Privacy Policy

Data Controller

International Film Festival Braunschweig e.V. (hereinafter referred to as the “Association”)
Neue Straße 8
38100 Braunschweig
Tel.: +49 (0)531 / 702 202 0
Fax: +49 (0)531 / 702 202-99

privacy(at)filmfest-braunschweig.de

Court of Registration: Braunschweig Local Court
Registration Number: VR 3342
Youth Protection Officer: Fabian Schauren (jugendschutz@kommunale-kinos.de)
Data Protection: privacy@filmfest-braunschweig.de

Board of Directors

Thorsten Rinke (Chair)
Florence Houdin (Chair)
Clemens Williges (Secretary)
Frank Beyer (Treasurer)
Andreas Richter (Board Member)
Haddijatou Jow (Board Member)

Responsible for content pursuant to § 55(2) RStV: Board of Directors of Internationales Filmfest Braunschweig e.V.

As of: September 23, 2024

Privacy Policy

General Information on Data Processing, Legal Bases, and the Security of Your Personal Data

This Privacy Policy explains which personal data is collected when you visit our websites as part of our online offering and the associated websites, and how this data is used. You have the right at any time to request, free of charge, information about the personal data we have stored about you. This Privacy Policy applies to the use of the websites www.filmfest-braunschweig.de, https://vp.eventival.com/biff/, and https://tickets.filmfest-braunschweig.de/, as well as our social media presences, hereinafter referred to as “online presences.”

The operators of the online presences take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this Privacy Policy. When accessing the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.

The users’ personal data processed within the scope of this online offering includes master data (e.g., names and addresses of customers), contractual data (e.g., accreditations, payment information), usage data (e.g., the web pages visited on our online service, interest in our program), and content data (e.g., entries in the contact form).

The term “user” encompasses all categories of individuals affected by data processing. These include our business partners, customers, prospective customers, and other visitors to our online service.

Please note that data transmission over the Internet (e.g., when communicating via email) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.

For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the data controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" prefix and the lock icon in your browser’s address bar.

Disclosure of Data to Third Parties and Third-Party Providers

Data is disclosed to third parties only within the scope of legal requirements. We only disclose user data to third parties if this is necessary, for example, on the basis of Article 6(1)(b) of the GDPR for contractual purposes or on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR for the economic and effective operation of our business.

If we use subcontractors to provide our services, we take appropriate legal precautions as well as corresponding technical and organizational measures to ensure the protection of personal data in accordance with the relevant legal provisions.

If, within the scope of this Privacy Policy, content, tools, or other resources from other providers (hereinafter collectively referred to as “third-party providers”) are used and their registered office is located in a third country, it is to be assumed that a data transfer to the countries where the third-party providers are based will take place. “Third countries” are defined as countries in which the GDPR is not directly applicable law, i.e., generally countries outside the EU or the European Economic Area. Data is transferred to third countries either when an adequate level of data protection is ensured, or when the user has given consent, or when there is some other legal authorization.

Collection of Personal Data When Visiting Our Websites

When you visit one of the association’s websites, your internet browser automatically transmits data to our web server. The following data is automatically collected and stored:
IP address

Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Amount of data transferred
Website from which the request originates
Browser
Operating system and its user interface
Language and version of the browser software.

The log file information is stored for a maximum of thirty days for security reasons (e.g., to investigate cases of misuse or fraud). Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.
This data is not combined with other data sources. Furthermore, we analyze the data in anonymized form for statistical purposes.

Cookies

Cookies are pieces of information that are transmitted from our web server or third-party web servers to users’ web browsers and stored there for later retrieval.

We use “session cookies,” which are stored only for the duration of your current visit to our website (e.g., to save your login status or the shopping cart function, thereby enabling you to use our online services at all). A session cookie stores a randomly generated unique identification number, known as a session ID. In addition, a cookie contains information about its origin and storage period. These cookies cannot store any other data. Session cookies are deleted once you have finished using our online service—for example, when you log out or close your browser.

If you do not want cookies to be stored on your computer, please disable the corresponding option in your browser’s settings. Stored cookies can be deleted in your browser’s settings. Disabling cookies may result in limited functionality of this online service.

Contacting Us

When you contact us (via email or social media), the user’s information is processed in accordance with Article 6(1)(b) of the GDPR for the purpose of handling the contact request and its follow-up.

The information you provide in the contact form, including the contact details you enter there, is stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not share this data without your consent.

Comments, Posts, Reviews

When users leave comments, reviews, or other posts, their IP addresses are stored for 7 days based on our legitimate interests within the meaning of Article 6(1)(f) of the GDPR.

This is done for our protection in case someone posts unlawful content in comments or posts (insults, prohibited political propaganda, etc.). In such a case, we ourselves could be held liable for the comment or post and are therefore interested in the author’s identity.

Registration on Our Online Platforms

We process master data (e.g., names and addresses, as well as users’ communication data), contractual data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and providing services in accordance with Article 6(1)(b) of the GDPR.

Users can, for example, create a user account in the MyBIFF section of our website or at www.online.filmfest-braunschweig.de. In particular, this is necessary for registration and login to our MyBIFF section, as well as for our events requiring registration, film submissions, accreditation, and on our streaming platform online.filmfest-braunschweig.de. During registration, users are informed of the required mandatory information. User accounts are not public and cannot be indexed by search engines.

We require this personal data for the following purposes:

Processing film and project submissions
Granting access permissions to private events
Registration/registration for events with limited attendance
Use of the online ticket sales feature
Collection of statistical data
If you are registered with us, you can access content and services that we offer exclusively to registered users. To contact us regarding this matter, please use the contact information provided at the end of this Privacy Policy.

Processing of Accreditation

When submitting or registering a film or project, you may also provide personal data belonging to third parties. Please ensure in advance that you have the consent of the individuals concerned to share this data with us.

We treat user data confidentially and store it on secure servers. Personal data that you enter via forms outside the MyBIFF area is processed by us via email and is therefore stored on our mail server. When registering as a volunteer, we use the Formlets service. We may also use Google and SurveyMonkey.

Privacy Policies:
Formlets www.formlets.com/privacy/
Google www.policies.google.com/privacy?hl=de&gl=de
SurveyMonkey www.surveymonkey.de/mp/legal/privacy-policy/?ut_source=footer

As part of the registration process, subsequent logins, and the use of our online services, we store the IP address and the time of each user action. This data is stored based on our legitimate interests, as well as those of users, in protecting against misuse and other unauthorized use. This data is generally not disclosed to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) of the GDPR.

Unless otherwise agreed, consent to the storage of data remains valid until the expiration of this policy. Users of our website will automatically be prompted to provide their consent again in the event of changes to this policy.

If users have terminated their user account, their data related to the user account will be deleted, unless retention is necessary for commercial or tax law reasons in accordance with Article 6(1)(c) of the GDPR. It is the responsibility of users to back up their data prior to the termination of the contract. We are entitled to irrevocably delete all user data stored during the term of the contract.

The following information explains the content of our newsletters, as well as the registration, distribution, and statistical analysis procedures, and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described herein.

Newsletter Content: We send newsletters, emails, and other electronic notifications containing promotional information (hereinafter “newsletters”) only with the recipients’ consent or when permitted by law. If the newsletter’s content is specifically described during the subscription process, that description is decisive for the user’s consent. In addition to our festival newsletter, the industry newsletter featuring industry news, and educational newsletters with information about our offerings for teachers and their school classes, we also send out a daily newsletter during the festival week.

Double opt-in and logging: Subscription to our newsletter is carried out via a so-called double opt-in process. This means that after signing up, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can sign up using someone else’s email address. Newsletter sign-ups are logged to provide proof of the sign-up process in accordance with legal requirements. This includes storing the time of sign-up and confirmation, as well as the IP address. Changes to your data stored with the email service provider are also logged.

Subscription Data: To subscribe to the newsletter, simply provide your email address. Optionally, we ask you to provide your first and last name. This information is used solely to personalize the newsletter.

The use of the email service provider, the conduct of statistical surveys and analyses, and the logging of the registration process are based on our legitimate interests pursuant to Art. 6(1)(f) of the GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves both our business interests and meets users’ expectations.

Cancellation/Withdrawal: You may cancel your subscription to our newsletter at any time, i.e., withdraw your consent. A link to unsubscribe from the newsletter can be found at the end of each newsletter. You may unsubscribe from the newsletter at any time by emailing presse(at)filmfest-braunschweig.de.

External Payment Service Providers

We use external payment service providers through whose platforms users and we can conduct payment transactions:

PayPal https://www.paypal.com/de/webapps/mpp/ua/privacy-full
SOFORT Überweisung/Klarna https://www.klarna.com/de/datenschutz/
Arvato Bertelsmann https://www.arvato.com/de/ueber-arvato/datenschutz.html
Concardis https://www.concardis.com/datenschutzerklaerung

Stripe https://stripe.com/de/privacy

We use these payment service providers in connection with the fulfillment of contracts based on Article 6(1)(b) of the GDPR. In addition, we use external payment service providers based on our legitimate interests pursuant to Article 6(1)(b) of the GDPR to offer our users effective and secure payment options.

The data processed by the payment service providers includes personal information, such as name and address; banking information, such as account numbers or credit card numbers; passwords, TANs, and checksums; as well as details related to the contract, transaction amounts, and recipients. This information is required to process the transactions. However, the data entered is processed and stored solely by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information confirming or rejecting the payment. Under certain circumstances, the payment service providers may transmit the data to credit bureaus. The purpose of this transmission is to verify identity and creditworthiness. For more information on this, please refer to the terms and conditions and privacy policies of the respective payment service providers.

Payment transactions are governed by the terms and conditions and privacy policies of the respective payment service providers, which are available on their respective websites or within the transaction applications. We also refer you to these documents for further information and to exercise your rights of withdrawal, access, and other data subject rights.

Social Media Presence

We maintain online presences on social networks and platforms to communicate with customers, prospective customers, and users active there and to inform them about our services.

Please note that this may involve the processing of user data outside the European Union. This may pose risks to users, as it could, for example, make it more difficult to enforce their rights. With regard to U.S. providers certified under the Privacy Shield, we note that they thereby commit to complying with EU data protection standards.

Furthermore, user data is generally processed for market research and advertising purposes. For example, usage profiles can be created based on users’ behavior and the resulting interests. These user profiles can in turn be used, for example, to display advertisements both within and outside the platforms that are presumed to correspond to users’ interests. For these purposes, cookies are typically stored on users’ computers, in which users’ usage behavior and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by users (particularly if users are members of the respective platforms and are logged in to them).

The processing of users’ personal data is based on our legitimate interests in effectively informing users and communicating with them in accordance with Article 6(1)(f) of the GDPR. If users are asked by the respective providers to consent to data processing (i.e., to give their consent, for example, by checking a box or clicking a button), the legal basis for the processing is Art. 6(1)(a) and Article 7 of the GDPR.

For a detailed description of the respective processing activities and the options for objecting (opt-out), please refer to the providers’ information linked below. We also note that requests for information and the exercise of user rights can most effectively be addressed directly with the providers. Only the providers have access to the users’ data and can directly take appropriate measures and provide information. If you still need assistance, however, you can contact us.

Facebook ( Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
Privacy Policy: www.facebook.com/about/privacy/, Opt-Out: www.facebook.com/settings and www.youronlinechoices.com, Privacy Shield: www.privacyshield.gov/participant.

Google/YouTube ( Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Privacy Policy: policies.google.com/privacy, Opt-Out: adssettings.google.com/authenticated, Privacy Shield: www.privacyshield.gov/participant.

Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA)
Privacy Policy / Opt-out: instagram.com/about/legal/privacy/.

Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA)
Privacy Policy: twitter.com/de/privacy, Opt-Out: twitter.com/personalization, Privacy Shield: www.privacyshield.gov/participant.

Flickr (Flickr, 475 Sansome St, San Francisco, CA 94111, USA)
Privacy Policy/Opt-Out: policies.oath.com/ie/de/oath/privacy/products/flickr/index.html.

Integration of Google Maps

Some of our web pages use maps from the “Google Maps” service provided by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to visually display geographic information (e.g., an overview of festival locations). When using Google Maps, Google also collects, processes, and uses data regarding visitors’ use of the map features. For more information about Google’s data processing, please refer to Google’s Privacy Policy. There, you can also change your personal privacy settings in the Privacy Center. Privacy Policy: www.google.com/policies/privacy/; Opt-Out: www.google.com/settings/ads/

Embedded YouTube Videos

We embed YouTube videos on some of our web pages. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit a page with the YouTube plugin, a connection is established to YouTube’s servers. This informs YouTube which pages you are visiting. If you are logged into your YouTube account, YouTube can associate your browsing behavior with you personally. You can prevent this by logging out of your YouTube account beforehand.

When a YouTube video is played, the provider uses cookies to collect information about user behavior. If you have disabled the storage of cookies for the Google Ads program, you will not have such cookies stored even when watching YouTube videos. However, YouTube also stores non-personally identifiable usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in your browser. For more information on the handling of user data, please see YouTube’s Privacy Policy at: www.google.de/intl/de/policies/privacy/

Embedded Vimeo Videos

We embed Vimeo videos on some of our web pages. Vimeo is operated by Vimeo, LLC, headquartered at 555 West 18th Street, New York, New York 10011, USA. When you visit a page with the Vimeo plugin, a connection is established to the Vimeo servers, and the plugin is displayed. This transmits information to the Vimeo server about which of our web pages you have visited. If you are logged in to your Vimeo account at that time, Vimeo associates this information with your personal user account. When you use the plugin—for example, by clicking the play button on a video—this information is also associated with your user account. You can prevent this association by logging out of your Vimeo user account before using our website and deleting the corresponding Vimeo cookies. For more information on data processing and Vimeo’s privacy policy, visit vimeo.com/privacy

Adobe Typekit Fonts

Based on our legitimate interests (i.e., our interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) of the GDPR), we use external “Typekit” fonts provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland. Adobe is certified under the Privacy Shield Framework and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TNo9AAG&status=Active).

User Rights

Users have the right at any time, upon request and free of charge, to receive information about the personal data we have stored about them. In addition, users have the right to have inaccurate data corrected, to restrict the processing of their personal data, and to have their personal data deleted. Users may also revoke their consent, generally with effect for the future.

If you wish to request information about your personal data, or to have it corrected or deleted, please contact our Data Protection Officer at

Internationales Filmfest Braunschweig e.V.
Neue Straße 8
38100 Braunschweig
Tel.: +49 (0)531 / 702 202 0
Fax: +49 (0)531 / 702 202-99
privacy(at)filmfest-braunschweig.de

Right to Object

Users may object at any time to the future processing of their personal data in accordance with legal requirements. In particular, the objection may be directed against processing for direct marketing purposes.

Changes to the Privacy Policy

We reserve the right to amend the Privacy Policy to adapt it to changes in the legal landscape or to modifications to the service and data processing. However, this applies only with regard to statements concerning data processing. If user consent is required or if parts of the Privacy Policy contain provisions governing the contractual relationship with users, changes will only be made with the users’ consent. Users are asked to review the content of the Privacy Policy regularly.

Sources: Fishfarm Solutions, Privacy Policy Generator
by activeMind AG; Attorney Dr. Thomas Schwenke