Last updated: 08 November 2026
This privacy policy explains how ONSHOT processes personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). It applies to the website onshot.netlify.app (and any domain that redirects to it) and to our Instagram account @onshot.online, including automated replies to comments and direct messages.
Benjamin Huemer, trading as ONSHOT
Veilchengasse 4, 2402 Haslau an der Donau, Austria
Email: onshot.online.mgmt@gmail.com
Phone: +43 664 99709997
We are not required to appoint a data protection officer.
When you open this website, the hosting provider automatically processes technical data that your browser sends: IP address, date and time, requested page, referrer URL, browser type and operating system. This is necessary to deliver the website and to keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). The data is kept by the hosting provider for a short period only (normally no longer than 30 days) unless it is needed to investigate a security incident.
This website is hosted by Netlify, Inc., San Francisco, USA, which processes the data listed in section 2 on our behalf (data processing agreement under Art. 28 GDPR). Data may be transferred to the USA. The transfer is based on the EU Commission adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, where applicable, on the EU Standard Contractual Clauses (Art. 46 GDPR).
This website does not use cookies, analytics, tracking pixels or advertising tools, and it does not store anything on your device. Therefore no cookie consent is required (§ 165 (3) TKG 2021). All fonts (Montserrat, Outfit, Playfair Display, Space Grotesk) and icons (Font Awesome Free) are hosted on our own web server. No connection to Google Fonts or any other font or icon service is made when you visit this website. The fonts are used under the SIL Open Font License 1.1, the Font Awesome icons under the CC BY 4.0 license.
If you contact us by email or phone, we process the data you provide (e.g. name, email address, phone number, content of your message) to answer your request and, if applicable, to prepare or carry out a contract. Legal basis: Art. 6(1)(b) GDPR (pre-contractual and contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Our email service is provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (processor); data may be transferred to the USA under the EU-U.S. Data Privacy Framework. Enquiries that do not lead to a contract are deleted six months after the last contact; contract-related correspondence is kept as long as required by Austrian tax and commercial law (generally seven years, § 132 BAO).
To answer enquiries quickly, incoming emails to our business mailbox are copied to our own computer, sorted and a draft reply is prepared with the help of software and artificial intelligence. For this we use one of the following two options: (1) AI models running locally on our own hardware, where no data leaves our computer, or (2) the AI assistant Windsurf / Devin of Cognition AI, Inc., USA, which we use with telemetry and data sharing disabled, so that the content is processed only on our behalf and is not used to train AI models. For transfers to the USA, the provider's data processing terms with the EU Standard Contractual Clauses (Art. 46 GDPR) or, where applicable, the EU-U.S. Data Privacy Framework (Art. 45 GDPR) apply. We do not use any other external AI service for emails. Every reply is checked and sent by a person; no decision with legal or similarly significant effect is made automatically (Art. 22 GDPR). We only receive a short internal notification on our phone (e.g. "new booking request") without the content of your message. Legal basis: Art. 6(1)(b) and (f) GDPR (efficient handling of enquiries). Storage periods are the same as in section 5.
We operate the Instagram professional account @onshot.online and use the official Instagram API from Meta to answer comments and direct messages. If you write a specific keyword (for example a word mentioned in one of our posts) as a comment under one of our posts or reels, our system automatically:
For this we process: your Instagram username and Instagram-scoped user ID, the ID and text of your comment or message, the post concerned, the date and time, and the reply we sent. If you send us a direct message, we process its content to answer you. Purpose: answering the request you started by commenting the keyword or writing to us. Legal basis: Art. 6(1)(b) GDPR (measures taken at your request) and Art. 6(1)(f) GDPR (legitimate interest in answering comments and messages efficiently). The replies are triggered only by the keyword; no decision with legal or similarly significant effect on you is made (no automated decision-making within the meaning of Art. 22 GDPR).
These records are stored on our own systems and deleted no later than 12 months after your last interaction with us, or earlier if you ask us to delete them (see section 9).
If you ask us via a keyword, comment or message to be informed about a service (for example a recording session), we note your Instagram username, the date and the service you are interested in, so that we can contact you about it via Instagram. Legal basis: Art. 6(1)(b) GDPR (your request). We will not send you advertising by email, SMS or phone without your separate, explicit consent (§ 174 TKG 2021). You can ask to be removed from the list at any time; otherwise the entry is deleted after the service has been provided or no later than 12 months after your request.
As a photo and video production company we take pictures and videos at events, shootings and recordings. Persons depicted are clients, artists, staff and, at events, guests. Recordings of clients and artists are made on the basis of the contract (Art. 6(1)(b) GDPR) or consent (Art. 6(1)(a) GDPR). Event recordings showing guests are made on the basis of our and the organiser's legitimate interest in documenting and promoting the event (Art. 6(1)(f) GDPR); organisers inform guests about the recording. We publish recordings on our website and social media (e.g. Instagram) only where this is covered by a contract, consent or legitimate interest and does not harm the legitimate interests of the persons depicted (§ 78 Austrian Copyright Act). If you are depicted and do not want a recording to be published, write to us (section 9) and we will remove or not use it. Raw material is kept for as long as needed for the project and possible re-orders, generally no longer than three years, unless a contract provides otherwise.
For artists we represent or work with, we may use face recognition software that runs exclusively locally on our own computer to find and sort photos and videos of that artist within our own recordings. Facial features are biometric data (Art. 9 GDPR); we therefore only use this for artists who have given their explicit consent (Art. 9(2)(a) GDPR), usually as part of the artist management agreement. Only the consenting artists' reference data is stored. Faces of other persons are only compared automatically during the search, are not identified, not stored as reference data and discarded immediately. No data is passed to cloud services for this purpose. Consent can be withdrawn at any time with effect for the future; the artist's reference data is then deleted.
Instagram is provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. All comments and messages are transmitted through Meta. For the statistics (insights) Meta provides about our account, we and Meta are joint controllers under Art. 26 GDPR; Meta has assumed primary responsibility for this processing (Page Insights Controller Addendum). Meta may transfer data to the USA under the EU-U.S. Data Privacy Framework. You can also exercise your rights regarding Instagram directly with Meta: Instagram Privacy Policy.
To receive comment and message notifications from Meta, our system uses the tunnelling service of ngrok, Inc., San Francisco, USA, as a technical processor (Art. 28 GDPR); data may be transferred to the USA on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR).
You can ask us at any time to delete all data we hold about you, including data we received through Instagram. Send an email to onshot.online.mgmt@gmail.com with the subject "Data deletion request" and your Instagram username, or send the word "delete" as a direct message to @onshot.online. We delete your data within 30 days and confirm the deletion to you. Data we are legally required to keep (e.g. invoices) is blocked and deleted when the legal retention period ends. Comments you posted yourself can be deleted by you directly in Instagram.
We only share personal data with the service providers named above (Netlify, Google, Meta, ngrok, external AI providers under a data processing agreement as described in section 5a), with our tax advisor where required for accounting and, where legally required, with authorities. We do not sell personal data.
Under the GDPR you have the right to:
Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds.
To exercise your rights, contact us at onshot.online.mgmt@gmail.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.
Our services are not directed at children. In Austria, consent to information society services can be given from the age of 14 (§ 4 (4) DSG). If you are younger, please do not use the keyword function without the consent of a parent or guardian.
We update this privacy policy when our services or the law change. The current version is always available on this page.