The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Philip Gröning Filmproduktion eK, Leopoldstr. 69, 80802 München, Germany, registered at Amtsgericht München under HRA 22080, represented by its proprietor Philip Gröning. Contact: soundofloss@groening-film.de, Phone 0178 9424225.

We process personal data of users of this website only insofar as this is necessary to provide and operate the website and for project management. Processing is based on legal provisions, in particular the GDPR and the German Federal Data Protection Act (BDSG). Personal data is any information relating to an identified or identifiable natural person.

We use SSL/TLS to encrypt the transmission of data between your browser and our server.

The hosting provider (Cloudflare) automatically processes technical data on every call to this website (IP address, date and time of access, requested URL, referrer URL, browser and operating system). This data is used exclusively for the technical operation and security of the website and is not combined with other personal data. Processing is based on Art. 6 (1) lit. f GDPR (legitimate interest in the secure operation of the website).

To pre-fill the registration form with the likely correct country and center the conflict map on your location, our website determines your country of access. Cloudflare reads the country and approximate coordinates (city level) from the IP address of your request. This data is transmitted to your browser via a server function (Astro Action) and cached there in the tab session (sessionStorage) to avoid repeated queries. The data remains exclusively in your browser and is deleted when the tab is closed. It is not stored on our servers or passed on to third parties. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in user-friendly pre-selection). If you do not wish the data to be transmitted, you can continue to use the site — the country dropdown will then start empty and the map will show a default location.

This website does not use tracking cookies or analytics tools. Only technically necessary data (see Server log files) is processed. There is no transfer to advertising networks. Technically necessary cookies set by the browser to maintain the session or security are used without separate consent insofar as they are required for the operation of this website.

As part of the registration for the Sounds of Loss project, we collect the data entered in the registration form: name and email address of the contact persons as well as the data of the registered organization. This data is used exclusively for project management, communication and activation. The legal basis is Art. 6 (1) lit. b GDPR (performance of a contract or pre-contractual inquiries); the contractual basis is the terms of participation. Contact is made via the provided communication channel (email).

After confirmation of the organization and at least one contact person, the organization may be named as a reference for the project in public communication. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the public relations of the project). You can object to the naming at any time by sending an email to the address stated in the imprint.

We may inform the named contacts about potentially similar projects of this kind, unless you object. The legal basis is Art. 6 (1) lit. f GDPR. You can object to this use at any time by sending an email to the address stated in the imprint.

For the processing of participation fees we use the payment service provider Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). In the event of a payment, your payment data is transmitted exclusively to Stripe. Stripe processes this data independently in accordance with the provisions of the GDPR; the data processing agreement (Art. 28 GDPR, Data Processing Agreement) between us and Stripe forms part of the Stripe Services Agreement. Where Stripe transfers data to Stripe, LLC (USA), this is primarily based on Stripe's certification under the EU-U.S. Data Privacy Framework, alternatively on the standard contractual clauses (Data Transfers Addendum). Further information can be found in Stripe's privacy policy at stripe.com/en/privacy.

This website is hosted and protected against attacks via the network of Cloudflare Inc. (101 Townsend Street, San Francisco, CA 94107, USA) (CDN, WAF, DDoS protection). In doing so, Cloudflare processes technical data such as IP addresses, access times and requested resources. A data processing agreement (Art. 28 GDPR, Data Processing Addendum) is in place between us and Cloudflare. As Cloudflare also operates servers in the USA, data is transferred to a third country. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the secure and performant operation of the website). The transfer to the USA is primarily based on Cloudflare's certification under the EU-U.S. Data Privacy Framework (Art. 46 (2) lit. b GDPR); alternatively, the standard contractual clauses of the EU Commission (Art. 46 (2) lit. c GDPR), which are incorporated into the DPA, apply. Further information can be found in Cloudflare's privacy policy at cloudflare.com/privacypolicy.

We have taken appropriate technical and organisational measures in accordance with Art. 32 GDPR to ensure a level of protection appropriate to the risk for the processing of personal data: encryption of data transmission via SSL/TLS; access restrictions to processing systems through strong authentication; separate storage of payment data (at Stripe) and registration data (in Cloudflare KV); regular deletion of data no longer required; logged changes and accesses.

We do not carry out any automated decision-making or profiling within the meaning of Art. 22 GDPR.

Where we process data on the basis of Art. 6 (1) lit. f GDPR (legitimate interest), you have the right to object at any time to the processing on grounds relating to your particular situation (Art. 21 (1) GDPR). In the event of an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests. For processing carried out for the purposes of direct marketing, you also have an unconditional right to object (Art. 21 (2) GDPR). The objection can be made informally, ideally by email to the address given in the imprint.

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR).

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18-20, 91522 Ansbach, baylda.bayern.de. A list of further competent authorities can be found at the Federal Commissioner for Data Protection and Freedom of Information: bfdi.bund.de.

Personal data is deleted as soon as it is no longer required for the purposes for which it was collected. Registration data is retained for the duration of the project and up to 6 months afterwards for traceability, unless legal retention obligations (e.g. commercial law 6 or 10 years pursuant to § 257 HGB, § 147 AO) conflict with deletion. Server log files are deleted after a maximum of 30 days.

If you have given us explicit consent to process your personal data at any time, you can revoke it at any time. Revocation does not affect the lawfulness of the processing carried out up to that point. Note: Processing within the framework of this website and registration is not based on consent, but on the legal bases mentioned above (contractual necessity / legitimate interest).

We reserve the right to adapt this privacy policy so that it always corresponds to current legal requirements or when we implement changes to our services. The current privacy policy will apply from your next visit.

For questions on data protection you can reach us at the contact details given in the imprint.