Privacy Policy
1. Introduction
Welcome to our website! We place the utmost importance on protecting your data and safeguarding your privacy. Below, we would like to explain what data we process, when, for what purpose, and on what legal basis. The aim is to explain how the services we offer work and how the protection of your personal data is ensured in the process.
According to Article 4(1) of the GDPR, personal data is any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly. Further information on this can be found, among other places, in Article 4(1) of the GDPR.
To the extent that we cite our legitimate interest or the legitimate interest of a third party (Article 6(1)(f) of the GDPR) as the legal basis for processing personal data, you have the right to object pursuant to Article 21 of the GDPR (see“2. Right to Object”).
To keep the following Privacy Policy clear and concise, we provide links in various places to information and privacy notices located on external websites (see also“16. Social Networks & External Links” in this Privacy Policy). We make every effort to keep the links listed in this privacy policy up to date. However, due to the constant updating of websites, it is possible that some links may not function correctly. If you notice such a link, we would appreciate it if you would let us know so that we can update the link.
2. Right to Object
Pursuant to Article 21 of the GDPR, you have the right to object to the processing of your personal data at any time. We will then no longer process your personal data for direct marketing purposes or for any related profiling.
We will also not process your personal data for other purposes following an objection, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims (see, for example, Art. 21(1) GDPR, the so-called “limited right to object”). In this case, you must provide reasons for your objection that arise from your specific situation.
You may also object to the processing of your personal data for reasons arising from your particular situation, where such processing is carried out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out in the public interest (see Art. 21(6) of the GDPR).
You may submit or notify us of your objection at any time (e.g., by email to datenschutz@filmstiftung.de).
3. Data Controller and Contact Person for Data Protection Matters
The data controller within the meaning of Article 4(7) of the GDPR for the processing of personal data is:
Contact information for the Data Protection Officer:
PROLIANCE GmbH
www.datenschutzexperte.de
Leopoldstr. 21
80802 Munich
Email: datenschutzbeauftragter@datenschutzexperte.de
If you have any questions regarding the processing of your personal data or your rights related to data protection, please contact:
Film- und Medienstiftung NRW GmbH
Legal Affairs
Deichmannhaus, Bahnhofsvorplatz 1
50667 Cologne
Email: datenschutz@filmstiftung.de
4. Visiting Our Website / Log Files
Every time you visit our website, we automatically collect data and information from your device’s system and store it in so-called server log files. This data consists of information relating to an identified or identifiable natural person (in this case: website visitors). The data is automatically transmitted by your browser when you visit our website. The following information is collected:
- Browser type and browser version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Time of the server request
- IP address
The purpose of this processing is to enable you to access our website from your device and to ensure that our website is displayed correctly on your device or in your browser. Furthermore, we use this data to optimize our website and to ensure the security of our systems. This data is not analyzed for marketing purposes.
The legal basis for this processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in presenting you with a website optimized for your browser and in enabling communication between our server and your device. The processing of your IP address is necessary, in particular, for the latter purpose.
As soon as the aforementioned data is no longer required to display the website, it will be deleted. Further storage may occur in individual cases if required by law.
The recipient of the data is our server host, which acts on our behalf under a data processing agreement.
The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are also not obligated to provide personal data. However, failure to provide such data may, under certain circumstances, result in your inability to use our website or to use it to its full extent.
6. Contacting Us
You can contact us by mail, phone, or email.
If you contact us by mail, we may process, in particular, your address information (e.g., last name, first name, street, city, ZIP code), the date and time the mail was received, and any data contained in your letter itself.
If you contact us by phone, we may process, in particular, your phone number and, if applicable and upon request during the call, your name, email address, the time of the call, and details regarding your inquiry. If you contact us via email, we will process, in particular, your email address, the time the email was sent, and any data contained in the body of the message (including attachments, if applicable).
The purpose of processing the above-mentioned data is to handle the contact request and to be able to contact the person making the request in order to address their inquiry.
The legal basis for the processing of personal data described here is Article 6(1)(f) of the GDPR. Our legitimate interest is to offer you the opportunity to contact us at any time and to be able to respond to your inquiries.
The personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.
The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are also not obligated to provide personal data. However, failure to provide such data could, under certain circumstances, result in your inability to contact us or our inability to contact you.
7. Your Data in the Grant Program
As part of the funding application process, we process the following personal data or categories of data:
- Name information
- Contact information
- Address information
- Identification data
- Place and date of birth
- Gender
- Biographical Information
- Filmography
- Bank Information
In connection with the awarding, implementation, and processing of grant applications and the disbursement of grant funds, the processed data is transferred to the following categories of recipients:
- Shareholders
- Board members
- Service providers entrusted with the administration of the funding
The legal bases for the processing of personal data described here are Article 6(1)(b) of the GDPR (for the purpose of taking pre-contractual measures) and Article 6(1)(e) of the GDPR (public interest). The processing of your personal data in connection with a grant application is carried out to fulfill and administer grant funding or to implement pre-contractual measures. Furthermore, the processing is carried out in the exercise of our grant-making mandate in accordance with our contractual basis with our shareholders.
The retention period for personal data processed in connection with grant projects is generally ten years from the conclusion of the grant, unless otherwise required by law.
The provision of personal data is contractually required and is also necessary for a funding decision. You are not obligated to provide personal data. However, failure to provide such data would mean that you cannot apply for or benefit from the funding we offer.
8. Contact and Networking Activities
For our contact and networking activities, we use the Microsoft Excel office program, the Microsoft Outlook office program, and the Microsoft Dynamics 365 CRM tool, Microsoft Corporation (“Microsoft”), One Microsoft Way, Redmond, WA 98052-6399, USA. In this context, we process the following personal data or categories of data:
- Contact information (salutation, title, first and last name—for you and your company, including employees and/or contributors—email address, mailing address, phone number)
- Information about your website
- Information provided by you that is necessary for conducting business or networking in connection with the assignment.
Through the integration of Microsoft services, Microsoft may collect information (including personal data) and process it. It cannot be ruled out that Microsoft may also transfer this information to a server in a third country.
Since the transfer of personal data to countries outside the EU is possible, additional safeguards are required to ensure the level of data protection mandated by the GDPR. For the United States, there is an adequacy decision by the European Commission pursuant to Article 45(1) of the GDPR regarding companies certified under the EU-U.S. Data Privacy Framework. Microsoft is certified under the EU-U.S. Data Privacy Framework and is therefore committed to complying with appropriate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search.
For more information, please refer to Microsoft’s privacy policy, which you can access here: Microsoft Privacy Policy – Microsoft Privacy
In the course of our activities, the data we process may be transferred to the following categories of recipients: Our shareholders and cooperation partners, organizers of networking events, distributors, and producers (regarding premiere invitations), as well as service providers entrusted with event management (see“9. Event Management”).
The legal bases for the processing of personal data described here are Art. 6(1)(b) GDPR (for the purpose of taking pre-contractual measures), Art. 6(1)(e) GDPR (public interest), and Art. 6(1)(f) of the GDPR (legitimate interest). The processing of your personal data in the context of contact and networking activities and event management is carried out either to implement pre-contractual measures and/or in the performance of our mandate in accordance with our contractual basis with our shareholders.
Your data will be stored until you revoke your consent.
9. Event Management
For our event management, we use the invitation and guest management tool Invitario, Invitario GmbH, Lohmühlenstraße 65, 12435 Berlin, Germany. In this context, we process the following personal data or categories of data:
- Contact information (salutation, title, first and last name—for you and your company, including employees and/or contributors—email address, mailing address, phone and fax numbers) and
- which of our events you have attended.
In the course of our activities, the data we process may be transferred to the following categories of recipients: our shareholders and cooperation partners, organizers of networking events, rental companies and producers, as well as service providers entrusted with event management.
The legal bases for the processing of personal data described here are Art. 6(1)(b) GDPR (for the purpose of taking pre-contractual measures), Art. 6(1)(e) GDPR (public interest), and Art. 6(1)(f) of the GDPR (legitimate interest). The processing of your personal data in the context of contact and networking activities and event management is carried out either to implement pre-contractual measures and/or in the performance of our mandate in accordance with our contractual basis with our shareholders.
Your data will be stored until you revoke your consent.
10. Information on Google Services
We use various services provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland, on our website.
For more detailed information about the specific Google services we use on this website, please refer to the privacy policy below.
By integrating Google services, Google may collect information (including personal data) and process it. It cannot be ruled out that Microsoft may also transfer this information to a server in a third country.
Since the transfer of personal data to countries outside the EU is possible, additional safeguards are required to ensure the level of data protection mandated by the GDPR. For the United States, there is an adequacy decision by the European Commission pursuant to Article 45(1) of the GDPR regarding companies certified under the EU-U.S. Data Privacy Framework. Google is certified under the EU-U.S. Data Privacy Framework and is therefore committed to complying with appropriate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search.
We ourselves have no control over what data Google actually collects and processes. However, Google states that, in principle, the following information (including personal data) may be processed:
- Log data (in particular, the IP address)
- Location-based information
- Unique application identifiers
- Cookies and similar technologies
For information on the types of cookies used by Google, please visit https://policies.google.com/technologies/types.
If you are signed in to your Google Account, Google may, depending on your account settings, add the processed information to your account and treat it as personal data. To this end, Google performs the following actions, among others:
If you are not signed in to a Google Account, we store the data we collect using unique identifiers linked to the browser, app, or device you are using. This allows us, for example, to ensure that your language settings are retained across all browser sessions.
If you’re signed in to a Google Account, we also collect data that we store in your Google Account and consider to be personal data. (https://www.google.com/intl/de/policies/privacy/index.html)
You can prevent this data from being added directly by signing out of your Google Account or by adjusting the relevant account settings in your Google Account. Furthermore, you can prevent the installation of cookies—to the extent that Google sets them—by adjusting the settings in your browser; however, please note that in this case, you may not be able to fully use all features of this website.
You can find out how to delete cookies in the most common browsers here, among other places:
- Google Chrome: Website
- Mozilla Firefox: Website
- Apple Safari: Website
- Microsoft Internet Explorer: Website
For more information, please refer to Google’s privacy policy, which you can access here: https://www.google.com/policies/privacy/
For information on Google’s privacy settings, visit https://privacy.google.com/take-control.html
11. Use of Matomo
We use Matomo on our website, a web analytics service provided by InnoCraft Ltd (“Matomo”), 7 Waterloo Quay, 6140 Wellington, New Zealand.
Matomo uses so-called “cookies,” which are text files stored on your device that enable an analysis of how you use the websites you visit. Matomo may also use so-called web beacons (invisible graphics). These web beacons allow information such as website traffic to be analyzed. The information generated by cookies and web beacons regarding the use of our website (including users’ IP addresses) is transmitted to a Matomo server—which may be located in New Zealand or other third countries—and stored there. This information may be shared by Matomo with its contractual partners.
Since the transfer of personal data to countries outside the EU is possible, additional safeguards are required to ensure the level of data protection mandated by the GDPR. For New Zealand, there is an adequacy decision by the European Commission pursuant to Art. 45(1) of the GDPR, which confirms a generally adequate level of data protection.
Matomo processes the following types of data:
- IP address
- URLs and page titles
- Referrer URLs
- Cookie IDs
- Geolocation data
In addition, you can find more detailed information about the data processed at https://matomo.org/faq/new-to-piwik/personal-data-matomo-analytics-collects-and-why/.
Furthermore, we have entered into a data processing agreement with InnoCraft Ltd. regarding the use of Matomo (Art. 28 GDPR). Matomo processes the data on our behalf to analyze your use of the website, to compile reports on website activity for us, and to provide us with other services related to website and internet usage. Matomo may transfer this information to third parties if required by law or if third parties process this data on Matomo’s behalf.
By integrating Matomo, our goal is to analyze user behavior on our website and respond accordingly. This enables us to continuously improve our offerings.
The purpose of processing the data collected as part of the consent form is to record your consent.
The legal basis for the processing of personal data described here in the context of the tracking process is your explicit consent pursuant to Art. 6(1)(a) of the GDPR.
The legal basis for processing the data collected in connection with obtaining your consent is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. We have a legitimate interest in being able to demonstrate the consent you have given to the measurement process (Article 7(1) of the GDPR).
In the context of data processing, Matomo is authorized to engage subcontractors. You can find a list of these subcontractors at https://matomo.org/matomo-cloud-dpa/finden.
12. Use of YouTube
We use YouTube videos on our website. YouTube is a service provided by YouTube LLC (“YouTube”), 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
YouTube is integrated by embedding the service on our website using a so-called “iFrame.” When this iFrame loads, YouTube or Google may collect information (including personal data) and process it. It cannot be ruled out that YouTube or Google may also transfer this information to a server in a third country.
Information regarding Google’s existing EU-U.S. Data Privacy Framework certification and other relevant details about data processing by Google in connection with the use of Google services can be found in this Privacy Policy under the section“10. Information on Google Services.”
We use YouTube in what is known as “Enhanced Privacy Mode.” According to the information provided by Google, this allows a video to be played without cookies tracking user behavior. We do not collect any data ourselves when you watch a YouTube video on our website.
By embedding YouTube, our purpose is to present various videos on our website so that you can watch them directly on our site.
The legal basis for the processing of personal data described here is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard lies in the significant benefits that YouTube offers. By embedding external videos, we reduce the load on our servers and can use those resources elsewhere. Among other things, this can increase the stability of our servers. YouTube and Google also have a legitimate interest in the (personal) data collected in order to improve their own services.
You can change your cookie settings (e.g., delete or block cookies, etc.). For more information, see“5. The Use of Cookies.”
The provision of personal data is neither required by law nor by contract, nor is it necessary for entering into a contract. You are also not obligated to provide personal data. However, failure to provide such data may, under certain circumstances, prevent you from using the content on our websites.
14. Job Applications and Application Management
On our website, we also offer you the opportunity to apply for advertised job openings and to send us your application via email.
If you contact us through this channel, your email address and the information contained in the message text and the application itself will be processed.
The purpose of processing your email address is to process the application and to be able to contact the applicant in response to the inquiry. The purpose of processing the personal data contained in the application documents you submit is to enable us to find a suitable candidate.
The legal basis for processing your email address is Article 6(1)(f) of the GDPR. Our legitimate interest is to offer you the opportunity to contact us at any time and to be able to respond to your inquiries. The legal basis for processing the personal data contained in the application is Article 6(1)(b), Article 88(1) of the GDPR, and Section 26(1) of the BDSG-neu.
The personal data will be processed only for as long as necessary to conduct the application process. If we reject the applicant’s application, the data will be deleted no later than six months after notification of the rejection. Processing of the data beyond this period will only take place if the applicant has given us their consent to do so.
17. Data Security
We protect our website and other systems against the loss, destruction, unauthorized access, alteration, or disclosure of your data by unauthorized persons through technical and organizational measures. However, despite regular checks, complete protection against all risks is not possible.
18. Retention Period for Personal Data
The duration of storage of personal data is determined by the relevant statutory retention requirements, e.g., under commercial and tax law. Upon expiration of the respective retention period, the corresponding data is routinely deleted. If data is necessary for the performance of a contract or for entering into a contract, or if we have a legitimate interest in continuing to store the data, the data will be deleted when it is no longer required for these purposes or when you exercise your right to revoke consent or object.
19. Your Rights
You generally have the following rights:
- The right, pursuant to Article 15 of the GDPR, to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
- The right, pursuant to Article 16 of the GDPR, to request without delay the rectification of inaccurate personal data or the completion of your personal data stored by us.
- The right, pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to assert, exercise, or defense of legal claims.
- The right, pursuant to Article 18 of the GDPR, to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, and we no longer need the data but you require it to assert, exercise, or defend legal claims, or you have objected to the processing pursuant to Article 21 of the GDPR.
- The right, pursuant to Article 20 of the GDPR, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another data controller.
- The right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR. As a general rule, you may contact the supervisory authority of the federal state where our registered office is located, as indicated above, or, if applicable, the supervisory authority of your usual place of residence or workplace.
- The right to withdraw consent pursuant to Article 7(3) of the GDPR. You have the right to withdraw your consent to the processing of data at any time with future effect. In the event of withdrawal, we will delete the relevant data immediately, unless further processing can be based on a legal basis that does not require consent. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal.
- The right to object pursuant to Art. 21 GDPR (see“2. Right to Object”). If we process your personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right under Article 21 of the GDPR to object to the processing of your personal data, provided this is based on reasons arising from your particular situation. If the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right to object without having to specify a particular situation.
We reserve the right to update this Privacy Policy as necessary, in compliance with applicable data protection regulations. This allows us to adapt it to current legal requirements and to account for changes to our services, such as the introduction of new services. The most current version applies to your visit.
Effective: September 1, 2026
16. Social Networks & External Links
In addition to this website, we also maintain a presence on various social media platforms, which you can access via the corresponding buttons on our website. If you visit such a platform, personal data may be transmitted to the provider of the social network.
Please note that user data may also be transferred to a server in a third country and may therefore be processed outside the European Union. U.S. providers certified under the EU-U.S. Data Privacy Framework have committed to complying with EU data protection standards. For more information, please visit https://www.dataprivacyframework.gov/.
In addition to storing the specific data you enter on this social media platform, the social network provider may also process other information.
Furthermore, the social media provider may process key data from the computer system you use to access the site—for example, your IP address, the type of processor used, and your browser version, including any plug-ins.
If you are logged into your personal user account on the respective network while visiting such a website, that network may associate the visit with your account.
For information on the purpose and scope of data collection by the respective platform, as well as the further processing of your data there and your related rights, please refer to the respective policies of the respective data controller, e.g., at:
We also note that our website contains links to external third-party websites; however, we have no influence over the processing of data on these third-party websites.