Data Protection Policy
As a wholly owned subsidiary of the Federal Republic of Germany, Transit Film GmbH has entered a contract with the Federal Republic of Germany, regarding the exploitation of federally owned weekly newsreels and films.
The management of Transit Film GmbH considers data protection a top priority. It is generally possible to use the website of Transit Film GmbH without having to provide any personal data. If a data subject wants to take advantage of special services of our company through our website, the processing of personal data may become necessary. When the processing of personal data becomes necessary and when there is no lawful basis for such a processing, we generally obtain the consent of the data subject.
The processing of personal data, such as name, address, E-Mail address or telephone number of a data subject will always be in accordance with the General Data Protection Regulation (GDPR) and in accordance with the country specific data protection regulation that Transit Film GmbH is subject to. Our company would like to use this data protection policy to inform the public about the method, scope and purpose of the personal data we collect, use and process. In addition, this data protection policy informs data subjects about their rights.
As the controller of processing Transit Film GmbH has taken numerous technical and organisational measures to ensure end-to-end data protection of the personal data processed here on this website. Nevertheless, Internet based data transfer may categorically exhibit security flaws so that an absolute protection may not be ensured. For this reason each data subject has the option to use alternative channels, such as the telephone, to relay personal data to us.
Transit Film GmbH’s data protection policy is based on terminology used by the European legislator for the issuing of the General Data Protection Regulation (GDPR). Our data protection policy is meant to be easily legible and comprehensible both to our clients and business partners. To ensure this we would like to explain the terminology we use:
In this data protection policy we use the following terms inter alia:
a) Personal data
Personal data means any information relating to an identified or identifiable natural person (in the following „data subject“). An identified natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
b) Data subject
A data subject is any identified or identifiable natural person, whose personal data is processed by the controller.
c) Data processing
Processing means any operation or set of operations performed upon personal data, whether or not by automatic means, such as collecting, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
d) Restriction of data processing
Restriction of processing means the marking of stored personal data with the aim to limit their processing in the future.
Profiling means any kind of automated processing of personal data consisting of the use of that personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.
Pseudonymisation means the processing of personal data in a such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that the additional information is stored separately and is subject to technical and organisational measures that ensure that the personal data cannot be attributed to an identified or identifiable natural person.
Controller means the natural or legal person, public authority, institution or other body, which alone or jointly with others determines the purposes and means of the processing of personal data. If the purposes and means of this processing are determined by union law or member state law, the controller or certain criteria for the controller’s nomination may be provided for by union law or member state law.
Processor means a natural or legal person, public authority, institution or other body, which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, institution or other body, to which the personal data are disclosed, regardless of whether they are a third party or not. Public authorities, which may receive personal data in the framework of a specific inquiry in accordance with union law or the member state law, are not considered recipients.
j) Third parties
Third party means a natural or legal person, public authority, institution or other body other than the data subject, controller, processor and persons, who under the direct responsibility of the controller or processor are authorised to process personal data.
Consent means any freely given specific, informed and unambiguous indication of the data subject’s wishes by which she or he, either by a statement or an by another clear affirmative action, signifies agreement to personal data relating to him or her being processed.
Cookies are text files that contain information about the use of our website (pages visited, number of visits, visiting hours, time spent on individual pages, used browser, operating system, etc.), which are stored on your computer's hard drive, if you allow this using the settings in your browser. Cookies cannot run programs or deliver viruses to your computer.
Name and address of data controller
Controller in terms of the General Data Protection Regulation, as well as other data protection laws in the member state of the European Union and other regulations that have the character of data protection is:
Transit Film GmbH
Dachauer Str. 35
Phone: +49 89 599 88 50
Recording of general data and information
Whenever the website of Transit Film GmbH www.transit-digital.de is visited by the data subject or an automated system it records a number of general data and information. The general data and information are stored in the server’s log files. Items that may be collected are (1) the types of browser used and their versions, (2) the operating system used by the system accessing our website, (3) the website from which a system accesses our website (so called referrer), (4) the subpages, which are accessed by a system on our website, (5) the date and time our website was accessed, (6) an Internet Protocol Address (IP), (7) the internet service provider of the system accessing our website and (8) other similar data and information that helps to avert threats in the event that our information technology systems (IT) are attacked.
Transit Film GmbH does not use this general data and information to draw conclusions about the data subject. Instead, this information is necessary to (1) correctly deliver our website’s content, (2) to optimise the content of our website and the advertising for it, (3) to ensure the proper permanent viability of our IT systems and our website’s technology, and (4) to provide law enforcement authorities with the information required for prosecution in the event of a cyber attack. These data and information, which are collected anonymously, are therefore analysed statistically by Transit Film GmbH, in part with the objective of increasing our company’s data protection and data security and thus ultimately ensuring an ideal level of protection for the personal data we process. The anonymous data in the server log files is stored separately from all personal data provided by a data subject.
Registration on our website
Data subjects have the option to register on our website www.transit-digital.de, which involves providing personal data. Which personal data are transmitted to the controller is defined in the input screen used for registration. The data subject’s personal data is collected and stored solely for internal use of the controller and for our own specified purpose. The controller may authorise the disclosure of personal data to one or more processors, such as a parcel delivery service, which may only use them for internal use ascribed by the controller.
When the data subject registers on the controller’s website the IP address assigned by his or her Internet service provider (ISP) is stored as well as the date and time of registration. This data is stored because it is the only way to prevent misuse of our services, and in the event that a criminal act is investigated the data may be used. In this respect, the storage of this data is a necessary safeguard for the controller. We principally do not transfer data to third parties, unless we are legally obliged to do so or unless the transfer occurs on behalf of criminal prosecution.
The personal data which the data subject voluntarily provides when registering helps the controller to offer the data subject content or services that may only be offered to registered users due to the nature of the matter. Registered persons have the option to change the personal data they provided during the registration at any time or have them completely erased from the controller’s database.
Upon demand, at any time, the controller will inform the subject data which of his or her personal data is stored. The controller will also rectify or erase personal data at the request or indication of the data subject, provided there is no legal obligation to keep them. The data subject may contact the data protection officer named in this data protection policy as well as any of the controller’s employees in this context.
Subscribing to our newsletter
Users have the option to subscribe to our company’s newsletter on our website www.transit-digital.de. The personal data sent to us when a newsletter is ordered is defined in the input screen used for subscribing.
Transit Film GmbH regularly informs their clients and business partners about any company offerings through a newsletter. Data subjects can only receive our company newsletter if (1) he or she has a valid email address and (2) he or she has registered for the newsletter. The law requires us to send a confirmation message through the double opt-in method to the E-Mail address the data subject has specified when subscribing to the newsletter. This confirmation message helps us verify that the owner of the E-Mail address is the data subject and has authorised receipt of the newsletter.
When the data subject registers for the newsletter, we also store the IP address assigned by his or her Internet service providers (ISP) to the system they used at the time of registration, as well as the date and time of registration. This data must be collected in order to ascertain any (possible) misuse of a data subject’s E-Mail address at a later time, and thus is a legal safeguard for the controller.
The personal data collected during registration for the newsletter is used solely for purpose of sending out the newsletter. In addition, newsletter subscribers may be notified by E-Mail if this is necessary for the operation of the newsletter service or if further registration is required, such as may be the case if the newsletter offer or the technical conditions change. The personal data collected as part of the newsletter service is not passed on to third parties. Data subjects can cancel the subscription to the newsletter at any time. Data subjects can, at any time, withdraw their consent to storage of personal data they have given us for the distribution of the newsletter. Every newsletter contains a link that can be used to withdraw consent. Data subjects can also cancel their subscriptions to the newsletter at any time directly on the controller’s website or use other means to notify the controller of their requests to cancel.
Transit Film GmbH’s newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic that is embedded in E-Mails sent in HTML format in order to enable recording and analysis of log files. It is used when conducting statistical evaluation of the success or lack of success of online marketing campaigns. The embedded tracking pixel allows Transit Film L.L.C to recognise whether and when a data subject has opened an E-Mail message and what links in the E-Mail were opened.
The controller stores and analyzes the personal data collected by tracking pixels contained in the newsletters in order to optimise the newsletter distribution and tailor the content of future newsletters even better to the interests of the data subject. This personal data will not be transmitted to third parties. Data subjects can, at any time, withdraw the separate consent they have given to this practice, which uses the double opt-in method. The controller erases any personal data after the consent has been withdrawn. When a subscription to our newsletter is cancelled Transit Film GmbH automatically interprets that as a withdrawal.
What services do we use for tracking and analysis on the website?
The website uses various website analysis and tracking services, which we will explain in more detail below. The legal basis for this form of data collection is Article 6 (1) (f) GDPR. Our legitimate interest lies in the optimization of our services and the marketing of our offers. You have the right to object to this data usage according to Art. 21 GDPR.
When using this website, the integration of external tracking services in individual cases will send data to recipients in the USA. In these cases, we make sure that the data transfer between the EU and the USA has been legitimized by data protection law. The data transfer is usually based on certification by the EU-US Privacy Shield, according to which American organizations commit themselves to a catalog of data protection principles. With regard to such transmission, the Commission has established the adequacy of the level of data protection by a decision of 12 July 2016, see eur-lex.europa.eu/legal-content/EN/TXT/PDF. If no Privacy Shield certification is available, we have agreed with our service providers standard contractual clauses within the meaning of Art. 46 para. 2 c) GDPR.
a) Google AdWords
Our website uses the Google Adwords service. Google AdWords is an online advertising program of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA94043, USA ("Google").
In addition, we use the so-called conversion tracking as part of the use of the Google AdWords Service. When you click on an ad put at disposal by Google, a conversion tracking cookie will be placed on your computer / device. These cookies lose their validity after 30 days, contain no personal data and are thus not used for personal identification. The information obtained using the conversion cookie is used to generate conversion statistics for AdWords advertisers who have opted for conversion tracking.
You may prevent the storage of cookies by a corresponding setting of your browser software; however, please note that if you do this, you may not be able to use all the features of this website to the fullest extent possible. In addition, you can disable interest-related ads on Google and interest-related Google ads on the web (within the Google Display network) in your browser, by selecting the "Off" button under http://www.google.de/settings/ads activate the off button or make the deactivation under http://www.aboutads.info/choices/ For more information about its settings and the privacy on Google see https://www.google.de/intl/de/policies/privacy/?fg=1.
b) Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called "cookies", text files that are stored on your computer and that allow an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is enabled on this website, your IP address will first be truncated by Google within the member states of the European Union or other parties to the agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred and truncated to a Google server in the USA Google will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity, and to provide other services regarding website activity and internet usage for the website operator. The IP address transmitted by your browser as part of Google Analytics is not conflated with other Google data. This website uses Google Analytics with the extension "anonymizeIp". As a result, IP addresses are further processed in truncated form, so that reference to individuals can be ruled out.
Opt-out: You can prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) to Google as well as the processing of this data by Google for both Google Analytics and Google Universal Analytics, by using the Download and install the browser plug-in that is available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
Contact us through our website
In compliance with legal regulations, our websites www.transit-digital.de and www.transitfilm.de contain information that enables rapid electronic contact and immediate communication with us, which also comprises a general address of so-called electronic mail (E-Mail address). If the data subject contacts the controller by E-Mail or uses a contact form, the personal data he or she sends is automatically stored. Such personal data given voluntarily by the data subject to the controller in this way are stored so that the request can be handled or the data subject be contacted. We will not transmit this personal data to any third parties.
Routine deletion and blocking of personal data
The controller processes and stores the subject data’s personal data only for the time that is required to reach the data retention purpose or to the extent provided by the European legislator or any other legislator in laws and regulations to which the controller is subject to.
When the storage purpose is no longer applicable or if a storage period prescribed by the European legislator or any another authorised legislator expires, the personal data is routinely blocked or deleted in accordance with legal regulations.
Rights of the data subject
a) Right of confirmation
The European legislator grants each data subject the right to obtain from the controller confirmation as to whether or not they will process their personal data. If a data subject wants to exercise this right of confirmation they can contact our data protection officer or any other of the controller’s employees.
b) Right of access
The European legislator grants each data subject the right to obtain from the controller information about his or her personal data stored at any time and free of charge as well as a free copy of this information. Furthermore, the GDRP grants the data subject the right to access to the following information:
- the purposes of processing;
- the categories of data being processed;
- the recipients or categories of recipients with whom the personal data has been shared or will be shared, in particular recipients in third countries or international organisations;
- when possible the anticipated period for which the personal data will be stored, or when this is not possible, the criteria used to determine that period;
- the existence of the rights to rectification or erasure of his or her personal data or the restriction of processing by the controller or the right to object to processing;
- the existence of the right to file a complaint with a supervisory authority;
- where the personal data were not collected from the data subject: all information relating to the source of the data;
- o the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR—at least in those cases—an explanation about the logic involved, as well as the significance and the anticipated consequences of such processing for the data subject.
The data subject shall also have the right to obtain information as to whether their personal data was transmitted to a third country or to an international organisation. In the case of a transfer the data subject shall have the right to information regarding appropriate safeguards in the context of the data transfer.
If a data subject wants to exercise this right of access, he or she can contact our data protection officer or any other of the controller’s employees at any time.
c) Right to rectification
The European legislator grants each data subject the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. The data subject shall also have the right—taking into account the purposes of the processing—to have incomplete personal data completed, including by means of providing a supplementary statement.
If a data subject wants to exercise this right of rectification, he or she may contact our data protection officer or any other of the controller’s employees at any time.
d) Right to erasure (right to be forgotten)
The European legislator grants each data subject the right to obtain from the controller, without undue delay, the erasure of personal data concerning him or her where one of the following grounds applies and where processing is not necessary:
- the personal data are no longer necessary to the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent on which the processing is based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and where there are no legal grounds for processing;
- the data subject objects to the processing pursuant to Article 21(1) GDPR and there are no over-riding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2);
- the personal data were unlawfully processed;
- the personal data must be erased in compliance with a legal obligation in union or member state law, to which the controller is subject;
- o the personal data have been collected in relation to the offer of information society services pursuant to Art. 8(1).
Where one of the above grounds applies and a data subject wants to prompt the erasure of personal data stored at Transit Film GmbH they may contact our data protection officer or any other of the controller’s employees at any time. Transit Film GmbH’s data protection officer or another employee will ensure that the request for erasure will promptly be fulfilled.
Where Transit Film GmbH has made the personal data public and where our company as the controller is obliged to erase the personal data pursuant to Art. 17(1) DPRG, taking into account available technology and the cost of implementation, Transit Film GmbH shall take reasonable steps, including technical measures, to inform other controllers, who process the publicised personal data, that the data subject has requested the erasure by such controllers of any links to, or copies or replications of these personal data, where processing is not required. Transit Film GmbH’s data protection officer or another employee will prompt any necessary action on a case-by-case basis.
e) Right to restrict the processing of personal data
The European legislator grants each data subject the right to obtain from the controller the restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a duration enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful, the data subject objects to the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the establishment, exercise or defence of legal claims;
- the data subject has objected to the processing pursuant to Art. 1(1) GDPR and it is not confirmed yet whether the legitimate grounds of the controller override those of the data subject.
Provided that one of the above premises applies and a data subject wants to obtain the restriction of personal data stored at Transit Film GmbH, he or she may contact our data protection officer or any other of the controller’s employees at any time. Transit Film GmbH’s data protection officer or another employee will prompt the restriction of the processing.
f) Right to data portability
The European legislator grants each data subject the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. He or she also has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on the consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b), and the processing is carried out by automated means, where the processing is not necessary to exercise a task carried out in the public interest or in the exercise of official authority, that the controller has been assigned.
In exercising his or her right to data portability pursuant to Art. 20(1) GDPR, the data subject shall have the right to have personal data transmitted directly from one controller to another controller, where technically feasible and where the rights and freedoms of other persons are not affected.
If the data subject wants to exercise this right of data portability he or she may contact Transit Film GmbH’s appointed data protection officer or another employee at any time.
g) Right to object
The European legislator grants each data subject the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her, based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.
Transit Film GmbH will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where Transit Film GmbH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data for such marketing purposes. This also applies to profiling to the extent that is related to such direct marketing. Where the data subject objects to Transit Film GmbH processing for direct marketing purposes, Transit Film GmbH shall no longer process the personal data for such purposes.
Where personal data stored at Transit Film GmbH are processed for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, the data subject, based on grounds relating to their specific situation, shall have the right to object, unless the processing is necessary for the performance of a task carried in the public interest.
If the data subject wants to exercise this right to object he or she may directly contact Transit Film GmbH’s data protection officer or any other employee. Also, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means that use technical specifications.
h) Automated individual decision-making, including profiling
The European legislator grants each data subject the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning him or her or similarly significantly affects him or her, provided the decision (1) is not necessary for entering into, or performance of a contract between the data subject and the controller, or (2) is authorised by union or member state law to which the controller is subject and which also contain appropriate safeguards to protect the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.
If the decision (1) is necessary for entering into or performance of a contract between the data subject and the controller or (2) is based on the data subject’s explicit consent, Transit Film GmbH shall implement appropriate safeguards to protect the data subject’s rights and freedoms and legitimate interests, which includes as the very minimum, the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
If the data subject wants to exercise this right in regards to automated decisions he or she may contact the controller’s data protection officer or any other employee at any time.
i) Right to withdraw consent
The European legislator grants each data subject the right to withdraw his or her consent concerning the processing of his or her personal data at any time.
If the data subject wants to exercise their right to withdraw consent they may contact the controller’s data protection officer or any other employee at any time.
Lawful basis for data processing
Art. 6(1)(a) GDPR is our company’s legal basis for data processing, for which we obtain consent for a specific processing purpose. When the processing of personal data is necessary for the performance of a contract, to which the subject data is party, as this may be the case in the processing procedures, that are necessary for the delivery of goods or the performance of services or return services, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing that is necessary for the implementation of pre-contractual measures, as may be the case when inquiring about our products or services. Personal data may be processed if it is necessary for our company’s compliance with a legal obligation, for example the fulfilment of tax obligations, pursuant to Art. 6(1)(c) GDPR. In rare cases the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This might for example be the case, when a visitor is injured in our company and his or her name, age or health insurance data or any other vital information must be disclosed to a doctor, a hospital or other third party. In this case the processing would be based on Art. 6 (1) (d) GDPR. Ultimately processing may be based on Art. 6(1)(f) GDPR. Any data processing that is not comprised by the preceding lawful bases are based on that lawful basis, when the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights of the data subject. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. Latter is of the opinion that a legitimate interest may be assumed where the data subject is a client of the controller (recital 47 (2)).
Legitimate interests in processing personal data, which may be pursued by the controller or by a third party
Where personal data is processed based on Art. 6(1)(f) GDPR, our legitimate interest is the performance of our business operation in favour of the benefit of our employees and our shareholders.
Data retention period
The respective legal retention period determines the period of storing of personal data. After the retention period has ended the respective data shall be erased routinely, provided they are not necessary for the performance of the contract or contract negotiations.
Provision of personal data as statutory or contractual requirement; necessity of a formal contract; obligation of data subjects to provide personal data; possible consequences of failure to provide such data
We inform you that providing personal data is partly required by law (e.g. tax regulations) or may result from contractual regulations (e.g. information about a contractual partner). It is possible that a contract closing may require that a data subject provide us with personal data, which we must process subsequently. The data subject is for example required to provide us with personal data when our company enters into a contract with him or her. The consequence of not providing the personal data would be that the contract with the data subject would not be concluded. Before the data subject provides any personal data he or she must contact our data protection officer. Our data protection officer will inform the data subject—on a case by case basis—whether providing personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data.
Existence of automated decision making
We do not use automated decision making or profiling.
Within a visit to our website we use the widely used SSL method (secure socket layer) in connection with whatever is the highest level of encryption supported by your browser. Usually this is a 256-bit encryption. If your browser does not support 256-bit encryption we will use 128-bit v3 technology instead. The icon of a locked key or lock symbol on your browser’s bottom status bar indicates whether each individual page of our website uses encrypted data transmission.
We use appropriate technical and organisational safety measures to protect your data from random or deliberate manipulation, partial or complete loss, destruction or from the unauthorised access of third parties. Our safety measures are continually enhanced as new technology becomes available.
Current status and change of this data protection policy
This data protection policy is current as of April 2019.
Due to the further development of our website and offerings or due to changes in law or administrative regulations it may be necessary to change this data protection policy.