Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation is:

2. Provision and hosting

The website is provided using Cloudflare and Cloudflare Workers. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When the website is accessed, Cloudflare processes technically necessary connection and security data, such as the IP address, time, requested resource, HTTP information and device details, in order to deliver content, defend against attacks and ensure availability. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing the website securely and reliably.

Cloudflare processes data as a processor on the basis of the Cloudflare Data Processing Addendum. Data transfers are governed by the safeguards and Cloudflare provisions described there. Workers Observability is disabled for this website, so no additional Worker application logs accessible to us are collected. This does not affect processing by Cloudflare that is necessary for operation and security. Its duration depends on the respective purpose and applicable provider rules.

3. Regiondo booking system

We use Regiondo for the calendar, booking, payment and booking management. The provider is Regiondo GmbH, Mühldorfstraße 8, 81671 Munich, Germany. The Regiondo booking calendar loads immediately on the pages intended for it. As soon as it loads, the browser connects to Regiondo and transmits technically necessary data such as the IP address, browser information, time and page accessed.

During the booking process, Regiondo processes in particular names, email address, number of participants, date, booking and payment information, and other details required during checkout. The processing serves pre-contractual measures, conclusion of the contract, booking management, payment processing, invoicing and compliance with legal obligations. The legal bases are Article 6(1)(b) and (c) GDPR. We base the technically necessary integration before a booking begins on Article 6(1)(f) GDPR and our interest in providing a functional booking service. Where consent is legally required for individual non-essential functions, that consent is the legal basis.

Depending on use, Regiondo places necessary session and shopping-cart cookies, functional cookies for widget configuration, and potentially analytics and payment provider cookies. Regiondo also uses Usercentrics on its own booking interfaces. The cookies and services used in a particular checkout depend on the selected functions and payment method.

We have entered into a data processing agreement with Regiondo. According to Regiondo, services and data are hosted with AWS in Frankfurt am Main. Regiondo uses subprocessors within and outside the EU. Not every listed service receives data from every booking; in particular, the payment provider actually used depends on the payment method selected at checkout.

• Regiondo privacy information
• Hosting information
• Current cookie information
• List of subprocessors

4. Payment processing

Payments are processed within the Regiondo checkout using the payment services offered there. The booking, amount, device and payment data required for the selected payment method are transmitted to the relevant payment provider. The legal basis is Article 6(1)(b) GDPR; we also process booking and invoice data required by law pursuant to Article 6(1)(c) GDPR. Further details can be found in the information displayed at checkout by the selected payment provider.

5. Audience and event measurement with Umami

We use Umami Cloud Hobby for privacy-friendly measurement of audience reach and selected usage steps. The controller is Spotlight Studios GmbH; the processor is Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, California, USA. The cloud account uses the EU data region. We have entered into a data processing agreement with Umami.

The integration is configured without cookies, respects the Do Not Track setting and excludes URL hash values. We do not transmit names, email addresses, booking or order numbers, or free-text fields to Umami. We measure only the page views and events described here, such as clicks on booking buttons, opening and starting the booking process, and a completed booking confirmed server-side. For the completion event, at most the currency and total amount paid are transmitted as non-customer-specific metrics.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in assessing audience reach and booking success in a privacy-friendly manner in order to improve the service. Where consent is legally required for the specific use, Article 6(1)(a) GDPR is the legal basis. Analytics data is retained for six months. Further information is available in the Umami product description.

6. Contact

If you contact us by email, we process the sender address, content and accompanying data required to handle the enquiry. For contract-related enquiries, the legal basis is Article 6(1)(b) GDPR; otherwise it is Article 6(1)(f) GDPR. Our legitimate interest lies in handling your enquiry. Statutory retention obligations remain unaffected.

We use Microsoft 365 for the technical provision and processing of business email communications. The provider in Europe is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data required to provide the email service.

7. Newsletter

During the Regiondo checkout, customers may voluntarily agree to receive future advertising or newsletter emails from Spotlight Studios. The checkbox is not selected by default. For this purpose, we process in particular the email address and the information required to demonstrate consent. Regiondo is used to record consent during checkout. The legal basis is Article 6(1)(a) GDPR.

Consent may be withdrawn at any time with effect for the future, in particular via an unsubscribe link in the relevant emails or by emailing hello@spotlightstudios.live. Withdrawal does not affect the lawfulness of processing carried out before that point. Necessary records of consent given or withdrawn may be retained insofar as this is required to comply with legal obligations to provide evidence or to prevent further emails from being sent.

8. Post-visit emails

On our behalf, Regiondo sends one email on the night after the visit requesting a review and another seven days after the visit inviting the customer to make another booking. The email address provided during booking and the booking data required to determine the timing are used for this purpose. These emails are sent independently of any newsletter subscription and are not part of the general newsletter. This promotional use ends after the second email.

The legal basis is Article 6(1)(f) GDPR in conjunction with the applicable requirements of competition law. Our interest lies in customer feedback and promoting our own similar services. You may object to this use at any time, at no cost other than basic transmission charges, by emailing hello@spotlightstudios.live. An objection will be implemented promptly for future promotional emails. This option is indicated in every promotional email.

9. Retention periods

• Newsletter or promotional use based on consent generally continues until consent is withdrawn or the recipient unsubscribes. Necessary evidence or suppression information may then continue to be stored insofar as required.
• Use for the two post-visit emails ends seven days after the visit when the second email is sent.
• Booking and contract records are deleted after the standard three-year limitation period expires, unless a dispute or another legal reason requires longer retention.
• Invoices and tax-relevant booking records are retained for eight years from the end of the relevant calendar year.
• Business correspondence subject to retention requirements is stored for six years.
• Following an objection to promotional use, we store only the email address or a suppression value derived from it insofar as this is necessary to prevent further promotional emails.

Deletion is suspended insofar as mandatory retention obligations or the establishment, exercise or defence of legal claims require restricted continued storage.

10. Your rights

Subject to the statutory requirements, you have in particular the right to:

• access under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR,
• object to processing under Article 21 GDPR, and
• withdraw consent with effect for the future.

You may also lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany: www.lda.bayern.de.