PRIVACY & COOKIES
Contents
1. Name and Address of the Data Controller
2. General Information on Data Processing
3. Collection of Personal Data When Visiting Our Website
4. Use of Cookies
5. Use of WireDrive
6. Social Media
7. Email Contact
8. Data Processing in the Context of Customer Relationships
9. Data Processing in the Context of Your Job Application
10. Rights of the Data Subject
11. Updates and Changes to This Privacy Policy
The data controllers within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection regulations, are:
WhatIf Studio GmbH, represented by the managing directors: Juliane Ellrich and Frank Siegl, Waldowstrasse 64, 13053 Berlin, Germany. Tel.: +49 (0)30 403 633 60, Fax: +49 (0)30 403 633 601, Email: info@whatif.film
You can contact our Data Protection Officer at FINIENS DATA GmbH, Attn: Data Protection Officer, Markgrafenstr. 4, D-60497 Frankfurt am Main, Tel. +49 (0)69 209 758 900 or by email at datenschutz@zauberbergproductions.com. Any data subject may contact our Data Protection Officer directly at any time with questions or suggestions regarding data protection.
2.1. Scope of Personal Data Processing
We generally process our users' personal data only to the extent necessary to provide a functional website as well as our content and services. Otherwise, the processing of our users' personal data takes place only with the user's consent. An exception applies in cases where the processing of data is permitted by other legal grounds.
2.2. Legal Basis for the Processing of Personal Data
To the extent that we obtain the consent of the data subject for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures. To the extent that the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis. If the processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and freedoms of the data subject do not override the aforementioned interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.
2.3. Data Erasure and Retention Period
The data subject's personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Storage may also take place if this is provided for by European or national legislators in Union regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract. If the data of the data subject is not deleted because it is required for other legally permissible purposes, its processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data of the data subject that must be retained for commercial or tax law reasons (six years pursuant to Section 257(1) of the German Commercial Code (HGB) and ten years pursuant to Section 147(1) of the German Fiscal Code (AO)).
3.1. Informational Use of the Website
When you view our website, we or our hosting provider collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security:
For this purpose, we use the services of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Further information regarding the purpose and scope of data collection and its processing by the provider can be found in the provider's privacy policy: https://vercel.com/legal/privacy. The legal basis for the use of Vercel is Art. 6(1)(f) GDPR. We have entered into a Data Processing Agreement (DPA) with Vercel: https://vercel.com/legal/dpa. Since Vercel may use servers in the United States, we base the data transfer on the EU Commission's Standard Contractual Clauses. The data is stored for a period of fourteen days and then deleted. This data is not stored together with other personal data of the user.
This website does not use any type of cookies that process personal data or enable the identification of individuals through other methods.
We also use links to the provider WireDrive on our website to display videos. When you access a video on our website, a connection is established with the WireDrive servers, and the video is displayed. This transmits information to the WireDrive server regarding which of our web pages you have visited, which browser you are using, and your IP address. WireDrive also processes your personal data in the United States. The legal basis for the use of WireDrive is Article 6(1)(f) of the GDPR. WireDrive is operated by SHIFT Media Holdings, Inc., 374 Congress Street, Suite 506, Boston, MA 02210, USA. Further information on data processing and privacy notices can be found at https://www.wiredrive.com/privacy-terms/.
We currently use the following social media links on our website: Instagram and LinkedIn. We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to the social media providers. Only if you click on the respective link and thereby activate it will these platforms receive the information that you have accessed the corresponding page of our online offering.
The Instagram service is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Instagram Privacy Policy: http://instagram.com/about/legal/privacy/. Since Meta may use servers in the U.S., we base the data transfer on the Data Privacy Framework and the EU's Standard Contractual Clauses: https://help.instagram.com/272603474673152/.
The LinkedIn service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland. Privacy Policy: https://www.linkedin.com/legal/privacy-policy. Since LinkedIn may use servers in the United States, we base the data transfer on the Data Privacy Framework and the EU's Standard Contractual Clauses: https://legal.linkedin.com/dpa.
You can contact us via the email address(es) provided on our website. In this case, the user's personal data transmitted with the email will be stored and used exclusively for the purpose of handling the correspondence. The data will not be disclosed to third parties. The legal basis for processing the data is Article 6(1)(a) and (f) of the GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. The user has the option to withdraw their consent to the processing of personal data at any time. If the user objects to the storage of their personal data, all personal data stored in the course of the contact will be deleted.
Furthermore, we process various data pertaining to our existing and future customers, as well as involved service providers, suppliers, and third parties in accordance with Article 6(1)(b) of the GDPR to provide our contractual or pre-contractual services. Data will only be disclosed to third parties if this is necessary to fulfill our contractual obligations or if we are legally obligated to do so. Unless otherwise agreed, we delete the relevant data once storage is no longer necessary, generally after the expiration of contractual or legal claims, or restrict processing if statutory retention obligations apply.
We process personal data about you for the purpose of your application for employment, to the extent necessary for the decision regarding the establishment of an employment relationship with us. The legal basis is Section 26(1) in conjunction with Section 8(2) of the BDSG (new). Furthermore, we may process personal data about you to the extent necessary to defend against legal claims asserted against us arising from the application process. The legal basis in this case is Article 6(1)(f) of the GDPR.
The data you provide will be stored only for the duration of the evaluation and deleted upon completion, unless further retention is needed. Application data is generally retained for up to 6 months. If an employment relationship between you and us does not materialize, we may continue to store data to the extent necessary to defend against potential legal claims.
Upon request, we will provide you with information regarding which data we have stored about you. If you do not wish for us to continue storing your data, you may notify us of this; we will then delete your data immediately.
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
10.1. Right of access
You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request information on the purposes, categories, recipients, storage periods, origin of the data, and the existence of automated decision-making.
10.2. Right to Rectification
You have the right to request rectification and/or completion from the controller if the personal data concerning you that is being processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
10.3. Right to Restriction of Processing
You may request restriction of processing of your personal data if you contest its accuracy, the processing is unlawful and you oppose erasure, the controller no longer needs the data but you need it for legal claims, or you have objected to processing pursuant to Article 21(1) of the GDPR.
10.4. Right to Erasure
You may request that the controller immediately erase the personal data concerning you if it is no longer necessary for the purposes for which it was collected, consent has been withdrawn, you object to the processing and there are no overriding legitimate grounds, the data has been unlawfully processed, or erasure is required for compliance with a legal obligation. The right to erasure does not apply where processing is necessary for compliance with a legal obligation, for the establishment, exercise, or defense of legal claims, or for archiving or statistical purposes.
10.5. Right to be Informed
The controller is obligated to notify all recipients of your personal data of any rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.
10.6. Right to Data Portability
You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format, and to transmit it to another controller, provided the processing is based on consent or a contract and is carried out by automated means.
10.7. Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you pursuant to Article 6(1)(e) or (f) of the GDPR. If you wish to exercise your right to object, simply send an email to datenschutz@zauberbergproductions.com.
10.8. Right to Withdraw Consent
You have the right to withdraw your consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.
10.9. Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
10.10. Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
This Privacy Policy is currently valid and is effective as of March 2026. Due to the ongoing development of our website and the services offered through it, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. You may access and print the current version of this Privacy Policy at any time on our website.