Pri­va­cy Po­li­cy

At a glance

Controller

Victus Films GmbH
Sendlinger Straße 1
80331 Munich, Germany

Managing director: Ben Blaskovic

Phone: +49 (0)89 92650538
Email: web@victus-films.com

The controller is whoever, alone or jointly with others, decides on the purposes and means of processing personal data. Personal data is any information that can identify you, such as your name, email address or IP address.

The essentials

Hosting and server log files

Hosting

Our website is hosted by Alfahosting GmbH, Ankerstraße 3b, 06108 Halle (Saale), Germany, on servers in Germany. We have a data processing agreement with Alfahosting under Art. 28 GDPR.

Server log files

Each time you visit our website, the server automatically stores information sent by your browser:

We need this data to deliver the website securely and reliably and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted automatically after a short time and are not combined with other data.

Audience measurement with Matomo

Scope

We use Matomo Cloud, a service of InnoCraft Ltd., New Zealand. The data is stored in data centres in Frankfurt am Main, Germany. We have a data processing agreement with InnoCraft. New Zealand is covered by an adequacy decision of the European Commission.

We have configured Matomo not to set any cookies. It records:

This shows us which content is read so we can improve the website. The data is not used to identify you personally and is not combined with other data. The legal basis is Art. 6(1)(f) GDPR. The data is deleted once it is no longer needed for analysis.

Opting out

If you enable “Do Not Track” in your browser, Matomo will not record your visits. You can also opt out here:

Contact and enquiries

Contact form, email and phone

If you contact us via the contact form, by email or by phone, we process the details you provide (such as name, company, email address, phone number and your message) to answer your enquiry. Messages from the contact form are sent to us by email, and our reply goes directly to the email address you entered.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a project or contract, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the data once the enquiry has been dealt with, unless statutory retention obligations apply.

Shop and payment

Orders

For shop orders we process your name, delivery and billing address, email address, the items ordered and the payment information passed to us by the payment provider. We need this data to fulfil the purchase contract (Art. 6(1)(b) GDPR). Invoices and accounting records are kept for as long as commercial and tax law requires (Section 257 HGB, Section 147 AO, Art. 6(1)(c) GDPR).

For shipping, we pass your name and delivery address to the shipping company.

Payment via Stripe

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your payment details (such as your card number) directly with Stripe; we never see them. Stripe may also transfer data to the USA and is certified under the EU-US Data Privacy Framework for this. See the Stripe privacy policy for details.

Shopping cart

Your shopping cart is only stored locally in your browser (local storage) so that it is still there on your next visit. It is only sent to us when you go to checkout. This is technically necessary for the shop (Section 25(2) no. 2 TDDDG). You can empty the cart or clear the site data in your browser at any time.

Newsletter and press list

Newsletter

New sign-ups to our newsletter are confirmed via the link in a confirmation email (double opt-in). We store your email address, optionally your name, and the time and IP address of sign-up and confirmation so that we can prove your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR). We inform existing business contacts on the basis of our legitimate interest in reporting on our work (Art. 6(1)(f) GDPR); you can object to this at any time. You can unsubscribe at any time via the link in every issue or by emailing us. We then delete your address. We keep proof of your earlier consent and a block entry where we need it to defend against claims (Art. 6(1)(f) GDPR).

We send the newsletter with Brevo, a service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. The data is processed in the EU, and we have a data processing agreement with Brevo. Brevo records opens and clicks for us only in anonymised form, without linking them to individual people. We do not analyse who opens the newsletter or clicks links.

We previously managed our newsletter contacts in HubSpot (HubSpot Ireland Limited, Dublin). When moving to Brevo we transferred the contacts who had not unsubscribed: email address, name, company where available and, where available, the proof of consent. Unsubscribed and undeliverable addresses were not transferred. If you reply to the newsletter, your message reaches our inbox and is handled like any other email to us.

Event invitations

We invite people to our own events, such as the VICTUS. Pre-Opening Night or the VICTUS. Award, by email. For this we use name, email address and, where available, company and role from our business contacts, plus a category so that invitations fit the occasion. Sending also runs via Brevo (see above).

If you accept or decline via the link in the invitation, we store your answer, any registered companion and an optional message on our server in Germany to manage the guest list. The legal basis is our legitimate interest in maintaining business contacts (Art. 6(1)(f) GDPR). You can object at any time via the unsubscribe link in every invitation or by emailing us. We delete answers for an event once we no longer need them to organise and follow up on it.

Press list

We send press releases to journalists and editorial offices whose professional contact details are public or who have given them to us. The legal basis is Art. 6(1)(f) GDPR (informing the press about our productions). You can object at any time; a short email is enough.

Other areas and links

VICTUS. Kino

In the VICTUS. Kino (victus-films.com/kino) we show our films in full length to invited business contacts. For this we store name, company, email address, an encrypted password, the time of invitation and sign-in, and which films were opened. If you request access via the “Request access” form, you send us your name, company, position, business email address, purpose and optionally a message; we use these details only to review the request and delete handled requests after six months. The legal basis is Art. 6(1)(b) and (f) GDPR. Signing in sets a technically necessary session cookie. We delete the data when the access ends.

The films play in the Vimeo player (Vimeo.com, Inc., New York, USA) with tracking switched off, or alternatively in YouTube’s privacy-enhanced mode (Google Ireland Limited, Dublin). When a film plays, your IP address is sent to the respective provider, and data may also reach the USA.

Production Hub

Our internal Production Hub (victus-films.com/hub), used only by invited team members, has its own privacy notice.

Links to other services

Our pages link to services such as Instagram, Facebook, LinkedIn, YouTube, Vimeo and Spotify. These are plain links: the provider’s page only opens when you click, and its own privacy policy then applies. No data is sent to these providers before that.

Fonts

All fonts are loaded from our own server. There is no connection to Google Fonts or any other font provider.

Your rights

What rights you have

You have the right at any time to access the data we hold about you (Art. 15 GDPR), and to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). A short message to us is enough.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Where your data is used for direct marketing, you can object at any time without giving reasons.

Complaints to a supervisory authority

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Objection to unsolicited advertising

We object to the use of the contact details published in our legal notice for sending advertising and information material that we have not expressly requested. We reserve the right to take legal action against unsolicited advertising, such as spam emails.