Privacy Policy

This privacy policy informs you about the nature, scope, and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and its associated websites, functions, and content, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”). Regarding the terms used, such as “processing” or “controller,” we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

Controller
imagis Filmproduktion GmbH & Co. KG
Allee 82
74072 Heilbronn
Germany

Managing Directors: Michael Stadler, Joshua J. Krull

Imprint: https://imagis-fiction.de/impressum

Types of Processed Data
Inventory data (e.g., names, addresses).
Contact data (e.g., email, phone numbers).
Content data (e.g., text entries, photographs, videos).
Usage data (e.g., visited websites, interest in content, access times).
Meta/communication data (e.g., device information, IP addresses).
Categories of Affected Persons
Visitors and users of the online offering (hereinafter referred to collectively as “users”).

Purpose of Processing
Provision of the online offering, its functions, and content.
Responding to contact inquiries and communicating with users.
Security measures.
Audience measurement/marketing.
Definitions of Terms
Personal data: Any information relating to an identified or identifiable natural person.
Processing: Any operation or set of operations performed on personal data.
Pseudonymization: Processing personal data in such a way that it can no longer be attributed to a specific data subject without additional information.
Profiling: Any form of automated processing used to evaluate personal aspects of a natural person.
Controller: A person or organization determining the purposes and means of processing personal data.
Processor: A person or organization processing personal data on behalf of the controller.
Relevant Legal Basis
According to Article 13 GDPR, we inform you of the legal bases of our data processing. If no specific legal basis is mentioned, the following applies:

Consent: Article 6(1)(a) and Article 7 GDPR.
Performance of a contract: Article 6(1)(b) GDPR.
Legal obligations: Article 6(1)(c) GDPR.
Legitimate interests: Article 6(1)(f) GDPR.
Protection of vital interests: Article 6(1)(d) GDPR.
Security Measures
We take appropriate technical and organizational measures per Article 32 GDPR to ensure an adequate level of protection for the data we process. These measures include:

Ensuring confidentiality, integrity, and availability of data.
Controlling access to data.
Establishing procedures for data protection, including deletion and incident response.
Embedding data protection principles into technology and system design (Article 25 GDPR).
Collaboration with Processors and Third Parties
We disclose data to third parties only if legally permitted (e.g., necessary for contract fulfillment, based on consent, legal obligation, or legitimate interest). If we contract third parties for processing, this is based on a data processing agreement per Article 28 GDPR.

Transfers to Third Countries
Data transfers outside the EU/EEA occur only if necessary for contract fulfillment, with user consent, due to legal obligations, or legitimate interests. Such transfers occur under specific conditions per Articles 44 ff. GDPR, such as recognized data protection standards (e.g., EU-US Privacy Shield) or standard contractual clauses.

Rights of Data Subjects
You have the right to:

Request confirmation of data processing and access to your data (Article 15 GDPR).
Request rectification of incorrect or incomplete data (Article 16 GDPR).
Request deletion of data (Article 17 GDPR) or restriction of processing (Article 18 GDPR).
Receive your data in a structured, commonly used format (Article 20 GDPR).
Lodge a complaint with a supervisory authority (Article 77 GDPR).
Right of Withdrawal
You can withdraw consent at any time with future effect (Article 7(3) GDPR).

Right to Object
You can object to future data processing at any time, especially concerning direct marketing (Article 21 GDPR).

Cookies and Right to Object to Direct Advertising
Cookies are small files stored on users’ devices. We use temporary (session) cookies and persistent cookies for various functions, including analytics and marketing. Users can disable cookies in browser settings, though this may affect website functionality.

Deletion of Data
Data is deleted according to Articles 17 and 18 GDPR when no longer needed for its intended purpose and no legal retention obligations exist.

In Germany: Retention periods of 10 years (§147 AO, §257 HGB) and 6 years (§257 HGB).
In Austria: Retention periods of 7 years (§132 BAO) and up to 22 years for real estate transactions.
Business-Related Processing
We process contract and payment data from customers, prospects, and business partners for service provision, customer support, and marketing.

Google Analytics Privacy Policy
This website uses Google Analytics (based on Article 6(1)(f) GDPR). Google Analytics uses cookies to analyze website usage. Data collected includes browser type, OS, referrer URL, IP address (anonymized), and session times.
Users can disable Google Analytics tracking via browser settings or an opt-out link.

Agency Services
We process client data for consulting, campaign planning, software development, implementation, and analysis. Data includes contract, contact, payment, and usage data. Processing follows Articles 6(1)(b) and 6(1)(f) GDPR.

Administration, Financial Accounting, Office Organization, Contact Management
We process data for administrative purposes, including financial accounting and legal obligations. Data may be shared with tax authorities, accountants, and payment processors.

Business Analytics and Market Research
We analyze business activities and trends based on inventory, communication, contract, and usage data. Processing is based on Article 6(1)(f) GDPR.

Providing Our Statutory and Business-Related Services
We process data from members, supporters, customers, and others per Articles 6(1)(b) and 6(1)(f) GDPR for administrative and public relations purposes.

Comments and Contributions
User IP addresses are stored for security purposes (Article 6(1)(f) GDPR). Data is retained indefinitely unless users request deletion.

Contacting Us
User inquiries are processed under Articles 6(1)(b) and 6(1)(f) GDPR. Inquiries are deleted when no longer needed.

Hosting and Email Services
Hosting services involve processing user data for website operations (Article 6(1)(f) GDPR and Article 28 GDPR).

Log Files and Access Data
Server log files store access data for security purposes (max 7 days).

Social Media Presence
We manage social media profiles to interact with customers and users, following platform-specific policies.

Embedding Third-Party Services and Content
We use third-party content (e.g., videos, fonts) based on legitimate interests (Article 6(1)(f) GDPR).

YouTube (Google LLC)
Google Fonts (Google LLC)
Google Maps (Google LLC)
Facebook Social Plugins (Facebook Ireland Ltd.)
Facebook data collection can be managed via privacy settings or cookie controls.