Scope and legal bases
This privacy policy applies to the film distribution section operated by Kinostar Filmverleih GmbH. Cinema services and linked third-party services have their own privacy notices.
We process personal data under the General Data Protection Regulation (GDPR). Depending on the purpose, processing is based on your consent (Art. 6(1)(a)), a contract or steps prior to a contract (point (b)), a legal obligation (point (c)) or our legitimate interests (point (f)). The purposes are explained below.
Website access and hosting
When you access our pages and files, the server receives information needed to deliver them. This includes your IP address, the time and requested address, browser and operating system, the referring page where transmitted, and the response status and size.
We use this information to deliver a stable and secure service and to detect and prevent misuse. Processing is based on Art. 6(1)(f) GDPR; our legitimate interest is reliable and secure operation. Technical service providers receive data where necessary to provide the service and, where acting as processors, are bound by contracts under Art. 28 GDPR.
Contact, film bookings and press enquiries
When you contact us by email, telephone or post, we process your contact details and the information you provide to handle your request. This includes film bookings, press enquiries and questions about distribution materials.
Requests relating to a contract are processed under Art. 6(1)(b) GDPR. Other enquiries are handled in our legitimate interest in communication under Art. 6(1)(f). Statutory retention requirements are based on Art. 6(1)(c). Please provide only the information needed for your request.
Images, downloads and local fonts
Film posters, images, locally provided videos and distribution materials are delivered from our media storage. Access involves the same necessary technical data as visiting a page. We provide these files to inform you about our programme and enable use of distribution materials (Art. 6(1)(f) GDPR).
Fonts in the film distribution section are served locally. Loading them therefore does not connect your browser to an external font provider.
YouTube and Vimeo trailers
External trailers load only after you activate the play button. Before that, only a preview image supplied by us is displayed. YouTube uses its enhanced privacy mode at youtube-nocookie.com; data is still transferred after activation.
After activation, the selected provider receives data including your IP address and information about your browser, device and the page you visited. The provider may use cookies or similar storage and associate the visit with your account if you are logged in. Activation is based on your consent under Art. 6(1)(a) GDPR. Storage of or access to information on your device additionally falls under section 25(1) of the German TDDDG.
The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for YouTube, and Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA, for Vimeo. Processing outside the European Economic Area, particularly in the USA, is possible. You can end the connection by closing or reloading the page. This does not affect processing that has already occurred. Further details are available from the providers.
External links and social networks
Links to Facebook, Instagram, Google Maps, streaming platforms and other providers lead to their websites. These services are included as links in the film distribution section. Displaying a link does not load the external service; opening it is subject to that provider’s data processing and privacy policy.
This also applies to direct trailer links. The relevant provider is responsible for bookings, purchases, accounts and other information submitted on its website.
Recipients and international transfers
Within our company, access is limited to the people handling your enquiry. Where necessary, data is shared with technical service providers, business partners involved in film bookings, legal advisers or authorities where required by law.
Transfers outside the European Economic Area take place only under the conditions of Art. 44 et seq. GDPR, for example an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses. External providers explain recipients and transfer mechanisms in their own privacy policies.
Retention and security
We retain personal data for as long as it is needed for its purpose. Once an enquiry is resolved, the related data is deleted unless statutory retention duties or necessary evidence, for example to establish or defend claims, require continued storage. Business records are subject to the applicable commercial and tax retention periods.
We use appropriate technical and organisational measures to protect personal data. Unencrypted email communication cannot be completely protected against access by third parties.
Your privacy rights
Subject to the legal conditions, you have the following rights. To exercise them, contact verleih@kinostar.com or write to the postal address above.
- Access to your personal data (Art. 15 GDPR) and rectification of inaccurate data (Art. 16).
- Erasure (Art. 17) and restriction of processing (Art. 18).
- Data portability for automated processing based on consent or a contract (Art. 20).
- Withdrawal of consent at any time for the future; this does not affect the lawfulness of earlier processing (Art. 7(3)).
- Objection on grounds relating to your particular situation to processing under Art. 6(1)(f) (Art. 21). You can object to direct marketing at any time without giving reasons.
Complaints and updates
Under Art. 77 GDPR, you may complain to a supervisory authority, particularly in your place of residence, work or the alleged infringement. The authority responsible for our company is the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg, Germany.
We update this policy when our services, integrated providers or legal requirements change. The published version applies.