Privacy policy

1. Controller

The controller for data processing on this website is:

Mastlicht Studio UG (haftungsbeschränkt)
Frankfurter Landstraße 35
63452 Hanau, Germany
Email: hallo@mastlichtmedia.de

2. Hosting

This website is hosted by Hostinger. When you access the website, our hosting provider automatically records so-called server log files transmitted by your browser. These include in particular your IP address, the time of the request and the browser used (user agent). This data is collected solely to ensure the trouble-free and secure operation of the website and is not merged with other data sources. The legal basis is our legitimate interest in providing the website in a technically flawless manner (Art. 6(1)(f) GDPR).

3. Contact form and quick enquiry

If you send us an enquiry via the contact form or the quick enquiry (“Start your request”), the data you enter and select (company, name, email address, phone number, message as well as your choice of service, industry and timing) is stored by us for the purpose of processing your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry serves to initiate a contract, otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

Together with your message we transmit technical information about the origin of the enquiry: the page from which you submitted the form, the page through which you entered our website, the address of the referring website, any campaign parameters contained in the link you followed (for example utm_source, utm_medium, utm_campaign, utm_content, gclid, fbclid) and the broad device type (mobile device or desktop). This information serves solely to understand which content and campaigns lead to enquiries. We also transmit your choice in the cookie banner for the “Statistics” and “Marketing” categories (given or not given), so that we can respect your decision when we attribute an enquiry to one of our ads. The legal basis is our legitimate interest in running our website on a commercially informed basis (Art. 6(1)(f) GDPR).

So that the entry page is retained across several page views, it is stored in your browser’s session storage. This access to your device takes place only with your consent to the “statistics” category (Section 25(1) TDDDG); you can withdraw that consent at any time via the cookie settings. Without this consent nothing is stored, and the entry page transmitted is simply the page from which you submit the form. The entry is deleted automatically when you close the browser tab.

To prevent misuse and spam, the forms contain a field that is invisible to people and is only filled in by automated programs. Before a form is sent, your browser also solves a small computational task that our own server sets and checks. Nothing is stored in your browser for this and no third-party service is involved; the task contains no information about you. So that each solution is valid only once, the server keeps a hash value of the solved task until it expires after one hour, no personal data. The forms therefore cannot be sent without JavaScript; you can reach us by email or phone instead. In addition, when you submit a form, the server stores a hash value of your IP address, generated with a secret key (HMAC-SHA-256), together with the time of the request in a temporary file in order to reject multiple submissions within 10 seconds. For IPv6 addresses, only the first part of the address (the network prefix) is included in the hash value. Your IP address itself is not stored. The file is not analysed and not combined with other data. Entries older than 24 hours are deleted automatically the next time the forms are used. The server also limits the total number of enquiries per hour; for this purpose it stores only the times of the last hour, no personal data. The legal basis is our legitimate interest in operating the forms without abuse (Art. 6(1)(f) GDPR).

For the technical delivery of these emails we use the service Resend Inc. as a processor. This may involve a transfer of your data to the USA. Such transfers are based on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

4. Vimeo (two-click solution)

On individual pages we embed videos provided by Vimeo Inc. So that no data is transferred without your involvement, we use a two-click solution: videos are initially shown as a preview image only. A connection to Vimeo’s servers is established and the video is loaded only once you actively click the play button and consent to loading external media. Your consent is stored as consent to the “External media” category (Art. 6(1)(a) GDPR) and can be withdrawn at any time via “Cookie settings” in the footer. Before you give this consent, no data is transferred to Vimeo. This may involve a transfer of data to the USA; such transfers are based on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Once you click, Vimeo’s privacy terms apply. We additionally embed the video with the parameter dnt=1, which instructs Vimeo not to set any tracking cookies. You can find more information in Vimeo’s privacy policy: https://vimeo.com/privacy.

5. Fonts

The fonts used on this website are hosted locally on our own server. No connection is made to Google Fonts or any other external font provider, so no data is transferred to third parties in this context.

6. Cookies and consent (consent banner)

The first time you visit this website, a notice appears that lets you decide whether optional services (statistics, external media, marketing) may be loaded. Without your consent, only technically necessary functions are used; your choice itself is stored locally in your browser (localStorage) for this purpose (Art. 6(1)(f) GDPR — documenting and honouring your decision). You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.

7. Google Analytics

Provided that you have consented to the “Statistics” category via the consent banner, this website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable an analysis of your use of the website. Your IP address is truncated before processing (IP anonymisation); data may be transferred to servers of Google LLC in the USA, which is based on the EU-US Data Privacy Framework.

The legal basis is exclusively your consent (Art. 6(1)(a) GDPR). Without your consent, Google Analytics is not loaded and no analytics cookies are set. You can withdraw your consent at any time via “Cookie settings” in the footer — any analytics cookies that have been set (_ga) are deleted in the process. Further information: https://policies.google.com/privacy.

When you successfully submit the contact form or the quick enquiry, we send this to Google Analytics as an event. The event contains neither your contact details nor free text, only the type of page the enquiry came from, the language of the page and your choice among the given answers (service, industry, timing). As soon as you pick the first answer in the quick enquiry, we also report once that it was started. We use Google's consent mode: Google Analytics receives your choice from the consent banner with every request and processes the data accordingly.

8. Google Ads (conversion measurement)

We run ads via Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Provided that you have consented to the “Statistics” and “Marketing” categories, we measure whether an enquiry via the contact form or the quick enquiry goes back to one of our ads. For this purpose, the click ID from the ad link (gclid) is stored in a cookie (_gcl_au), and the event of the successful enquiry is transferred from Google Analytics to Google Ads. Google may link this data to your Google account if you are signed in. Data may be transferred to servers of Google LLC in the USA, which is based on the EU-US Data Privacy Framework.

The legal basis is exclusively your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent to “Marketing”, consent mode tells Google that no advertising cookies may be set and no data may be used for advertising purposes; the click ID is then removed from the data. You can withdraw your consent at any time via “Cookie settings” in the footer, which deletes any _gcl cookies that have been set. Further information: https://policies.google.com/technologies/ads.

9. Your rights

Within the scope of the applicable statutory provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of the data processing. You also have a right to rectification, erasure, restriction of processing and data portability, as well as a right to object to the processing of your personal data. You can contact us at any time regarding this and any other questions on the subject of data protection (contact details above).

In addition, you have the right to lodge a complaint with the competent supervisory authority. The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit).