
Clients do not automatically agree to promotional publication simply by commissioning photography or video work.
Photographs and videos may be processed using professional editing tools.
Editing may include:
- exposure correction;
- colour correction;
- cropping;
- sharpening;
- noise reduction;
- skin retouching;
- masking;
- background adjustments;
- background removal;
- object removal;
- perspective correction;
- resizing;
- video editing;
- audio adjustments;
- file optimisation;
- export into different formats.
Only information reasonably necessary for the requested editing workflow is processed.
Create23 may use software containing artificial intelligence or machine-learning features to assist with photography and video editing.
Examples may include:
- automated masking;
- noise reduction;
- subject detection;
- object removal;
- generative fill;
- background adjustment;
- image enhancement;
- sharpening;
- lighting adjustments;
- colour correction;
- other AI-assisted retouching tools.
Some AI functions operate locally on a computer.
Other features may require selected data, photographs or parts of photographs to be processed using systems operated by third-party software providers.
Where cloud-based AI functionality is used, Create23 aims to limit the information transferred to what is necessary for the intended editing purpose.
Create23 does not operate a general-purpose AI model and does not independently use client photographs to train its own artificial intelligence model.
Where drone photography or video is included in a project, recordings may contain:
- clients;
- project participants;
- buildings;
- vehicles;
- surrounding properties;
- public areas;
- individuals incidentally appearing in the background.
Create23 aims to avoid unnecessary collection of identifiable information about unrelated third parties.
Drone operations are also subject to applicable aviation, location, property and privacy requirements.
If Create23.at contains a contact form, information entered into that form is processed for the purpose of handling your inquiry.
This can include:
- name;
- email address;
- telephone number where requested;
- company information;
- project information;
- your message.
Providing information through the contact form is voluntary.
However, information such as a valid contact method may be necessary for Create23 to respond to your request.
When you communicate with Create23 by email, we process:
- your email address;
- your name where provided;
- message contents;
- attachments;
- related correspondence;
- technical information associated with email delivery.
This information is used for communication, project administration and maintaining relevant business records.
When you access Create23.at, technical information may automatically be processed by the website server or hosting infrastructure.
This may include:
- IP address;
- date and time of access;
- page requested;
- browser information;
- operating system;
- referring website;
- technical request information;
- server response information.
This information may be necessary for:
- delivering the website;
- identifying technical problems;
- maintaining security;
- detecting malicious activity;
- preventing abuse;
- investigating security incidents.
The legal basis is generally Create23's legitimate interest under Article 6(1)(f) GDPR in operating a functional and secure website.
Create23 may use website analytics in order to understand how the website is used and improve its performance.
Where an analytics service requires consent under applicable Austrian or European law, it will only be activated after the visitor has provided the necessary consent.
If no optional analytics consent is provided, those optional analytics technologies should remain inactive.
The technologies actually used by Create23 may change as the website develops. This Privacy Policy and the site's cookie information will be updated where necessary.
Create23.at may contain links to third-party websites or services.
For example, links may lead to:
- social media;
- maps;
- external platforms;
- partner websites;
- other online services.
When you leave Create23.at and visit another website, that third party processes information according to its own privacy practices.
Create23 is not responsible for the privacy practices of unrelated third-party websites.
Create23.at may occasionally use embedded content or functionality provided by third parties.
Examples could include:
- videos;
- maps;
- social-media content;
- external booking tools;
- galleries;
- other interactive services.
Where loading an embedded service would transmit personal data to a third party and prior consent is legally required, Create23 aims to prevent that service from loading before the appropriate consent has been provided.
Create23 may use third-party providers where reasonably necessary for operating the website or providing services.
These may include providers of:
- website hosting;
- domain services;
- DNS services;
- email;
- cloud storage;
- backup;
- cybersecurity;
- photo editing software;
- video editing software;
- AI-assisted editing;
- file transfer;
- client galleries;
- accounting;
- payment processing;
- technical support.
Where a provider processes personal data on behalf of Create23, appropriate data-protection arrangements are used where required by law.
Some technology or software providers used by Create23 may process information outside Austria or outside the European Economic Area.
Where personal data is transferred to a country outside the European Economic Area, Create23 will rely on an appropriate transfer mechanism where required.
Depending on the provider and country, this may include:
- an adequacy decision issued by the European Commission;
- Standard Contractual Clauses;
- another legally recognised safeguard.
Create23 aims to minimise unnecessary international transfers of identifiable client material.
Create23 does not keep personal information longer than reasonably necessary for the relevant purpose, except where longer storage is required by law.
Inquiries
If an inquiry does not result in a project, correspondence may generally be kept for a reasonable period in case follow-up communication is necessary.
Active Projects
Project-related information is retained for as long as necessary to:
- organise the project;
- perform the agreed work;
- deliver the final material;
- handle reasonable revisions;
- resolve project-related questions.
Accounting Records
Invoices and other records subject to Austrian accounting or tax retention obligations are retained for the period required by applicable law.
Photographs and Video
Original photographs, edited images, video files and project files may be retained for a reasonable period after a project has been delivered.
Retention allows Create23 to:
- complete revisions;
- correct delivery problems;
- restore files where reasonably possible;
- manage the project history;
- protect legitimate legal interests.
Create23 does not guarantee permanent or indefinite storage of client photographs or videos unless this has been specifically agreed.
Clients should maintain their own backups of delivered files.
Security Data
Technical and security information may be retained for a period reasonably necessary for troubleshooting, fraud prevention and security purposes.
Legal Claims
Information relevant to an actual or potential legal dispute may be retained for as long as reasonably necessary to establish, exercise or defend legal claims.
Create23 takes reasonable technical and organisational precautions designed to protect personal data against:
- unauthorised access;
- accidental loss;
- unlawful disclosure;
- alteration;
- destruction;
- misuse.
Measures may include, depending on the relevant system:
- password protection;
- access restrictions;
- encrypted connections;
- secure cloud infrastructure;
- system updates;
- backups;
- security monitoring;
- limited access to client files.
No internet-connected system can provide an absolute guarantee of security.
Where the GDPR applies, you may have the following rights regarding your personal data.
Right of Access
You may request confirmation of whether Create23 processes personal data relating to you and, where applicable, request access to that information.
Right to Rectification
You may request correction of inaccurate personal data.
Right to Erasure
You may request deletion of personal data where the legal conditions for erasure are satisfied.
This right is not absolute.
Information may continue to be retained where storage is required by law or justified by another applicable legal basis.
Right to Restriction of Processing
You may request restriction of processing in circumstances provided for by the GDPR.
Right to Data Portability
Where applicable, you may request certain personal information you provided in a structured, commonly used and machine-readable format.
Right to Object
Where personal data is processed on the basis of legitimate interests, you may have the right to object based on your particular situation.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time for future processing.
Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed unlawfully.
In Austria, the competent supervisory authority is:
Österreichische Datenschutzbehörde
Austrian Data Protection Authority
More information is available through the official website of the Austrian Data Protection Authority.
You may also contact Create23 first so that we have an opportunity to address your concern.
To make a request concerning your personal data, contact:
Please provide enough information for us to understand your request.
Where necessary, Create23 may request reasonable information to confirm the identity of the person making the request before releasing personal information.
We will not request more verification information than reasonably necessary.
Create23 does not currently use solely automated decision-making that produces legal effects or similarly significant effects concerning website visitors or clients.
AI-assisted photo and video editing tools are used for creative or technical editing purposes and are not used to make legal, financial, employment or similarly significant decisions about individuals.
You are not required to provide personal data simply to browse publicly accessible portions of Create23.at.
Certain information is necessary if you want Create23 to:
- respond to an inquiry;
- prepare an offer;
- discuss a project;
- provide photography or video;
- deliver project files;
- create an invoice.
If required information is not provided, Create23 may be unable to provide the requested service.
Create23 may update this Privacy Policy from time to time.
Changes may be necessary because of:
- changes to the website;
- new services;
- changes in technology;
- new software providers;
- changes in analytics or cookies;
- new editing workflows;
- changes in AI tools;
- changes to legal requirements.
The date at the beginning of this document identifies the current version.
For questions concerning this Privacy Policy, the processing of personal data or your privacy rights, please contact:
Create23
Operated by Filip Nikitovic
1230 Vienna, Austria
Email: [email protected]
Website: Create23.at
End of the privacy policy · last updated 19 September 2026Back to top ↑
22. Social Media
Create23 may maintain profiles on social-media platforms.
If you visit or interact with Create23 through a social-media service, the relevant platform may independently process information about you.
Create23 does not control the independent processing activities of those platforms.
If you contact Create23 through social media, we may process your:
for the purpose of responding to your communication.