An adjective claims, a reference proves. That makes the reference section the one part of a website that works without superlatives: who did what for whom is verifiable, and verifiability is what convinces. At the same time, few areas of a website are so densely covered by law. A single reference card can touch four different legal regimes at once: trade mark law protects the logo, copyright law protects the photograph, portrait rights protect the people in the picture, and data protection law covers the named contact person. Above all of that sits the contract with the client, which can permit or forbid being named at all. This article sorts the four layers, shows what a short written reference release with scope, term and withdrawal looks like, and describes the workable alternative for everyone bound by professional confidentiality.
Why references beat adjectives
A website can claim whatever it likes. The moment a specific client, a specific project and a specific outcome are named, the text changes category: advertising becomes a checkable statement. A prospect can call the company you named. They can look at the building. They can compare the industry with their own. That checkability is the actual mechanism, and it explains why one well-described reference carries more weight than three paragraphs about quality awareness and reliability. How to spot and replace that kind of marketing language is covered in the article on writing website copy customers actually read.
One distinction matters. Reviews and customer voices are other people's statements about you, and they follow their own rules — in particular the duty to disclose whether and how you verify them, which the article on showing customer reviews legally explains. A reference is something else: it is your own account of a project. The risk therefore shifts away from unfair-competition law and towards third-party rights — the client, the photographer, the people in the frame. How a reference image should be composed so that it produces enquiries is covered in the article on project photos that bring in enquiries; this piece deals with the prior question of what you are allowed to show at all.
References advertise with other people's property
The economic scale is considerable. As the umbrella organisation of 79 (German Chamber of Industry and Commerce) chambers of industry and commerce, the DIHK represents the interests of more than 3 million (German Chamber of Industry and Commerce) companies in Germany. Almost every one of them can be both client and rights holder in a reference. On the other side stands the Wettbewerbszentrale, supported by around 1,100 (Wettbewerbszentrale) companies and around 800 (Wettbewerbszentrale) chambers and business associations; it typically pursues unfair-competition cases after a tip-off from a competitor in the same trade.
Four areas of law in one reference card
Publishing a reference usually means making four decisions at once without noticing. It is worth looking at them separately, because each has its own legal basis and its own consequences. The overview below maps each element to the law it touches.
The logo: trade mark law
A registered sign gives its proprietor an exclusive right (German Trade Mark Act, Section 14). Anyone using it in the course of trade without consent can be required to cease and desist, and to pay damages where they acted intentionally or negligently.
The photo: copyright law
The author is the person who pressed the shutter, not the person who paid. The client acquires rights of use to the agreed extent, while the author keeps the right to be recognised as the author of the work (German Copyright Act, Section 13).
The people: portrait rights
Portraits may be distributed or publicly displayed only with the consent of the person depicted (German Art Copyright Act, Section 22). That covers the client's staff just as much as third parties who happen to be present.
Personal data: the GDPR
The name, role and contact details of a contact person are personal data and need a legal basis (GDPR, Article 6(1)). The company itself, as a legal person, is not covered by that requirement.
Above those four layers sits a fifth one that no statute provides: the contract. Confidentiality agreements, secrecy clauses in framework contracts and the terms of public procurement can forbid being named even where trade mark law and data protection law raise no objection. This layer is the one most often overlooked, because it is not in a statute book but in a PDF from the tender phase.
Legal framework, not legal advice
Naming a client requires their consent
The most common assumption is that a satisfied client will not mind. Legally that counts for nothing. A company decides for itself who it is publicly associated with — perhaps because it does not want to advertise working with a particular trade right now, because a competitor of yours is also in talks there, or because its marketing department has rules about external communication. Silence in response to an email is not consent, and a clause in your own terms and conditions stating that you may name clients as references rarely holds up when challenged.
On data protection, one distinction saves a lot of anxiety. The GDPR expressly does not apply to the processing of personal data of legal persons, including the name, legal form and contact details of the legal person (GDPR, Recital 14). Naming a limited company is therefore not a data protection matter. As soon as a sole trader, a freelancer or a named contact person appears, however, personal data is involved and a legal basis under Article 6(1) (GDPR) is required — in practice, consent under point (a). How to document consent and notices on a website is covered in the article on imprint and privacy policy pages.
| Who you want to name | What needs clarifying | Basis |
|---|---|---|
| A corporation, for example a GmbH or AG | The company's consent to being named and to logo use; a check of contractual confidentiality duties | Contract, trade mark law, name rights |
| A sole trader or a freelancer | Additionally a data protection basis, because the business name and the person coincide | GDPR, Article 6(1) |
| A named contact person | That person's own consent, separate from the company's; withdrawal possible at any time | GDPR, Articles 6 and 7 |
| A public sector client | Check tender documents and contract terms; being named is often tied to written approval | Contract, procurement terms |
| A client with a confidentiality agreement | As a rule no naming; an anonymised project account instead | Contract, professional rules |
No objection is not consent
A second point concerns sequence. Consent should be obtained before the reference page is built, not afterwards. Editing photos, writing copy, publishing the page and only then asking means negotiating from a weak position and possibly dismantling a finished page. The best moment is project handover: satisfaction is at its peak, the right people are reachable, and the matter is still open.
The reference release: scope, term, withdrawal
A reference release is not a contract package, it is half a page. It answers five questions, and each of them heads off a typical later dispute: who is releasing? What exactly is being shown? Where may it appear? For how long? And how do you get out again? Leave one of those out and you create room for interpretation, and room for interpretation is the raw material of conflict.
- Releasing party: the company, represented by someone authorised to sign — not the site manager, who is rarely responsible for communication matters.
- Subject matter: use of the company name, use of the word and figurative mark, specifically identified photos, the text of the case description. Ideally with file names or as an annex.
- Channels: website, proposal documents, trade fair displays, social media profiles. A release for the website does not automatically cover an advertising campaign.
- Term: a defined period rather than "until further notice". In practice 24 months (project experience) with a follow-up confirmation by email works well.
- Withdrawal: possible at any time in text form, with an implementation period of roughly 14 days (project experience) so that removal stays plannable.
- People in the picture: a separate confirmation that depicted staff of the client have consented themselves, or that no individuals are identifiable.
- Image source: who took the photos and which rights of use were transferred — including whether an attribution is required.
- Confidentiality: an explicit confirmation that no non-disclosure agreement stands in the way. With larger clients this is the most important line.
Reference release
Between ____________________ (Client)
and ____________________ (Contractor)
1. Subject matter
The Client agrees that the Contractor may present the project
"____________________" (period: ____ to ____) as a reference.
Released for use are:
[ ] the Client's company name
[ ] the word and figurative mark (logo), unaltered
[ ] the photographs listed in Annex 1 (file names: ________)
[ ] the case description in Annex 2
2. Channels
The Contractor's website, proposal and presentation documents.
Further channels only with separate approval.
3. Term
24 months from signature. Any extension requires a renewed
confirmation in text form.
4. Withdrawal
The Client may withdraw this release at any time in text form
without giving reasons. The Contractor removes the content
within 14 days of receiving the withdrawal.
5. Individuals and third-party rights
The Client confirms that no non-disclosure agreement prevents
being named. In the released photographs:
[ ] no individuals are identifiable
[ ] individuals are identifiable and have given their consent.
Place, date Signature Client Signature ContractorThe right of withdrawal is not a courtesy; for personal data it is mandatory. Consent once given can be withdrawn at any time, and withdrawal must be as easy as giving consent (GDPR, Article 7(3)). Planning for that from the outset saves the argument about whether a signature from three years ago still holds. In practice it means the withdrawal needs an address that someone actually reads, plus an internal routine that triggers removal within the stated period.
Build the release into project handover
Client logos: when trade mark law still allows it
The logo wall is a popular design device — and the point where most complaints in the reference area arise. The reason lies in the starting point of trade mark law: registration grants the proprietor an exclusive right (German Trade Mark Act, Section 14(1)). Where there is a risk of repetition, the proprietor can demand that the use stop, even where an infringement is only threatened for the first time; intentional or negligent conduct adds damages, which may also be calculated on the basis of a reasonable licence fee (German Trade Mark Act, Section 14(5) and (6)). A registered mark is no short-lived right either: protection runs for 10 years from the filing date and can be renewed for a further 10 years at a time (German Trade Mark Act, Section 47).
The statute does, however, contain an exception that is decisive for references. The proprietor may not prohibit a third party from using the mark for the purpose of identifying or referring to goods or services as those of the proprietor, provided the use is in accordance with honest practices in industrial or commercial matters (German Trade Mark Act, Section 23). That is where the room to manoeuvre lies: stating factually who you have worked for is a reference to someone else's sign; using it as decoration, a quality seal or proof of partnership steps outside the exception.
The proprietor of a trade mark is not entitled to prohibit a third party from using the mark in the course of trade for the purpose of identifying or referring to goods or services as those of the proprietor — provided the use is in accordance with honest practices in industrial or commercial matters.
- The sign appears unaltered: original colours or a single-colour version approved by the rights holder, no colour adjustments of your own, no cropping, no distortion.
- There is visible clear space between the sign, your own logo and neighbouring elements, so that no combined sign emerges.
- The heading describes the relationship factually: "clients", "projects for", "commissioned by". Wording such as "partner" or "recommended by" claims more than the assignment supports.
- No sign is placed in a way that suggests a certification, membership or authorisation that does not exist.
- Brand guidelines of the client are observed where they exist; larger companies provide a document with minimum sizes and clear space.
- The logo wall shows only clients with a release on file, not companies you once wrote a proposal for.
One nuance deserves attention. The exception for referential use assumes that the mention is factually necessary, or at least factual in tone. A list of twelve greyscale logos documenting client relationships sits closer to that line than a full-screen stage of other people's brands in which your own offering barely features. When in doubt, take the simpler route: the company name as text instead of the logo. The text states the same fact and touches trade mark law far less.
Who owns the project photo
The second big misconception concerns photographs. Paying a photographer does not buy authorship; it buys rights of use to the extent agreed. Copyright itself stays with the person who pressed the shutter, and it includes the right to be recognised as the author, together with the decision whether and under what designation the work is credited (German Copyright Act, Section 13). Two very practical consequences follow: you need a statement about which uses are permitted, and a statement about whether an attribution is required.
The terms of protection explain why this topic rarely expires. For simple photographs — images without particular creative height — protection ends 50 years after publication or after the first lawful communication to the public, and at the latest 50 years after production (German Copyright Act, Section 72). Where the image qualifies as a photographic work, the regular term applies: copyright expires 70 years after the death of the author (German Copyright Act, Section 64). A photo from an old project folder is therefore usually still protected, even if nobody remembers who took it.
| Origin of the photo | Who is the author | What you need |
|---|---|---|
| Taken by a commissioned photographer | The photographer | A written grant of rights of use for website, proposals and social media; clarification of the attribution |
| Taken by staff as part of their duties | The staff member | A clause in the employment contract or a short confirmation; rights of use usually pass to the business |
| Photo supplied by the client | Often unclear | The client's confirmation that they hold the rights and may pass them on — otherwise you are liable for publishing |
| Taken on your own phone at the site | You | Only third-party rights in the frame need clearing: people, other brands, protected parts of buildings |
| Image from a stock library | The contributing photographer | Check the licence, in particular whether advertising use is covered and whether attribution is required |
Attribution is often treated as a blemish and left out. That is risky, because the right to be named is a moral right of the author and can be asserted in its own right. A fixed convention helps: the credit in the caption or collected on a dedicated page linked from the footer, and stored as a field in the content system so that it survives the next redesign. Which licence types otherwise need distinguishing is covered in the article on image rights and real motifs.
People, interiors and other people's buildings
Project photos are taken in real places, and real places are rarely empty. The principle is simple and strict at once: portraits may be distributed or publicly displayed only with the consent of the person depicted (German Art Copyright Act, Section 22). After that person's death, the consent of their relatives is required for 10 years (German Art Copyright Act, Section 22). Breaching this risks more than civil claims: the statute provides for imprisonment of up to one year or a fine, and the offence is prosecuted only upon complaint (German Art Copyright Act, Section 33).
Portraits may be distributed or publicly displayed only with the consent of the person depicted.
The law does provide exceptions, but they help only so much in a reference context. Distribution without consent is permitted for portraits from the sphere of contemporary history, for images in which people appear merely as incidental elements alongside a landscape or other location, and for pictures of gatherings and similar events (German Art Copyright Act, Section 23(1)). The permission ends where a legitimate interest of the person depicted is infringed (German Art Copyright Act, Section 23(2)). For a reference that means the fitter working in the foreground is not an incidental element. An unrecognisable silhouette at the edge of the frame would be — and even then, consent is the safer route.
Your own staff
Employees need to consent as well, and that consent should be voluntary, documented and revocable. Once someone leaves the business, the factual reason for continued use often falls away; those images then belong out of the reference pool.
Interiors and property rights
Photographs taken inside someone else's premises require the permission of the person entitled. Exploiting them without agreement can lead to claims even where no person and no brand appears in the frame. That permission belongs in the reference release.
Other people's buildings
Freedom of panorama permits images of works permanently located on public paths, streets or squares — taken from those paths (German Copyright Act, Section 59). Shots from the air or from private land are not covered by it.
The neighbour in the background
Anonymised project accounts under confidentiality
For law firms, tax advisers, medical and psychotherapy practices, executive search and parts of IT security, naming a client is simply not an option. Professional confidentiality is anchored in professional law and backed by criminal sanctions; it regularly covers the very fact that a mandate or treatment relationship exists. Outside these professions too, some clients decline to be named for competitive reasons. The answer is not an empty reference section, but the anonymised project account.
It works because it carries the information prospects actually want: they want to know whether your business has solved a problem like theirs before. The company name is dispensable for that; the constellation is not. Four short paragraphs suffice: situation, task, approach, outcome. Used consistently, this structure produces cases that can be compared — and avoids the impression that there is nothing to show. For the language side, with short sentences and concrete figures, the article on clear website copy supplies the groundwork.
Describe instead of naming
"A trades business with 18 employees in the district" carries almost as much information as the company name without stating it. Size, region and the initial problem are enough for a prospect to place the case.
Avoid reverse identification
A description is anonymous only when the combination of details does not point back to one company. Industry plus town plus headcount plus year often identifies a business in a small town unambiguously. When in doubt, leave one attribute out.
Merge similar cases
Several comparable projects can be condensed into one typical account. Labelling matters: a merged case must not be presented as one specific project, or anonymisation turns into misleading advertising.
The colleague test
Before-and-after images without misleading
Before-and-after shots are the most effective form of reference and the most vulnerable at the same time. They assert a change, and that assertion is judged under unfair-competition law. For 2025 (Wettbewerbszentrale), the Wettbewerbszentrale reports that more than one in two (Wettbewerbszentrale) of the legal questions it had to examine concerned misleading or non-transparent practices; four (Wettbewerbszentrale) sets of proceedings clarified questions before the Federal Court of Justice, three (Wettbewerbszentrale) of which ended in a judgment the same year. Misleading advertising is therefore not a fringe issue but the focal point of complaints.
- Same position, same focal length, similar time of day: shooting the after image in sunshine and the before image in the rain compares the weather rather than the work.
- No retouching of the result. Colour correction and cropping are defensible; removing distracting details is not.
- State the moment: an after image taken right after cleaning shows a different state than one taken six months into use. Both are fine when the caption says so.
- State the scope: what was commissioned, what did the client contribute, what is third-party equipment? Without that boundary the image claims someone else's work.
- Label atypical results. An unusually successful project may be shown, but it should not be presented as the normal case.
- Where people appear, consent covers both shots — including the unflattering before situation.
Presentation also decides whether the comparison reads as fair. Two images of equal size side by side, clearly labelled and without slider effects, come across as more honest than an animation that steers the eye. Which crops and captions work in practice is shown in the article on project photos that trigger enquiries.
What applies when the relationship ends
References age, and on several levels at once. The simplest question: may a reference stay up after the client has moved on? In principle yes — the statement "we delivered this project in 2024" remains true even though the relationship ended. It becomes problematic when the presentation suggests an ongoing relationship, for instance through present-tense wording or a heading such as "our clients". A date or a year solves that in one line.
| Event | What to do | Deadline |
|---|---|---|
| The client withdraws the release | Remove the content from website, proposal documents and profiles; check cached versions too | Within the agreed period, commonly 14 days (project experience) |
| The company changes its logo | Swap the old sign or switch the reference to a text mention | At the next maintenance round |
| The client is acquired or renamed | Adjust the mention to the new company name or obtain a fresh release from the successor | Before the next publication |
| The release expires after 24 months | Obtain a short confirmation by email or archive the reference | Before expiry, with a calendar reminder |
| The person shown leaves the business | Replace the photo or take it out of the reference pool | On departure |
One appointment a year is enough
Store releases and credits where they stay maintainable
Legal certainty rarely fails on knowledge and often on filing. The release sits on paper in a project folder, the image credit is in an email, the expiry date is known only to the person who ran the project. Once that person leaves or the website is rebuilt, the connection is lost — and the reference sits online without documented basis. The remedy is unspectacular: the details belong wherever the image lives.
Media with metadata
In XICflow every image in the media manager carries an alt text and a title. The alt text describes the motif for screen readers and search engines, while the title field holds the image credit and its source. Both stay attached to the image even when it is later used on another page.
Reference and project blocks
References are built as their own block type with fields for client, period, task, service and images. Every reference therefore looks the same, and missing details show up while creating the entry rather than while proofreading the finished page.
Anonymised cases as a variant
For law firms and practices the same block works without the client field: situation, task, approach, outcome. The structure stays comparable while identifying details drop out — with no need for a second page template.
The practical gain lies in reuse. An image whose credit was entered correctly once carries that credit to every other page. A reference block that knows its release date can be listed for the annual review. And an alt text created at upload time does not have to be added retroactively during an accessibility check — for which the article on image formats and alt text supplies the detail. Which building blocks are available is set out in the overview of the Flow Builder features; how finished pages look is easiest to judge from the example sites.
Put into practice in ten steps
The sequence below brings an existing reference pool into a documented state and sets the process for future projects at the same time. For a mid-sized pool of ten to fifteen references this is a morning's work, spread over two sessions.
- Take stock: list every place where client names, logos or project photos appear — website, proposal templates, trade fair displays, vehicle livery, social media profiles.
- Check the basis for each reference: is there consent, in what form, with what scope and since when? If it is missing, the reference goes on a waiting list for now.
- Review contracts: go through framework agreements, non-disclosure agreements and tender documents to see whether naming is excluded.
- Create the release template: store the half-page with scope, channels, term, withdrawal and the confidentiality confirmation as a document in the business.
- Collect the missing releases with a short personal message that attaches the finished draft of the reference — this raises the return rate noticeably (project experience).
- Clear image rights: for every photo, record who took it, which use was agreed and whether an attribution is required.
- Check image content: look for people, other brands, number plates, interiors and neighbouring properties at the edges of the frame, and re-crop when in doubt.
- Add anonymised cases wherever naming is excluded, and apply the colleague test to them.
- Place references in the site structure: an overview plus a dedicated sub-page per project, linked from the matching service pages — which pages should exist at all is covered in the article on the pages a business website needs.
- Set the annual appointment: one hour in January for release dates, logos, people and the currency of the descriptions. How a website is built and maintained overall is shown in the route from idea to finished site.
Anyone who has been through this once notices that the real gain is not avoiding letters from lawyers. It is that the reference section is complete for the first time: with dates, with scope, with documented images and with cases that can be compared. That is what turns it into the part of the website that produces enquiries rather than merely filling space.
Sources and studies