The protection of your personal data is important to us. We process your data in accordance with the applicable national and European data protection legislation. To ensure that you understand what data we process, for what purposes, and what rights you have in this regard, we would like to inform you about our data processing practices.
1. Data Controller
The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection provisions is:
Studio Hamburg GmbH
Jenfelder Allee 80
22045 Hamburg
Germany
Phone: 004940 6688-0
Email: info@studio-hamburg.de
2. Data Protection Officer
The controller’s Data Protection Officer is:
Studio Hamburg GmbH
Data Protection Officer
Jenfelder Allee 80
22045 Hamburg
Germany
Email: datenschutz@studio-hamburg.de
3. General Information on Data Processing
a) Scope of the Processing of Personal Data
As a general rule, the controller collects and processes users’ personal data only to the extent necessary to provide a functional website and its content and services. Users’ personal data is generally collected and used only with their consent. An exception applies where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.
b) Legal Basis for the Processing of Personal Data
Where the controller obtains the consent of the data subject for processing personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to take steps prior to entering into a contract. Where the processing of personal data is necessary for compliance with a legal obligation to which the controller’s company is subject, Article 6(1)(c) GDPR serves as the legal basis. Where the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis. Where processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, and those interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR serves as the legal basis for processing.
c) Data Erasure and Storage Period
The personal data of the data subject will be erased or restricted as soon as the purpose for which it was stored no longer applies. Data may be stored for longer if this is required under provisions of European Union or national law, regulations, or other rules to which the controller is subject. Data will also be restricted or erased when a statutory retention period expires, unless further storage is necessary for the conclusion or performance of a contract.
4. Data Processing on Behalf of the Controller and Data Security
On the basis of separate written agreements, the controller also engages service providers to process personal data on its behalf in accordance with Article 28 GDPR. This does not constitute a transfer of your personal data to third parties within the meaning of data protection law. The controller remains responsible to you for compliance with data protection requirements. Employees of the processors are obliged to maintain the confidentiality of your data to the same extent as the controller’s own employees. They are subject to the controller’s instructions. The controller ensures that all technical and organisational security measures required by law are implemented to protect your personal data against loss and misuse. Your personal data is stored in secure operating environments and is accessible to the processors’ employees only to the extent strictly necessary to fulfil their contractual duties.
5. Accessing This Website
As a general rule, the controller collects and uses users’ personal data only to the extent necessary to provide a functional website and the controller’s content and services. Whenever this website is accessed, the controller’s system automatically collects the following data from the computer system of the accessing device and stores it in log files: name of the file accessed, date and time of access, amount of data transferred, notification of successful retrieval, type and version of your browser, user’s IP address, user’s operating system, user’s internet service provider, websites from which the user’s system accessed this website, and websites accessed by the user’s system via this website. This data is not combined with data from other sources. The legal basis for collecting and storing this data in log files is Article 6(1)(f) GDPR. The temporary collection of this data by the system is necessary to deliver the website to the user’s computer and ensure that it can be displayed correctly. Storing the data in log files also serves to maintain the stability and functionality of the website. In addition, the data is used to optimise the website and protect the controller’s information technology systems against potential external attacks. These purposes also constitute the controller’s legitimate interest in processing the data under Article 6(1)(f) GDPR. The data is erased as soon as it is no longer necessary to fulfil the purpose for which it was collected. Data collected to provide the website is erased at the end of the respective session. Data stored in log files is erased after no more than seven days. Longer storage is possible. In such cases, users’ IP addresses are erased or anonymised so that the accessing device can no longer be identified. The collection of data to provide the website and its storage in log files are essential for operating the website, meaning that users have no right to object to this processing.
6. Contact Options
You can contact the controller via an online contact form or by email through this website. Personal data submitted to the controller through the contact form or by email (e.g. name, address, or email address) is used exclusively to process users’ enquiries. The data is not passed on to third parties. The legal basis for processing data submitted via the contact form, following the user’s consent, is Article 6(1)(a) GDPR. The legal basis for processing data submitted by email is Article 6(1)(f) GDPR. The purposes described above also constitute the controller’s legitimate interest in processing the data under Article 6(1)(f) GDPR. The data is erased as soon as it is no longer necessary to fulfil the purpose for which it was collected. This is the case when the relevant enquiry has been fully dealt with and it can be concluded from the circumstances that the matter has been definitively resolved. Users may withdraw their consent to the processing of their personal data at any time and may object to the storage of personal data submitted to the controller by email. In such cases, the conversation cannot be continued. Users can contact the address specified in Section 1 for this purpose. All personal data stored in connection with the contact request will then be erased.
7. Newsletter
This website offers the option to subscribe to a free newsletter. When registering for the newsletter, the data entered in the registration form is transmitted to the controller. The following additional data is also collected during registration: the IP address of the accessing device and the date and time of registration. During the registration process, your consent to the processing of your data is obtained, and reference is made to this Privacy Policy. Data processed for the purpose of sending newsletters is not passed on to third parties. The data is used exclusively to send the newsletter. Where the user has given consent, the legal basis for processing data following newsletter registration is Article 6(1)(a) GDPR. The user’s email address is collected to deliver the newsletter. Other personal data collected during registration is used to prevent misuse of the services or the email address used. The data is erased as soon as it is no longer necessary to fulfil the purpose for which it was collected. Accordingly, the user’s email address is stored for as long as the newsletter subscription remains active. Other personal data collected during registration is generally erased after seven days. Users may cancel their newsletter subscription at any time without incurring any costs other than the standard transmission charges. A notification in text form sent to the contact details listed in Section 1 is sufficient (e.g. by email, fax, or letter). Each newsletter also contains a link that allows you to unsubscribe. This also enables you to withdraw your consent to the storage of personal data collected during registration.
8. Job Applications
The controller collects and processes applicants’ personal data for the purpose of managing the recruitment process. This processing may also take place electronically, particularly where applicants submit their application documents electronically, for example by email or via a form on this website. Please also refer to the service provider’s Privacy Policy on the relevant form page. If an employment contract is concluded with an applicant, the submitted data will be stored for the purpose of managing the employment relationship in compliance with statutory requirements. If no employment contract is concluded, the application documents will be automatically erased two months after the applicant has been notified of the rejection, unless other legitimate interests of the controller prevent their deletion. An example of such a legitimate interest is the need to retain evidence for proceedings under the German General Equal Treatment Act (AGG).
9. Cookies
This website uses cookies. Cookies are text files stored in or by your internet browser on your computer system. When you visit a website, a cookie may be stored on your operating system. This cookie contains a distinctive string of characters that allows the browser to be uniquely identified when the website is accessed again. The controller uses cookies to make this website more user-friendly. Certain elements of the website require the accessing browser to be recognised even after navigating to another page. Cookies store and transmit the following data: language settings and login information. The purpose of using technically necessary cookies is to make websites easier for users to use. Some website functions cannot be provided without cookies. These functions require the browser to be recognised again after navigating to another page. The controller uses cookies for the following purposes: applying language settings and remembering search terms. User data collected through technically necessary cookies is not used to create user profiles. The legal basis for processing personal data using cookies is Article 6(1)(f) GDPR. Cookies are stored on your computer and transmitted from it to this website. As a user, you therefore have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing your internet browser settings. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for this website, some website functions may no longer be available in full.
10. Links
This website contains links to third-party online services over which the controller has no control and for which it therefore cannot accept responsibility for data protection or content. Please read the privacy policies of the online services you access via this website.
11. Use of Plugins and Other Tools
a) YouTube
The controller has integrated YouTube components into this website. YouTube is an online video platform that allows video publishers to upload video clips free of charge and enables other users to view, rate, and comment on them, also free of charge. YouTube permits the publication of all types of videos, including full-length films and television programmes, music videos, trailers, and videos created by users themselves. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Whenever a user accesses an individual page of this website operated by the controller that contains an integrated YouTube component (YouTube video), the relevant YouTube component automatically causes the user’s browser to download a display of that component from YouTube. Further information about YouTube is available at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google learn which specific subpage of this website the user has visited. If the user is logged in to YouTube at the same time, YouTube recognises which specific subpage of this website the user visits when they access a page containing a YouTube video. This information is collected by YouTube and Google and associated with the user’s YouTube account. Whenever a user is logged in to YouTube while accessing this website, YouTube and Google receive information through the YouTube component that the user has visited this website, regardless of whether the user clicks on a YouTube video. If the user does not want this information to be transmitted to YouTube and Google, they can prevent the transmission by logging out of their YouTube account before visiting this website. YouTube’s published privacy policy, available at https://www.google.de/intl/de/policies/privacy/, provides information about the collection, processing, and use of personal data by YouTube and Google.
b) Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google uses cookies, which are text files. The information generated by the cookie about users’ use of this website is generally transmitted to and stored on a Google server in the USA. Google is certified under the Privacy Shield framework and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). Google will use this information on behalf of the controller to evaluate users’ use of the controller’s online services, compile reports on activity within these services, and provide the controller with other services relating to the use of these online services and internet usage. Pseudonymous usage profiles may be created from the processed data. The controller uses Google Analytics only with IP anonymisation enabled. This means that Google truncates users’ IP addresses within Member States of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The IP address transmitted by the user’s browser is not combined with other Google data. Google Analytics is used to analyse and optimise this online service and to operate it efficiently. This also constitutes the controller’s legitimate interest in processing the data under Article 6(1)(f) GDPR. You can prevent cookies from being stored by changing the settings in your browser software. You can also prevent Google from collecting data generated by cookies and relating to your use of this online service, as well as from processing this data, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de
Further information about Google’s use of data and the available settings and objection options can be found on Google’s websites: https://www.google.com/intl/de/policies/privacy/partners – “How Google uses data when you use our partners’ sites or apps” http://www.google.com/policies/technologies/ads – “How Google uses data for advertising” http://www.google.de/settings/ads – “Manage the information Google uses to show you ads”
c) Web Fonts
The controller has integrated components from fonts.com into this website. Fonts.com enables fonts to be displayed using external fonts known as web fonts. Fonts.com is operated by Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA. Whenever a user accesses an individual page of this website operated by the controller, the fonts.com component automatically causes the user’s browser to download data from www.fonts.com. As part of this technical process, fonts.com learns that the website has been visited and which specific page has been accessed by the user’s device. Fonts.com also receives the IP address assigned by the user’s internet service provider (ISP), the browser type, the browser language, the website visited immediately before this website, and the date and time of the visit. The data and information transmitted to fonts.com in this way enable fonts.com itself, as well as its affiliated companies and partner companies, to target visitors to the controller’s websites with personalised, interest-based advertising. The applicable privacy policy for fonts.com can be found at http://www.monotype.com/de/rechtshinweise/datenschutzrichtlinie/.
d) Google Web Fonts
To ensure that content is displayed correctly across different browsers and presented in an attractive visual format, the controller uses script libraries and font libraries such as Google Web Fonts (https://www.google.com/webfonts/) https://fonts.google.com/ on this website. Google Web Fonts are transferred to your browser cache to prevent fonts from being loaded repeatedly. If your browser does not support Google Web Fonts or blocks access to them, content will be displayed in a standard font. Accessing script libraries or font libraries automatically establishes a connection to the library operator. In theory, the operator of the relevant library may collect data, although it is currently unclear whether this occurs and, if so, for what purposes. Google’s privacy policy is available here: https://www.google.com/policies/privacy/
e) Google Maps
This website uses the Google Maps API to display geographical information visually. When using Google Maps, Google also collects, processes, and uses data relating to visitors’ use of the map functions. Further information about data processing by Google can be found in Google’s privacy policy: https://www.google.com/policies/privacy/ You can also change your personal privacy settings in Google’s Privacy Centre.
12. Your Rights
a) Right of Access under Article 15 GDPR
You have the right to request confirmation from the controller as to whether personal data concerning you is being processed. If such processing is taking place, you may request information from the controller about the following: the purposes for which the personal data is processed; the categories of personal data being processed; the recipients or categories of recipients to whom your personal data has been or will be disclosed; the intended period for which your personal data will be stored or, if specific information is not available, the criteria used to determine that period; the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller, or a right to object to such processing; the existence of a right to lodge a complaint with a supervisory authority; any available information about the source of the data if the personal data was not collected directly from you; and the existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and intended consequences of such processing for you. You also have the right to request information about whether your personal data is transferred to a third country or an international organisation. In this context, you may request information about the appropriate safeguards under Article 46 GDPR relating to the transfer.
b) Right to Rectification under Article 16 GDPR
You have the right to request the rectification and/or completion of your personal data from the controller if the data being processed concerning you is inaccurate or incomplete. The controller must make the correction without undue delay.
c) Right to Erasure under Article 17 GDPR
You may request that the controller erase your personal data without undue delay, and the controller is obliged to erase it without undue delay if one of the following grounds applies: the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; you withdraw your consent on which the processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing; you object to the processing under Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing under Article 21(2) GDPR; the personal data has been processed unlawfully; the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject; or the personal data was collected in relation to information society services under Article 8(1) GDPR. If the controller has made your personal data public and is obliged to erase it under Article 17(1) GDPR, the controller shall take reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing the personal data that you, as the data subject, have requested the erasure of all links to, copies of, or replications of that personal data. The right to erasure does not apply where processing is necessary: to exercise the right to freedom of expression and information; to comply with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health under Article 9(2)(h) and (i) and Article 9(3) GDPR; for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes under Article 89(1) GDPR, insofar as the right referred to in paragraph 1 of this section is likely to render impossible or seriously impair the achievement of the objectives of that processing; or for the establishment, exercise, or defence of legal claims.
d) Right to Restriction of Processing under Article 18 GDPR
You may request restriction of the processing of your personal data under the following conditions: if you contest the accuracy of your personal data, for a period enabling the controller to verify its accuracy; if the processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead; if the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defence of legal claims; or if you have objected to processing under Article 21(1) GDPR and it has not yet been established whether the controller’s legitimate grounds override your own. Where the processing of your personal data has been restricted, such data may, apart from being stored, be processed only with your consent or for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. If processing has been restricted under the conditions described above, the controller will inform you before the restriction is lifted.
e) Right to Be Informed under Article 19 GDPR
If you have exercised your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of the rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.
f) Right to Data Portability under Article 20 GDPR
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR, and the processing is carried out by automated means. In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This right must not adversely affect the rights and freedoms of others. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
g) Right to Withdraw Consent under Article 7(3) GDPR
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
h) Right to Lodge a Complaint with a Supervisory Authority under Article 77 GDPR
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the Data Protection Commissioner for Broadcasting of ARD, ZDF, and Deutschlandradio if you believe that the processing of your personal data infringes the GDPR. The supervisory authority will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.
i) Right to Object under Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions. The controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. In connection with the use of information society services, you may exercise your right to object by automated means using technical specifications, notwithstanding Directive 2002/58/EC. You also have the right to object, on grounds relating to your particular situation, to the processing of your personal data for scientific or historical research purposes or statistical purposes under Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out in the public interest.
13. Amendments to This Privacy Policy
The controller reserves the right to amend this Privacy Policy at any time to ensure that it complies with current legal requirements. This also applies if this Privacy Policy needs to be updated due to new or revised services. The new Privacy Policy will apply the next time you visit this website.