privacy policy

Scope of application

This privacy policy applies to all personal data processed within our company and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as an individual's name, email address, and postal address. Processing personal data ensures that we can provide and invoice our services and products, whether online or offline. The scope of this privacy policy covers:

• all online presences (websites) operated by us
• Social media presence and email communication

In short: this privacy policy applies to all areas in which personal data is processed within the company in a structured manner via the aforementioned channels. Should we enter into a legal relationship with you outside these channels, we will notify you separately where appropriate.

Legal bases

In the following privacy policy, we provide transparent information on the legal principles and provisions – namely the legal bases under the General Data Protection Regulation – that permit us to process personal data. Regarding EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can review this EU General Data Protection Regulation online via EUR-Lex, the access point to EU law, at https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

• Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the details you entered into a contact form.
• Contract (Article 6(1)(b) GDPR): We process your data in order to fulfil a contract or pre-contractual obligations with you. For example, if we enter into a production agreement with you, we require personal information in advance.
• Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally required to retain invoices for accounting purposes. These typically contain personal data.
• Legitimate interests (Article 6(1)(f) GDPR): Where legitimate interests do not override your fundamental rights, we reserve the right to process personal data. For instance, we must process certain data to operate our website securely and with commercial efficiency. Such processing therefore constitutes a legitimate interest.

Other grounds, such as processing in the public interest, the exercise of official authority, or the protection of vital interests, do not generally apply to us. Should any such legal basis nevertheless be relevant, it will be stated in the appropriate section.

In addition to EU regulations, national laws also apply: In Austria, this is the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Datenschutzgesetz), abbreviated to DSG. In Germany, the Federal Data Protection Act (BDSG) applies. Should any other regional or national laws be applicable, we will inform you in the following sections.

Contact details of the controller

Should you have any questions regarding data protection or the processing of personal data, please find the contact details of the responsible controller below:

Retention period

As a general principle, we only retain personal data for as long as is strictly necessary to provide our services and products. This means we delete personal data as soon as the reason for processing it no longer applies. In certain cases, we are legally required to retain specific data even after the original purpose has ceased, for instance for accounting purposes.

Should you request the erasure of your data or withdraw your consent to data processing, the data will be deleted as promptly as possible, provided there is no statutory obligation to retain it.

We will inform you below regarding the specific duration of the respective data processing, where further information is available.

Rights under the General Data Protection Regulation (GDPR)

Pursuant to Articles 13 and 14 GDPR, we inform you of the following rights available to you to ensure fair and transparent data processing:

• Under Article 15 GDPR, you have the right of access to ascertain whether we process your data. If this is the case, you have the right to receive a copy of the data and to learn for what purpose we carry out the processing, which categories of data are processed, who receives this data and – if the data is transferred to third countries – how security can be guaranteed, how long the data will be stored, that you have the rights to rectification, erasure, restriction, and objection, that you may lodge a complaint with a supervisory authority, where the data originates from if we did not collect it directly from you, and whether profiling is carried out.
• Under Article 16 GDPR, you have the right to rectification of data, meaning that we must correct data if you discover any errors.
• Under Article 17 GDPR, you have the right to erasure ('right to be forgotten'), which specifically means that you may request the deletion of your data.
• Under Article 18 GDPR, you have the right to restriction of processing, meaning that we are only permitted to store the data, not use it any further.
• Under Article 20 GDPR, you have the right to data portability, meaning that we will provide your data to you in a standard format upon request.
• Under Article 21 GDPR, you have the right to object, which, once exercised, entails a modification of the processing. If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then examine as swiftly as possible whether we can legally comply with this objection. If data is used for direct advertising, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing.
• Under Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (such as profiling).
• Under Article 77 GDPR, you have the right to lodge a complaint. This means that you can lodge a complaint with the data protection authority at any time if you believe that the processing of personal data breaches the GDPR.

In short: you have rights – do not hesitate to contact our designated controller listed above!

If you believe that the processing of your data violates data protection law or that your legal data protection rights have been infringed in any other way, you may lodge a complaint with the supervisory authority. For Austria, this is the Data Protection Authority (Datenschutzbehörde), whose website can be found at https://www.dsb.gv.at/. In Germany, there is a data protection commissioner for each federal state. For further details, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local supervisory authority is responsible for our company:

Austrian Data Protection Authority (Datenschutzbehörde)

Barichgasse 40–42, 1030 Vienna · Phone: +43 1 52 152-0 · Email: dsb@dsb.gv.at · Website: https://www.dsb.gv.at/

Communication

Data subjects

Anyone who communicates with us by telephone, email, or online form

Processed data

e.g. telephone number, name, email address, submitted form data. You can find more details under the respective contact method used

Purpose

Handling communication with clients, business partners, etc.

Retention period

Duration of the business transaction and statutory retention requirements

Legal bases

Art. 6(1)(a) GDPR (Consent), Art. 6(1)(b) GDPR (Contract), Art. 6(1)(f) GDPR (Legitimate interests)

When you contact us and communicate via telephone, email, or an online form, personal data may be processed. This data is processed to handle and respond to your enquiry and manage the associated business matter. The data is retained for the duration required or as long as mandated by law.

Data subjects

All persons who contact us via the communication channels we provide are affected by the aforementioned procedures.

Phone

When you call us, call details are stored pseudonymously on the respective end device and by the telecommunications provider used. In addition, details such as your name and telephone number may subsequently be sent via email and stored to answer your enquiry. The data will be deleted as soon as the business matter has been concluded and legal requirements allow.

To ensure your enquiry reaches us via email, these details are additionally forwarded to our inbox via the form service Formspree (Formspree Inc., USA). Processing to handle your enquiry is carried out pursuant to Art. 6(1)(b) GDPR for contractual or pre-contractual enquiries, or otherwise pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries. Formspree processes data in the USA. Information on international transfers and data protection can be found at https://formspree.io/legal/privacy-policy. The data processing terms and transfer safeguards applicable to our contractual relationship must also be taken into account.

Email

When you communicate with us by email, data may be stored on the respective end device (computer, laptop, smartphone, etc.) as well as on the email server. The data will be deleted as soon as the business matter has been concluded and legal requirements allow.

Contact form

When you message us via the contact form on this website, we store your name, email address, telephone number (if provided), message, timestamp of the enquiry, and the page from which the enquiry was sent in our website's database. Access is strictly limited to us. To protect against automated spam submissions, we use an invisible honeypot field; no external captcha service is employed. The data will be deleted as soon as the business matter has concluded and legal requirements permit.

Legal bases

Data processing is based on the following legal bases:

• Art. 6(1)(a) GDPR (Consent): You grant us consent to store your data and use it further for purposes relevant to the business transaction;
• Art. 6(1)(b) GDPR (Contract): Processing is necessary for the performance of a contract with you or a data processor, such as a telephone provider, or we need to process data for pre-contractual measures, such as preparing a quotation;
• Art. 6(1)(f) GDPR (Legitimate interests): We aim to manage client enquiries and business communications in a professional manner. Certain technical resources, such as email clients, servers, and mobile network providers, are necessary to conduct communication efficiently.

Data Processing Agreement (DPA)

In this section, we would like to explain what a data processing agreement is and why it is required. Because the German term “Auftragsverarbeitungsvertrag” is quite a mouthful, we will often refer to it using the acronym DPA (or AVV). Like most businesses, we do not work entirely on our own, but also rely on services provided by other companies or individuals. By engaging various service providers, we may share personal data for processing. These partners then act as processors with whom we enter into an agreement known as a Data Processing Agreement (DPA). Most importantly for you, your personal data is processed strictly according to our instructions and must be governed by this DPA.

Who are data processors?

As a company and website owner, we are responsible for all data we process from you. Alongside controllers, there may also be data processors. This includes any company or individual processing personal data on our behalf. More precisely, under the GDPR definition: any natural or legal person, public authority, agency, or other body processing personal data on our behalf is considered a data processor. Data processors may therefore include service providers such as hosting or cloud platforms.

For better clarity of terms, here is an overview of the three roles under the GDPR: Data subject (you as a client or prospective client) → Data controller (we as the company and commissioning party) → Data processor (service providers such as web hosts or cloud providers).

Content of a Data Processing Agreement

As mentioned above, we have entered into a Data Processing Agreement (DPA) with our partners acting as data processors. This primarily stipulates that the processor processes the data exclusively in accordance with the GDPR. The agreement must be concluded in writing, although electronic conclusion is also deemed "in writing" in this context. Personal data is only processed on the basis of this agreement. The agreement must include the following:

• Commitment to us as the controller
• Obligations and rights of the controller
• Categories of data subjects
• Categories of personal data
• Nature and purpose of data processing
• Subject matter and duration of data processing
• Location of data processing

Furthermore, the agreement contains all obligations of the data processor. The main obligations are:

• To ensure data security measures
• take appropriate technical and organisational measures to protect the rights of data subjects
• maintain a record of processing activities
• to cooperate with the data protection supervisory authority upon request
• conduct a risk assessment regarding the personal data received
• Sub-processors may only be engaged with the written permission of the controller

To see what such a DPA looks like in practice, you can visit https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html, where a model agreement is provided.

Cookies and local storage

Data subjects

Website visitors

Deployment

Essential consent storage; optional analytics and external media only with your consent

Legal basis

Section 165 (3) TKG 2021 and Art. 6 (1) lit. f GDPR (Legitimate Interests) for technically necessary storage

Cookies are small text files that a website stores in your browser. In accordance with Section 165(3) TKG 2021 (Telecommunications Act), we only employ technically non-essential storage or access following your informed consent. Optional analysis via Google Analytics 4 as well as external video players remain disabled without consent; no Google Analytics signals are sent without prior consent.

We store your consent decision under filmfalt-consent in your browser's localStorage, including the date, consent version, and your preferences for statistics and external media. The provider is FILMFALT Media e.U.; the purpose is to remember and implement your choices. This necessary storage relies on the exemption for strictly requested services under Section 165(3) TKG 2021 and Article 6(1)(f) GDPR. We will request your consent again after twelve months or if a new consent version is introduced. In the administration area, necessary storage for authentication remains in place.

You can change your selection at any time or withdraw your consent with effect for the future via the cookie settings in the footer. If consent for statistics is withdrawn, we stop analytics, delete accessible first-party GA cookies, and reload the page. Data processing carried out prior to revocation remains unaffected. We cannot delete third-party cookies on external domains ourselves; you can remove these via your browser.

When playing embedded videos from YouTube or Vimeo, the respective providers may place their own cookies or similar technologies in your browser. Details can be found in the "Audio & Video" section.

You can manage, delete, or disable cookies in your browser at any time. How this works depends on your browser: Chrome, Safari, Firefox, and Microsoft Edge each provide instructions in their respective help sections.

Google Analytics 4

We use Google Analytics 4 exclusively following your consent to statistics (Article 6(1)(a) GDPR and Section 165(3) TKG 2021). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is the statistical evaluation of page views and successful contact enquiries. We do not transmit form contents, name, email address, or telephone number to Analytics.

Prior to your consent, gtag.js is not loaded and no connection is established to Google Analytics or Google Tag Manager. Under Google Consent Mode v2, analytics_storage, ad_storage, ad_user_data, and ad_personalization are denied by default. Upon consent, only analytics_storage is granted; Google Signals and ad personalisation are disabled in the website configuration.

The website limits the lifespan of analytics cookies (_ga and _ga_…) to 60 days without automatic renewal. For user- and event-level data, a retention period of two months must be configured in GA4 Admin. This account setting cannot be defined via website code and must be confirmed by the controller; standard aggregated reports are not subject to this retention limit.

During use, online identifiers, IP address, device information, and page views, in particular, may be transmitted to Google. Processing in the USA is possible. For transfers to the certified Google LLC, the adequacy decision for the EU-US Data Privacy Framework applies; in addition, the relevant EU Standard Contractual Clauses may apply. Further information: https://policies.google.com/privacy?hl=en and https://support.google.com/analytics/answer/7667196.

You can withdraw your consent at any time via the cookie settings in the footer. Analytics will then be stopped, and accessible first-party analytics cookies will be deleted. The lawfulness of processing prior to withdrawal remains unaffected.

Web hosting

Data subjects

Website visitors

Purpose

professional website hosting and operational security

Processed data

IP address, time of website visit, browser used, and other data. Further details can be found below

Retention period

depending on the respective provider, but generally 2 weeks

Legal bases

Art. 6(1)(f) GDPR (Legitimate interests)

What is web hosting?

When visiting websites today, certain information—including personal data—is automatically generated and stored, as is the case on this website. This data should be processed as sparingly as possible and only with valid justification. By website, we mean the entirety of all web pages under a domain, i.e. everything from the homepage to the very last subpage (such as this one).

To display the website, your browser must connect to another computer where the website's code is stored: the web server. Operating a web server is a complex and demanding task, which is why it is usually handled by professional hosting providers. They provide web hosting and thereby ensure reliable, error-free storage of website data. When the browser establishes a connection and during data transmission to and from the web server, personal data may be processed.

Our hosting and cloud service providers

This website, its database (e.g. for contact enquiries, blog posts, and projects), as well as image and video files, are hosted with professional hosting and cloud service providers acting on our behalf. The website is delivered via a global content delivery network (CDN) to ensure fast and secure page loading. As part of this process, data may also be processed on servers outside the EU, particularly in the US. In this case, the transfer is carried out based on the European Commission's adequacy decision for the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).

Why do we process personal data?

The purposes of data processing are:

• Professional website hosting and operational security
• to maintain operational and IT security
• Anonymous analysis of access behaviour to improve our services and, where necessary, for criminal prosecution or the enforcement of legal claims

What data is processed?

Even as you visit our website right now, our web server—the computer hosting this website—typically stores data automatically, such as

• the complete web address (URL) of the accessed webpage
• Browser and browser version (e.g. Chrome 87)
• the operating system used (e.g. Windows 10)
• the address (URL) of the previously visited page (referrer URL)
• the host name and IP address of the accessing device
• Date and time
• in files known as web server log files

How long is data stored?

As a rule, the aforementioned data is stored for two weeks and automatically deleted thereafter. We do not disclose this data, but we cannot rule out that public authorities may inspect it in the event of unlawful conduct.

In short: your visit is logged by our hosting provider (the company running our website on dedicated servers), but we will never share your data without your consent!

Legal basis

The lawfulness of processing personal data in the context of web hosting arises from Art. 6(1)(f) GDPR (safeguarding legitimate interests), as the use of professional hosting with a third-party provider is necessary to present the company online securely and user-friendly, and to pursue any attacks or claims arising therefrom if required.

A Data Processing Agreement pursuant to Article 28 et seq. GDPR has been established between us and the hosting provider, ensuring compliance with data protection laws and guaranteeing data security.

Fonts

The fonts used on this website are loaded directly from our own server. No connection to Google Fonts or other third-party font providers is established, and no data is transmitted to third parties for this purpose.

Audio & Video

Data subjects

Website visitors

Purpose

Optimising our service – presenting our films directly on the website

Processed data

Information about your device and your IP address; during playback, potentially user behaviour data. Further details can be found below

Retention period

Data is generally retained for as long as necessary for the purpose of the service

Legal bases

Art. 6(1)(f) GDPR (Legitimate interests), Art. 6(1)(a) GDPR (Consent), insofar as you actively start a video

What are audio and video elements?

We have integrated video elements into our website so you can watch our films directly on the site. This content is provided by service providers and retrieved from their servers. These are embedded functional elements from the platforms YouTube and Vimeo. When you interact with these elements, your personal data may also be transmitted to, processed by, and stored by these service providers.

Why do we use video elements on our website?

As a film production company, we showcase our work best through moving images. Rather than simply giving you a link to a video, we embed our films directly on our website.

How videos are embedded on our website

• Some page headers display a muted background video from YouTube. This is only loaded after you consent to external media; until then, the existing still image remains visible. We use youtube-nocookie.com (privacy-enhanced mode). Even in this mode, your IP address and technical information are transmitted to Google once loaded; it does not mean that no data processing or storage takes place.
• The preview thumbnails for our films are provided via our website hosting. Viewing the preview thumbnail does not establish a connection to YouTube or Vimeo.
• We only load YouTube and Vimeo players once you have consented to External Media. Without this consent, clicking on a film displays a notice alongside the option to open the cookie settings. Provider, purpose, and storage are explained there. Once enabled, the respective provider may use cookies or similar technologies and collect user behaviour data.
• Our own videos hosted directly on our website are delivered by our hosting provider without any data being transferred to YouTube or Vimeo.

YouTube

The provider for the European region is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process data in the USA; transfers are carried out on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. You can find out more about data processing in Google's privacy policy at https://policies.google.com/privacy?hl=en.

Vimeo

The provider is Vimeo.com, Inc. (330 West 34th Street, 5th Floor, New York, New York 10001, USA). Transfers to the USA are carried out on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. You can find out more about data processing at https://vimeo.com/privacy.

Duration of data processing

For details on the precise retention period of data stored on third-party servers, please refer to the respective provider's privacy policy. In principle, personal data is only processed for as long as strictly necessary to deliver the services. Some cookies are deleted immediately after leaving the website, whereas others may remain stored in your browser for several years.

Right to object

You have the right to object to data processing at any time. You can prevent data collection by cookies by managing, disabling, or deleting cookies in your browser. The lawfulness of processing carried out prior to withdrawal remains unaffected.

Legal basis

For our own videos hosted on our servers, Art. 6(1)(f) GDPR applies. External video players are loaded solely upon your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. Simply clicking a film tile does not constitute such consent. You may withdraw your consent at any time via the cookie settings in the footer.

Google Reviews

We display our average Google rating and review count on our website. Our server retrieves these figures directly from Google; no data relating to you as a visitor is transmitted to Google in the process.

Google Maps will only open once you click the link to our Google profile, at which point the privacy policy of Google Ireland Limited applies, which can be found at https://policies.google.com/privacy?hl=de.

Links to social media profiles

Our website includes links to our profiles on Facebook, LinkedIn, and YouTube. These are standard links—no social media plug-ins are embedded, and simply visiting our website does not transmit any data to these networks.

You will only be redirected to the respective provider's website once you click one of these links. From that point on, their privacy policy applies:

• Facebook (Meta Platforms Ireland Limited): https://www.facebook.com/privacy/policy/
• LinkedIn (LinkedIn Ireland Unlimited Company): https://www.linkedin.com/legal/privacy-policy
• YouTube (Google Ireland Limited): https://policies.google.com/privacy?hl=en

Explanation of terms used

We consistently strive to make our Privacy Policy as clear and accessible as possible. However, this is not always straightforward, especially when dealing with technical and legal matters. It is often necessary to use legal terms (such as personal data) or specific technical terminology. Rather than simply using these terms, we aim to explain them clearly.

Data processors

Within the meaning of the GDPR (Art. 4), the term “processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. Explanation: This includes any company or individual that processes personal data on our behalf – such as hosting or cloud service providers.

Consent

Within the meaning of the GDPR (Art. 4), “consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Personal data

Within the meaning of the GDPR (Art. 4), “personal data” means any information relating to an identified or identifiable natural person. Explanation: Personal data is therefore any data that can identify you as an individual – such as your name, address, email address, or phone number. According to the European Court of Justice (CJEU), your IP address also counts as personal data.

Profiling

Within the meaning of the GDPR (Art. 4), “profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate, analyse, or predict certain personal aspects relating to a natural person. We do not engage in profiling.

Data controller

Within the meaning of the GDPR (Art. 4), the term “controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Explanation: In our case, we are responsible for processing your personal data.

Processing

Within the meaning of the GDPR (Art. 4), “processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Closing remarks

It is important to us to inform you about the processing of personal data to the best of our knowledge and belief. In doing so, we not only want to let you know which data is processed, but also explain the reasons for using various software applications. If you have any questions, please feel free to contact us.