Privacy
Privacy at a glance
When you visit this website, technical data is processed to provide the website and keep it secure. If you contact us by email or telephone, we also process the information you provide to handle your enquiry.
No contact form or additional analytics tool is currently integrated. For the website hosted by STRATO, only STRATO’s server-based access statistics are envisaged. Trailers are embedded on the website via YouTube and Vimeo. These players are loaded only after your express consent. The following sections explain the details, legal bases and your rights.
Controller
schöne neue filme. GmbH
Rauchstraße 7
81679 München
Germany
Represented by Alexander Krötsch (Managing Director)
Email: hello@schoeneneuefilme.de
Telephone: +49 (0) 89 3274 5131
Hosting and access data
STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, is the planned hosting provider under the Hosting Basic package. When the website is accessed, technically necessary access data is processed. This includes, in particular, the IP address, date and time of access, requested files, volume of data transferred, status messages, information about the browser and operating system and, where applicable, the previously visited page.
This processing serves to provide the website, maintain its stability and security, and detect and prevent attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our online offering.
STRATO states that IP addresses are stored for a maximum of seven days for attack detection and prevention. Access logs available in the customer account are provided with anonymised IP addresses for six weeks, according to STRATO. The settings and periods applicable to our specific hosting package will be checked before publication.
A data processing agreement under Article 28 GDPR is in place with STRATO. It governs the processing of personal data on our behalf.
Contact by email and telephone
If you contact us, we process the information you provide, such as your name, contact details, message content and any documents submitted. This is used to handle your enquiry and subsequent correspondence. Our email accounts are hosted by STRATO. No contact form is integrated into this website.
If your enquiry relates to a contract or steps taken before entering into a contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR on the basis of our legitimate interest in handling incoming requests. Where statutory retention obligations apply, retention is based on Article 6(1)(c) GDPR.
The deletion rules set out in the following section apply to contact enquiries, story submissions and applications.
Providing data for a general enquiry is voluntary. Without the information needed to respond, we may be unable to deal with your enquiry. Please note that ordinary emails are not automatically end-to-end encrypted.
General retention periods
We retain personal data only for as long as it is necessary for the relevant processing purpose. If the data is no longer needed earlier, we delete it before the maximum periods below expire.
- General enquiries that do not lead to a working relationship: deleted no later than three months after the enquiry has been finally dealt with.
- Unsolicited story submissions where we have no interest in further development: deleted after rejection or a decision not to review the material, and no later than three months after receipt.
- Unsolicited applications for roles without a specific selection process: deleted promptly, and no later than three months after receipt. They are not automatically added to a casting database.
- Applications within a specific selection process: generally deleted no later than six months after rejection or completion of the selection process. Retention during this period takes place only insofar as it is necessary to defend potential claims.
Where a working relationship continues, the documents required for it are transferred to the project or contract file. Purpose-specific retention periods and, where applicable, statutory retention obligations apply to those documents.
Longer-term inclusion in a story or casting database is not automatic. A separate purpose, appropriate legal basis and fixed retention period will be agreed for this. For voluntary inclusion based on separate consent, this period is generally twelve months; consent can be withdrawn at any time with effect for the future. No such database has currently been established.
Statutory retention obligations may require longer storage; the legal basis is Article 6(1)(c) GDPR. In specific legal disputes, documents needed to establish, exercise or defend legal claims may be retained separately. Processing is restricted to that purpose. The data is deleted once the grounds for retention no longer apply.
Deletion also covers email attachments and downloaded copies. A limited overwrite cycle for backup copies must be defined and confirmed before publication. An erasure request or withdrawal of consent does not result in the deletion of data that must still be retained on another lawful basis.
Fonts, images and storage on your device
Fonts and preview images are served through our own website. Loading these files does not require a request to an external font or image service.
The current website draft does not include analytics or marketing cookies, or storage of settings in Local Storage or Session Storage. Your browser may cache files to display pages more quickly. Before publication, we will check whether the production hosting environment uses any additional cookies or other storage access. Where required, prior consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) will be obtained for storage on, or access to, your device that is not strictly necessary.
External video and streaming services
Links to Vimeo, YouTube, Google, Amazon, ARD Mediathek and other providers lead to external websites. External links do not load players on this website. The following information applies to the separately embedded YouTube and Vimeo players. An external website is accessed only when you open its link. The provider’s own privacy information applies there; accessing the site may already involve processing your IP address and technical browser data.
Embedded videos: YouTube and Vimeo
Consent and withdrawal
We use embedded videos to present trailers and teasers for our projects. Initially, only a preview image served through our website is displayed. The relevant external player is loaded only after the separate notice and your click on “Agree and load video”.
Consent applies only to this video during the current page view; it is not stored persistently in cookies or browser storage. The rest of the website remains usable without consent. The legal basis for loading the player and the associated data transmission is Article 6(1)(a) GDPR. Where the provider stores or accesses information on your device, consent is obtained under Section 25(1) TDDDG.
You can withdraw consent to further embedding and remove the player by selecting “Deactivate video”. Reloading the page requires fresh consent. This does not affect the lawfulness of processing before withdrawal. Removing the player does not automatically delete data already transmitted or information stored by the provider or on your device. The provider’s privacy and account controls and your browser’s cookie and site-data settings are available for this purpose.
YouTube
For people in the European Economic Area and Switzerland, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Other possible recipients include Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and service providers engaged by Google.
After consent, data processed may include your IP address, browser and device information, the time and origin of the request, and playback and interaction data. Google uses data, among other things, to provide, secure and improve its services. Depending on sign-in status and settings, data may be associated with a Google account and used for further purposes described in Google’s privacy policy.
We use privacy-enhanced mode through youtube-nocookie.com. This restricts the use of playback for personalisation; it does not prevent all data processing or storage access. Further information: Google privacy policy and YouTube embedding and privacy-enhanced mode.
Google describes different retention rules depending on the type of data: data may be kept until you delete it, for fixed periods, or longer for security and legal purposes. The actual period also depends on account and activity settings. No single retention period is given for all player data. Details and deletion options: Google retention rules.
Vimeo
The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. After consent, data processed may include your IP address, device and browser information, request data and playback data. Further recipients may include affiliated companies and appointed service providers. Processing serves, among other things, video delivery and security; if you are signed in or existing identifiers are present, links to previous usage may be possible.
We use the dnt=1 (“Do Not Track”) parameter. Vimeo still lists possible security cookies for this setting: _cf_bm with a lifetime of 30 minutes, _cfuvid until the session ends, player_clearance for seven days and cf_clearance for one year. Previously stored Vimeo cookies may still be sent with requests. DNT therefore does not mean that no cookies or personal data are processed. Details: Vimeo Player Cookies.
Vimeo does not specify a single server-side retention period for player data. It describes retention according to business or legal necessity, followed by deletion or anonymisation. Cookie lifetimes are distinct from these periods. Rights and deletion requests can be addressed to privacy@vimeo.com. Further information: Vimeo privacy policy.
Transfers to the United States and other countries
Loading the players may involve processing data in the United States and other countries. Google LLC has active certification under the EU–US Data Privacy Framework (DPF); Vimeo.com, Inc. also states that it participates. Where a transfer is covered by valid DPF certification, the European Commission’s adequacy decision under Article 45 GDPR provides the basis. Certification does not replace the consent obtained here for loading the video.
For transfers not covered by an adequacy decision, the providers refer, among other things, to EU Standard Contractual Clauses and, where necessary, additional safeguards under Article 46 GDPR. Information and access to the safeguards they describe: Google: international data transfers and Vimeo: international data transfers. Current participation status can be checked using the official DPF list.
Visitor statistics
For a general overview of how the website hosted by STRATO is used, we use the server-based access statistics included in our hosting package. These serve to evaluate usage in aggregate and improve our online offering. No additional tracking scripts or analytics cookies are added to the website for this purpose. Individual visitor profiles or links to our contact or project data are not envisaged.
The evaluation is based on access data generated during hosting, such as requested files, access times and technical browser information. STRATO describes the IP addresses or hostnames in the logs provided as anonymised. Where personal data is processed in preparing the statistics, Article 6(1)(f) GDPR is the proposed legal basis. Our legitimate interest is to understand usage of our offering in aggregate and improve its provision. The specific configuration and data protection assessment will be checked before publication.
According to STRATO, the access logs provided are available for six weeks. Graphical statistics can be accessed for several years; the period applicable to our package and the available settings will be confirmed before publication. We do not create our own long-term archives of access logs.
No additional analytics services such as Google Analytics are used. Any later extension will be decided separately; the privacy information and, where necessary, consent functions will be adapted before it is introduced. The local preview is not yet hosted by STRATO and therefore does not generate STRATO visitor statistics.
Your rights
Subject to the applicable legal conditions, you have the right to access information about the processing of your personal data and obtain a copy of it (Article 15 GDPR), to have inaccurate data rectified or incomplete data completed (Article 16 GDPR), and to have data erased (Article 17 GDPR). The right to erasure is not unrestricted, particularly where further processing is necessary to meet legal obligations or establish, exercise or defend legal claims.
Restriction of processing: Under Article 18 GDPR, you may request restriction, in particular while the accuracy of data you dispute is being checked, instead of erasure where processing is unlawful, where you need data we no longer require for legal claims, or while overriding grounds are being assessed following an objection. Restricted data may generally only be stored; further use is permitted only under the legal conditions.
Data portability: Where automated processing is based on your consent or a contract, you may, under the conditions of Article 20 GDPR, receive the personal data you have provided in a structured, commonly used and machine-readable format and transmit it to another controller. Where technically feasible, you may also request direct transmission. The rights and freedoms of others must not be adversely affected.
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then stop processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
You may object at any time to the processing of your personal data for direct marketing. The data will then no longer be processed for those purposes. This also applies to profiling insofar as it relates to such direct marketing.
Withdrawal of consent: You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal. To exercise your rights, please contact hello@schoeneneuefilme.de.
You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the country of your habitual residence, place of work or the alleged infringement. For private businesses based in Bavaria, the generally competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA).