We are pleased that you are visiting our website and would like to thank you for your interest. Protecting the privacy of our website visitors’ personal data is a key concern of ours, which is why we ask you to kindly take note of the information provided be-low.
In the following provisions we inform you about the collection, processing and use of your personal data in connection with your visit and use of the service offer on our website.
This Data Privacy Statement can be stored and printed.

1. Controller/ Data Protection Officer
1.1. Controller

The controller of the data collection, data processing and data use is the opera-tor of the website www.animationproductiondays.de:
Film- und Medienfestival gGmbH
Stephanstr. 33
D-70173 Stuttgart, Germany
Tel: +49-(0)711-92546-0
Fax: +49-(0)711-92546-150
E-mail: kontakt@festival-gmbh.de

1.2. Data Protection Officer

The contact data of the Data Protection Officer is:
Thomas Lang
Oberer Kirchhaldenweg 9 b
70195 Stuttgart
datenschutz@festival-gmbh.de

2. Basic principles

We collect and process your personal data in compliance with the relevant statutory regulations, in particular with the General Data Protection Regulation (hereinafter referred to as: “GDPR”) and with the provisions of the German Federal Data Protection Act (hereinafter referred to as: “BDSG”) and in accord-ance with the provisions set out below.

3. Terminology

3.1. Personal Data

The term personal data means any information relating to an identified or identifiable natural person. This includes, for example, name, address, telephone number, e-mail address, IP address, user name, password, and information on the websites which have been viewed by a visitor.

3.2. Data subject

The data subject is every identified or identifiable natural person whose personal data is processed by the controller responsible for the processing or by a processor on behalf of the controller.

3.3. Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3.4. Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting the processing thereof in the future.

3.5. Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

3.6. Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

3.7. Recipient

Recipient means a natural or legal person, public authority, agency or another body, to which the personal data is disclosed, whether a third party or not.

3.8. Third Party

Third Party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process the personal data.

3.9. Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

4. Collection, processing and use of your personal data when you visit our website

4.1. Log files

Every time you access our website, the respective Internet browser transmits specific user data and stores it in log files, the so-called server log files. The data concerned is as follows:

• date and time when you access our website
• URL of the website you are referred from
• the file retrieved
• the amount of data transmitted
• the browser type and browser version
• your operating system
• your IP address.

This data is collected and processed for the purpose of enabling you to use our website (establish the connection), to guarantee system security, for technical administration of the network infrastructure, to pass information on to the law enforcement authorities in the event of a cyber attack or abuse, and in order to optimize our offer.

The data is stored for 7 days. It is then erased – subject to any statutory storage obligations or storage requirements of public authorities.

The legal basis for the collection, storage and use of this data is our legitimate interest in being able to make the information on our website available to you free of any impairment and in guaranteeing the necessary security (Art. 6 (1) sentence 1 (f) GDPR).

4.2. Establishing general contact

If, in order to receive general information, you contact us by e-mail, by means of the postal service or on the telephone, then depending on the transmission route you choose, we store and process your form of address, your e-mail address, your first name and last name, your address and the content of your message. If you voluntarily provide us with more data than is necessary for the chosen transmission route, then we also store and process this data.

If you contact us by using our contact form, we collect, store and process your e-mail address and the content of the message sent to us. These are mandatory details. In addition, you can also voluntarily provide us with your first name and last name.

Please note that we do not need the data you provide on a voluntary basis in order to reply to your messages and you should check carefully whether or not you wish to disclose this data to us.

After the communications with you have been concluded, this data will be routinely erased – provided that there are no statutory storage obligations or storage requirements of public authorities or unless the lawfulness of the data processing is grounded on a different legal basis. This erasure is carried out no later than one year after we have had no further communications with you.

The legal basis for processing your personal data is our legitimate interest in communicating with you in order to reply to your messages and to be able to answer your questions (Art. 6 (1) sentence 1 (f) GDPR).

4.3. Transmitting information (also of a promotional nature)

If you provide us with your personal data in connection with contacting one of our employees and giving us your business card or by an enquiry requesting information by e-mail, post, on the telephone etc., we store your data and use it for the purpose of sending you information in future on us, our activities and events. Information is only sent by e-mail if you give us your explicit consent after we have verified your e-mail address (double opt-in). If you did not contact us by e-mail yourself beforehand then we ask you to confirm that you consent to our sending you promotional information either by clicking on a link we send you or by sending us an e-mail reply. Your consent is given voluntarily and may be withdrawn at any time by sending us an e-mail with the reference “deregister” to the following address: datenschutz@festival-gmbh.de. When withdrawing your consent, you do not incur any charges apart from the transmission costs of the basic tariff.

The legal basis for this processing of your data is our legitimate interest in communicating with you in future and/or to comply with your wish by sending you information in future, including information of a promotional nature, on us, our activities and events (Art. 6 (1) sentence 1 (f) GDPR). If we send you information of a promotional nature by e-mail, the legal basis for this is your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR.

If we have received your data in connection with a contractual relationship with you, e.g. by virtue of your having registered for one of our events or if you have submitted works in connection with an award, we process your personal data transmitted in this connection, on the one hand for the purpose of performing the contract relationship existing with you, or alternatively to initiate it. In addition, we will also send you information on us, our activities and events in future too, including information of a promotional nature.

The legal basis for the processing of your data is, on the one hand, to perform or initiate the contract relationship with you pursuant to Art. 6 (1) sentence 1 (b) GDPR, on the other hand it is the legitimate interest we have in sending you direct advertising and in advising you of our activities (Art. 6 (1) sentence 1 (f) GDPR).

You may object at any time to your personal data being processed for direct advertising purposes. To this effect please send us an e-mail with the reference “de-register” to datenschutz@festival-gmbh.de. We will then no longer use your data for these purposes.

4.4. Newsletter

Our website is a showcase presenting you with interesting information on our company, our events and activities, our products and campaigns. You also have the possibility of subscribing to our free Newsletter so that you can receive this information directly by e-mail.

We need to have your e-mail address for you to subscribe to this. You can also indicate your first name and last name on a voluntary basis. Please note that we do not need the data you provide on a voluntary basis in order to send you the Newsletter and you should check carefully whether or not you wish to disclose this data to us. We use the so-called “double opt-in process” for your registration:

Once you have sent us the registration form, you receive a confirmation e-mail from us for verification of your e-mail address. The registration does not become effective until you have clicked on the link in the e-mail confirmation. If you have subscribed to the Newsletter you have given us the following statement of consent:

I agree to receiving information and advertising from
Film- und Medienfestival gGmbH in the form of Newsletters.

We use the e-mail address you advised us of when ordering the Newsletter solely to send the Newsletter.

You can unsubscribe from the Newsletter at any time. For this you can use the unsubscribe link provided at the end of every e-mail. Further, we also accept de-registrations by e-mail and on the telephone using the contact data provided above. Your e-mail address will then be immediately erased from the distribution system unless there is another legal basis for processing your personal data. When withdrawing your consent, you do not incur any charges apart from the transmission costs of the basic tariff.

The legal basis for collecting and processing your data to send you the Newsletter is your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR.

We use Mailchimp for provision of the Newsletter function; this is a newsletter service of Rocket Science Group LLC headquartered in 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, Georgia 30308, USA.

We point out that Rocket Science Group LLC complies with the requirements of both the EU-US Privacy Shield and also those of the Swiss-US Privacy Shield. You can find extensive information on the data privacy policy of Rocket Science Group LLC (“Privacy Policy”) on the Mailchimp website: https://mailchimp.com/legal/privacy/#3._Privacy_for_Contacts. Mailchimp acts on our behalf as our processor (see section 5).

4.5. Registration and submission of projects

4.5.1. Miscellaneous

The Animation Production Days serve the purpose of establishing contacts between creative individuals and investors.

In connection with the Animation Production Days you can either submit your animation project or, if are a potential investor, have projects that have been submitted presented to you. To enable us to record the purpose of your attendance at the Animation Production Days and to draw up a schedule in line with this, you have to be registered on our website. In this connection we collect, store and process the purpose of your registration (submission of a project, co-producer of a project already submitted, producer, studio or service producer without a submitted project, participant in the APD Talent Program or investor), the name of the undertaking which you are attending the APD for, the website, address (street, post code, town/city, country), the profile and main area of activity of the undertaking you are attending for. We also collect, store and process your first name and last name, telephone number, e-mail address, corporate profile, professional title, expertise and your specific request.

You can further advise us of your academic title on a voluntary basis and write an additional message. Please note that we do not need the data you provide on a voluntary basis in order to carry out the registration and you should check carefully whether or not you wish to disclose this data to us.

The legal basis for processing your personal data is to take steps, prior to entering into a contract, for your participation at the Animation Production Days, and/or for performance of the contractual relationship entered into with you as a participant at the Animation Production Days (Art. 6 (1) sentence 1 (b) GDPR). The legal basis is also exercising our legitimate interest to introduce you to suitable producers or investors (Art. 6 (1) sentence 1 (f) GDPR).

4.5.2. Disclosure and publication

The intent and purpose of the Animation Production Days is to establish contact between producers and investors. In order to fulfil the purpose of the Animation Production Days, it is necessary to pass your data on to the other participants at the Animation Production Days.

This is why we pass on part of your data (name of the project and of the undertaking you are attending for) to the other participants, and on our website we publish the name of the undertaking you are attending the APD for, your first name and last name, your professional title, the country you are attending from, the name of your project and a preview image of your project.

In addition, the following data will be forwarded to the FMX, Filmakademie Baden-Württemberg, Animationsinstitut, Akademiehof 10, 71638 Ludwigsburg as part of the conference: Title, title, first name, last name, e-mail-address, company, country

The legal basis for processing your data is the performance of the contract entered into with you (Art. 6 (1) sentence 1 (b) GDPR) and our legitimate interest in performance of the purpose of the APD (Art. 6 (1) sentence 1 (f) GDPR).

4.5.3. Photo in the APD Catalogue

In addition, you have the possibility of uploading a photograph of yourself for the APD catalogue.

I consent to a portrait photograph of me being included in the print and digital versions of the catalogue for this purpose. If my photograph provides any indications as to my ethnic origin, religion or health (e.g. skin colour, head covering, spectacles), my consent also applies to these indications. This statement of consent is given voluntarily and may be withdrawn at any time with effect for the future by sending an e-mail to us at
datenschutz@festival-gmbh.de.

If you withdraw your consent, the printed version of the catalogue will continue to be used unchanged for up to two months. Your photograph will be obscured at the latest two months after your withdrawal of consent.

The legal basis for processing your data is your consent (Art. 6 (1) sentence 1 (a) GDPR).

4.5.4. Submission of a project and talent programme

If you submit a project or wish to participate in the APD talent program, then we additionally collect, store and process detailed information on the project submitted (including the title, information on funding, genre etc.). We also collect, store and process the names of the persons involved whom you have notified us of (director, scriptwriter, storyboarder, animation lead). You are responsible for the names of the authors involved in the project being correct and for their not having objected to being named.

The legal basis for the processing of your personal data is to take steps prior to entering into a contract or for performance of the contract entered into with you, pursuant to Art. 6 (1) sentence 1 (b) GDPR.

4.6. Online Meeting Scheduler and APD Catalogue

Within the framework of the co-production and financing market that is taking place, you as a participant have the opportunity to meet other participants in pre-planned one-to-one meetings.

In order to arrange meetings with other participants, we collect, store and process your name, e-mail address, the purpose of your participation in the Animation Production Days (studio/producer or investor) and your availability. We also collect and store your preferred partners for a meeting in order to coordinate the one-to-one meetings. However, this data is not passed on to other participants.

Part of the co-production and financing market are the joint meals. You can voluntarily tell us your preferred meal option (vegetarian, vegan) or leave further comments or remarks for us. Please note that the data you provide voluntarily is not necessary for us to participate in the event and please check carefully whether you wish to provide us with this data.

The legal basis for the processing of your personal data is the perception of our legitimate interest in introducing you to suitable producers or investors (Art. 6 Para. 1 Sentence 1 lit. f DS-GVO).

4.7. Cookies and marketing tools

4.7.1. Cookies

We use so-called cookies. Cookies are alphanumeric identification characters (small text files) which are either stored briefly in your working memory and then deleted again as soon as you close your browser (“session cookies”) or stored in your storage medium over a longer period or for an unlimited period of time (“permanent cookies”). They can be subdivided into the following categories:

 

4.7.1.1. Necessary cookies

We use cookies that are strictly necessary from a technical perspective to hold the connection while you visit our website, to guarantee the security of communications and to protect our systems against attack. Without these cookies it is not possible to provide the website. The website cannot function securely without these cookies.

We use the following necessary cookies:

Name	Cookie provider	Cookie	Description	Storage duration
APD	animationproductiondays.de	_current_language	Keeps the current language set	Permanent 24 hours
APD	animationproductiondays.de	nm_transient_id	Assigns a unique ID to every website visitor. If the visitor revisits the website, a new ID is assigned.	Session

 

The legal basis for the use of these cookies is our legitimate interest, pursuant to Art. 6 (1) sentence 1 (f) GDPR, to enable you to have secure and disruption-free use of the functionalities of our website.

 

4.7.1.2. Deactivation of cookie settings

You can allow or refuse to allow the use of cookies in our cookie settings [https://www.animationproductiondays.de/]. Alternatively, in your browser settings, you can refuse to allow cookies in general, erase them from your computer, block them or activate the function that ensures you are always asked before a cookie is set. You do not have to allow cookies to visit our website. We do point out, however, that the use of the offer on our website, especially the convenience of use, might be restricted if you have deactivated cookies.

The following examples show you how to deactivate cookies:

Internet Explorer browser:

1. Open the Internet Explorer.
2. Select “Internet Options” in the menu “Tools”.
3. Click on the “Privacy” tab.
4. Click on “Advanced” under the sub-heading “Settings”
5. You can now choose whether to accept all cookies, block all cookies or prompt approval of the cookies.
6. You confirm your setting by pressing “OK”.

 

Firefox browser:

1. Open the Firefox browser.
2. Select “Options” from the main menu (three lines) in the top right corner
3. Click on the “Privacy & Security” tab.
4. In the section “Enhanced Tracking Protection” select “Custom” and choose a setting from the cookies dropdown menu.
5. You can now choose which types of sites to accept cookies from, if any.
6. You may need to restart the browser for the changes to be applied.

Safari browser:

1. Open the Safari browser.
2. Select “Preferences” under the Safari menu tab.
3. Click “Privacy” and choose any of the following:
4. Select “Prevent cross-site referencing”.
5. Select “Block all cookies”.
6. Select “Remove” or “Remove All” to remove stored cookies from the selected websites or all websites.
7. Click “Manage Website Data” to see which websites store cookies or data.

Google Chrome browser:

1. Open the Chrome browser.
2. Select “Settings” from the main menu (three dots) in the top right corner.
3. Under “Privacy & Security” select “Site Settings” and from this menu select “Cookies and site data”.
4. You can either switch on “Allow sites to save and read cookie data” to allow all sites to use cookies or switch off “Allow sites to save and read cookie data” to block cookies on all sites.
5. You can also allow and block individual sites by clicking “Add” under the sub-heading of the action you want to perform.
6. The browser saves the changes made automatically.

Other browsers:

If you use any other browsers, information on cookie settings can be found by pressing the browser’s “assist” button.

Please note that browser functionalities change frequently. If the above instructions are no longer up to date, please follow the instructions provided by your browser.

4.8. Inclusion of Youtube videos

We incorporate videos from “YouTube”, the platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Information on the use of the data by Google when videos are viewed, is provided in the Google privacy policy:

https://www.google.com/policies/privacy/ and in the Youtube terms of use: https://www.youtube.com/static?gl=DE&template=terms&hl=de.

When a YouTube video is viewed, personal data is generally transferred by means of cookies to YouTube and to the Google tracking service DoubleClick, so as to enable the user behaviour to be analysed. In this case, cookies are already set every time the website is viewed, with the effect that Google is, in principle, able to collate all of the pages you have visited as a user, in order to compile a profile. It cannot, therefore, be ruled out that this data that is stored by the respective network is assigned to an individual person.

It is possible that by viewing YouTube videos, your data could be transferred to servers in third countries, e.g. in the USA. The responsibility for operating in compliance with data protection regulations has to be guaranteed by the respective provider. We point out that Google LLC complies with the requirements of both the so-called EU-US Privacy Shield and also those of the Swiss-US Privacy Shield. These are treaties between the United States and the European Union and the United States and Switzerland, guaranteeing that the level of data protection stipulated in the European Union is also complied with by the relevant undertakings domiciled and certified in the USA. Further explanations are available at: https://www.privacyshield.gov/. You can retrieve the list of certified undertakings from: www.privacyshield.gov/list. We do, however, advise of the following: Even if undertakings in the USA have subjected themselves to the EU-US Privacy Shield (see list of the undertakings at: www.privacyshield.gov/list) or to the EU standard contract clauses, and have thus undertaken to comply with the data protection rules specified in the contract, the transmission of data to countries outside Europe, especially to the USA, nonetheless involves risks under data protection law.

This use of your data by Google is conditional upon your consent. You give this consent in connection with the cookie consent or, in an individual case, by accepting data processing by Google by clicking on the video interface.

By means of our software solution, there is only a transmission of data to Google if you allow only the Youtube cookies or if you allow all social media cookies. Google may not collect any data from you beforehand. This thus ensures that you can use our offer without making your data available to Google.

Your consent is voluntary, as you can already choose in the cookie settings [https://www.animationproductiondays.de/] whether you agree to allowing cookies to be set by Youtube or not. It is up to you to decide not to allow Youtube cookies. Please bear in mind that in this case Youtube content cannot be displayed on our website.

You can withdraw your consent at any time. In order to prevent the transmission of data to Google without activating the video, you can block Youtube cookies at any time in the cookie settings [https://www.animationproductiondays.de/]. The resultant effect is that no data is transferred to Google, but you cannot be shown any videos either. You can still watch the video if you accept the data transmission to Youtube by clicking on the link on the blocked video user interface.

The legal basis for this processing of your data is your consent (Art. 6 (1) sentence 1 (a) GDPR).

4.9. Integration of Vimeo videos

4.10. Google Maps

On our website we use “Google Maps”, an online map service offered by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Google Maps enables us to show you our location via an interactive map on the website and to give you travel directions to us.

As a rule, information on your use of our website (such as your IP address) is already transmitted to Google servers and stored there as soon as you retrieve the subpages which the map from Google Maps is embedded in. In this connection there can also be a transmission to the Google LLC servers in the USA. This happens regardless of whether you are logged into Google via a user account or not.

No data is transmitted to Google Maps unless you have given your consent. In the cookie settings you can withdraw your consent at any time. If you do not grant us your consent to the inclusion of Google Maps, we use a special software solution which prevents the transmission of data to Google. The effect this has is that when you click on the map in Google Maps, you are transferred to a link first of all and only by clicking on this link after receiving data privacy instructions is the information sent to Google. Please only click on the map if you are in agreement with your data being transferred to Google and being used by Google as described below. If you do not activate the link there is no transmission of your data to Google.

Google uses the following data to determine the location:

• GPS
• Your IP address
• Sensor data of the device you use
• Information on objects in the vicinity of your device, e.g. any Wi-Fi access points, radio masts and Bluetooth-enabled devices

The type of location data collected by Google depends on the specific settings on your devices and accounts. You can, for example, activate and deactivate the location data via the “settings” App on your device.

If you are logged into Google, your data is assigned directly to your account. If you do not wish to have an assignment to your Google profile, you have to log out before you activate the button. Even if you are not logged in, Google stores your data as user profiles and evaluates it especially for (personalised) advertising and market research. You have the right to object to these user profiles being created; however, you have to contact Google to exercise this right.

We point out that Google LLC complies with the requirements of both the so-called EU-US Privacy Shield and also those of the Swiss-US Privacy Shield. These are treaties between the United States and the European Union and the United States and Switzerland, guaranteeing that the level of data protection stipulated in the European Union is also complied with by the relevant undertakings domiciled and certified in the USA. Further explanations are available at: https://www.privacyshield.gov/. You can view the list of certified undertakings at: www.privacyshield.gov/list. We do, however, advise you that, even if undertakings in the USA have subjected themselves to the EU-US Privacy Shield and have thus undertaken to comply with the data protection rules specified in the treaty, the transmission of data to countries outside Europe, especially to the USA, can nonetheless involve risks under data protection law due to the possibilities of access by the state. Only if you have given your consent is your data transferred to Google as an exception.

Extensive information on data protection by Google (“Google Privacy Policy”) is provided on the Google website: https://policies.google.com/privacy?hl=de, the additional terms of use for Google Maps can be found at:       https://www.google.com/intl/de_US/help/terms_maps.html.

If you are not in agreement with your data being transferred to Google in connection with the use of Google Maps in future, you do have the possibility of fully deactivating the Google Maps web service at any time by switching off the application of JavaScript in your browser. You cannot then use Google Maps or the map display on this Internet site. The following examples describe how you can deactivate JavaScript in the common browser Internet Explorer Version 9 or higher, Firefox, Google Chrome and Safari:

Internet Explorer Version 9 or higher:

1. Click on “Tools” in the browser and then select the “Internet Options”.
2. Change to the “Security” tab in the next window.
3. Now press on “Custom level…” in the “Security” tab.
4. When the dialogue window “Security Settings – Internet Zone” opens, scroll to the section “Scripting”.
5. In “Active Scripting” select the option “Disable”.
6. A “Warning!” window now opens and asks you “Are you sure you want to change the settings for this zone?” – select “Yes”.
7. After returning to “Internet Options”, click on OK to store the settings and close the window.
8. Now click on the “Refresh” button on your browser to reload the page.

Firefox:

1. In Firefox, type “about:config” in the address bar, then press “Enter”.
2. Select the “I accept the risk!” button.
3. Type “javascript” in the “Search” box.
4. Double-click the “javascript.enabled” line to switch the setting between “true” and “false” as desired.

Google Chrome:

1. Select “Settings” from the main menu (three dots) in the top right corner of the browser.
2. Click “Site Settings” under the sub-heading “Privacy & Security”.
3. Click “JavaScript”.
4. You can choose to switch “enable all” or “disable all” or you can add sites to an allow list or block list.

Safari:

1. Open Safari.
2. Open the Safari menu and click “Preferences”.
3. Click the “Security” tab.
4. Remove the check from the box in front of “Enable JavaScript” to disable the feature.

Please note that browser functionalities change frequently. If the above instructions are no longer up to date, please follow the instructions provided by your browser.

Additional information on restricting data use by Google Maps e.g. on deactivating and activating the location memory for certain devices and on deactivation or activation for specific Apps is available here:
https://support.google.com/accounts/topic/7189122?hl=de&ref_topic=3382254.

We use Google Maps to be able to show you the interactive maps of Google Maps and to thus improve your sense of direction regarding our location and make it easier for you to find us. The legal basis is your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR.

4.11. Cloudflare

We use content delivery networks to design a particularly appealing website for you and to simultaneously reduce the website loading time. In this connection, content of our website, for instance fonts and images, is provided on external third-party servers. We use content of the provider “Cloudflare”.

We use animation libraries of Cloudflare, a Content Delivery Network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

When you visit our website, Cloudflare collects your IP address, your system configurations and other information on the traffic to and from Cloudflare customer websites.

We point out that Cloudflare complies with the requirements of both the so-called EU-US Privacy Shield and also those of the Swiss-US Privacy Shield. These are treaties between the United States and the European Union and the United States and Switzerland, guaranteeing that the level of data protection stipulated in the European Union is also complied with by the relevant undertakings domiciled and certified in the USA. Further explanations are available at: https://www.privacyshield.gov/. You can view the list of certified undertakings at: www.privacyshield.gov/list. We do, however, advise you that, even if undertakings in the USA have subjected themselves to the EU-US Privacy Shield and have thus undertaken to comply with the data protection rules specified in the treaty, the transmission of data to countries outside Europe, especially to the USA, can nonetheless involve risks under data protection law due to the possibilities of access by the state.

You can find extensive information on the privacy policy of Cloudflare on the Cloudflare website: https://www.cloudflare.com/de-de/privacypolicy/.

The legal basis for the use of this content delivery network is our legitimate interest in providing you with an appealing and fast-loading website (Art. 6 (1) (f) GDPR).

4.12. Job applications

If you send us your application through the postal service, by e-mail or telefax, we collect, store and process the contact data you specifically provide us with, e.g. your name, address and telephone number, your telefax number and your e-mail address, in order to use it to be able to communicate with you during the course of the application process. Your full application documentation and other documentation provided during the course of the application process, and our records, will also be handled in confidence and protected against access when stored. Documents on paper will be protected against access when stored. We process your application documentation in order to be able to assess your specialist aptitude, qualification and ability for the position you have applied for, and so as to have a basis on which to make our selection decision.

If your application documentation should contain special categories of personal data, for instance information on your health, your religious beliefs or ethnic origin, we shall base our processing of such documentation on our statutory obligations as an employer and on the protection of your fundamental rights associated therewith and thus, in addition, on Art. 9 (2) (b) GDPR. Additionally, we also process your information on the basis of Art. 9 (2) (h) GDPR in order to be able to assess the working capacity of potential employees and, if appropriate, to take preventive or occupational medicine measures.

If the outcome of the application process is successful, we will use and process your documentation and data in the context of your employment relationship. You will be given separate information in this respect. Otherwise the application process will end when a letter of rejection addressed to you is dispatched.

Your data will be erased no later than four months after our letter of rejection is dispatched and any copies existing on paper will be correctly destroyed and disposed of or returned to you, unless a longer storage period is necessary in order to defend against any legal claims or to perform a statutory obligation. Naturally we will proceed in the same manner if you advise us that you wish to retract your application.

If, after your application is rejected, you would like us to consider you in a subsequent selection process, we will store your application documentation if you have given us your statement of consent in writing. If appropriate, we will obtain this from you separately. The legal basis for this continued storage and processing of your personal data is your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR. This data will be routinely erased after two years or in the event of your withdrawal of consent, which is possible at any time, unless a longer storage period is necessary in order to defend against any legal claims or to perform a legal obligation.

The legal basis for collecting and processing your data in connection with the application process is, in principle, the need to have it for a decision on establishing an employment relationship (Art. 6 (1) sentence 1 (b) GDPR; section 26 (1) sentence 1 BDSG) and our legitimate interest in using it for the purpose of the proper conduct of the application process (Art. 6 (1) sentence 1 (f) GDPR). In the event of special categories of personal data, the legal basis is Art. 9 (2) (b) and (h) GDPR (see above).

4.13. Children and young people

Our websites are not designed for children or young people below 16 years of age. We do not therefore knowingly or intentionally collect any personal data from children or young people. If you are under 16 years of age, please do not enter any data on this website. If we obtain knowledge that we have received personal data from children or young people who are not yet 16 years of age, we will erase such data without undue delay subject to any storage obligations.

5. Data processing by a processor / disclosing data

5.1. Data processing by a processor

Notwithstanding any other provisions, we reserve the right, on the above legal bases, to transfer or disclose your data to a third-party (processor) commissioned by us (e.g. in connection with IT support, hosting, destruction of files, sending the Newsletter etc.). We always have agreements on such processing on our behalf with the service providers commissioned by us in this manner. These agreements ensure that the data disclosed accordingly is only used by our commissioned processors to perform the tasks stipulated by us in accordance with the above purposes and that it is used in compliance with the technical and organisational measures necessary for data security and data protection.

5.2. Disclosing data to third parties

Further, your personal data is not transmitted to third parties for any purposes other than those set out below. We only disclose personal data to third parties if:

• you have explicitly given us your consent to do so pursuant to Art. 6 (1) sentence 1 (a) GDPR;
• disclosure is necessary pursuant to Art. 6 (1) sentence 1 (f) GDPR on account of a legitimate interest and if there is no reason to assume that such interest is overridden by your interests or fundamental rights and freedoms to protect your personal data (Art. 6 (1) sentence 1 (f) GDPR);
• there is a legal obligation for disclosure pursuant to Art. 6 (1) sentence 1 (c) GDPR;
• the transmission is necessary, pursuant to Art. 6 (1) sentence 1 (b) GDPR, for the performance of contract relationships with you;
• the transmission is necessary, pursuant to Art. 6 (1) sentence 1 (d) GDPR, in order to protect vital interests or
• the transmission is necessary for the performance of a task carried out in the public interest pursuant to Art. 6 (1) sentence 1 (e) GDPR.

5.3 Payment Service Provider Stripe

We use the payment service provider Stripe to process the payment. When processing payments via the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, we pass on the information you provide during the ordering process and the information about your order, in particular:

• Full Name
• Address
• Bank account number
• Sort code
• credit card number
• invoice amount
• Currency and transaction number

on the legal basis of Art. 6 Para. 1 lit. b Pass on GDPR. Your data will only be passed on for the purpose of payment processing with the payment service provider Stripe Payments Europe Ltd. and only to the extent that it is necessary for this. You can find more information on Stripe’s data protection at the URL https://stripe.com/de/privacy#translation.

6. Encryption / data security

6.1. Your data is always encrypted by means of TLS encryption (so-called Transport Layer Security) when it is collected, processed and used. TLS is implemented to encrypt the continual flow of data on the Internet between the server and a user’s browser and to thus prevent any “eavesdropping and data being secretly retrieved” – insofar as this is technically feasible. One of the ways to tell that a connection is encrypted, is if the URL in your browser’s address bar starts with “https://” and/or if the status bar at the bottom of your web browser shows a “lock” or “key” symbol (icon). By clicking on the icon, depending on the browser you use, you can receive further information on the encryption and on the TLS certificate used.

6.2. We point out that it is not possible to fully guarantee data security during e-mail communications. For transmitting confidential information, it might be preferable to use the postal service or service by a courier.

6.3. Furthermore, we apply all reasonable, suitable, technical and organisational security measures to protect your data against accidental or deliberate manipulation, full or partial loss, destruction and unauthorized access by third parties. Our security measures are subject to on-going improvement and further development in accordance with technological developments.

7. Erasure of the data / restriction of data processing

Your data will be erased, in principle, if your consent has discontinued or if the data is no longer required for the purpose of the data processing and if there is no other legal basis for or justified interest in continued storage and processing. If, however, this data still has to be stored due to existing statutory or contractual obligations or requirements of public authorities (e.g. warranty, financial book­keeping), then data processing is restricted by marking and blocking the data. In the event that the purpose of the data processing is changed compared with the original purpose, we shall inform you of this in a manner that is in conformity with data protection law and comply with the requirements of data protection law.

8. Rights of the data subject

As the data subject whose data is being processed, you are entitled to the following rights:

• Right to be given information (Art. 15 GDPR)

You have the right to obtain information from us on the personal data stored on you. This encompasses, in particular, information on the purposes of the processing, the categories of the personal data processed, the categories of recipient to whom the processed personal data has been or will be disclosed, the period of storage, the existence of the right to rectification or erasure of personal data, to restriction of processing and to object to such processing, the existence of a right to lodge a complaint, the source of your data if it was not collected by us, and the existence of automated decision-making, including profiling, and, if applicable, meaningful information on the details. You further have the right to receive a copy of your personal data undergoing processing by us.

• Right to rectification (Art. 16 GDPR)

You have the right to obtain from us without undue delay the rectification of inaccurate personal data and the right to have incomplete personal data completed.

• Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)

You have the right to obtain from us the erasure of your personal data, subject to the statutory requirements. If such erasure is prejudiced by statutory storage obligations or storage requirements of public authorities or where the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims, the processing of the data will be restricted (see below).

• Right to restriction of processing (Art. 18 GDPR)

You have the right to demand of us, subject to the statutory requirements, that we restrict the processing of your personal data, i.e. mark the data and restrict the future processing of it (blocking).

• Right to data portability (Art. 20 GDPR)

You have the right, subject to the statutory requirements, to require us to transmit to you, or to another controller named by you, the personal data concerning you, which you provided to us, in a structured, commonly used and machine-readable format.

Right to object to direct marketing (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data for advertising purposes (“Objection to Advertising”).

• Right to object to data processing if the legal ground is a “legitimate interest” (Art. 21 GDPR)

You have the right to object at any time to the processing of the data by us if the legal basis for this is a “legitimate interest”. We will then discontinue the processing of the data unless we are able to demonstrate, in accordance with the legal stipulations, compelling legitimate grounds for the continued processing which override your rights.

• Right to withdraw consent (Art. 7 (3) GDPR)

If you have given us your consent to the collection and processing of your data, you may withdraw this consent at any time with effect for the future. The lawfulness of processing your data in the past up until the time of your withdrawal of consent shall remain unaffected by this.

• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You may lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of your data is infringing applicable law. For this you have the right to approach the competent data protection authority at your habitual residence or in your country or the data protection authority with competence for us.

9. Competent supervisory authority

The supervisory authority with competence for us is the

State Officer for data protection and

freedom of information of the German State of Baden-Württemberg

Königstrasse 10a

70173 Stuttgart, Germany

Telephone: +49 (0)711/615541-0

E-mail: poststelle@lfdi.bwl.de

10. Validity and changes to the Data Privacy Statement

This Data Privacy Statement is valid at the current time and is the version dated 28 November 2019.

It can become necessary to amend this Data Privacy Statement as a result of further developing our website and offers or due to changes to statutory provisions or requirements of the public authorities.

You can retrieve, print and store the Data Privacy Statement valid at any one time from our website at [https://www.animationproductiondays.de/datenschutzbestimmungen/].