Privacy Policy

Last updated: 13 May 2026

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Jonas Bomba
Brandtsplatz 7
50825 Cologne, Germany
Email: info@cinephiles.de
Phone: +49 151 65528703

2. Overview

This website is deliberately designed to minimise data. It does not use tracking cookies, analytics tools, advertising pixels or social plugins. Fonts, scripts and styles are served from our own server. Video trailers are only loaded from external providers after you actively click and are explicitly informed about the data exchange.

When you access the site, technically unavoidable connection data is processed (server log files, see Section 4). Beyond that, we only process personal data when you contact us or play a trailer.

3. Legal bases

Where we process personal data, we rely on the following legal bases under the GDPR:

• Art. 6 (1) (a) GDPR: consent (e.g. for loading a video trailer after a click).
• Art. 6 (1) (b) GDPR: performance of a contract or pre-contractual measures (e.g. handling your email enquiry).
• Art. 6 (1) (c) GDPR: legal obligation.
• Art. 6 (1) (f) GDPR: legitimate interests (e.g. stable, abuse-free delivery of the website).

The storing and reading of information on end-user devices is additionally governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

4. Hosting and server log files

The website is hosted on a dedicated virtual server provided by Hostinger UAB, Švitrigailos g. 34, LT-03230 Vilnius, Lithuania. A data processing agreement under Art. 28 GDPR is in place. The server is located within the European Union.

Each request to the server is logged automatically. The following data is collected:

• URL and file name requested
• date and time of access
• amount of data transferred
• success message
• browser type and version
• operating system
• referrer URL (previous page)
• IP address of the requesting device

Log file data is processed solely to ensure stable operation, to investigate abuse and to improve the website. Legal basis is Art. 6 (1) (f) GDPR. Log files are stored for a maximum of 30 days and then deleted or anonymised. The data is not merged with other sources.

5. Fonts, scripts and styles

All fonts used on this website (Boldonse, Inter, Fraunces, Geist Mono) are delivered locally from our own server. No connection to Google Fonts or any other third-party server is established.

The JavaScript libraries required for rendering (React, ReactDOM, Babel Standalone) are also delivered locally. No third-party content delivery networks are used.

6. Contact by email or phone

If you contact us by email (info@cinephiles.de) or phone, your details (name, email address, phone number, content of your message) will be stored exclusively for the purpose of handling your enquiry and any follow-up questions. Legal basis is Art. 6 (1) (b) GDPR for contractual or pre-contractual matters and Art. 6 (1) (f) GDPR for general communication.

Data is deleted as soon as it is no longer required for the purpose of processing, at the latest after the expiry of statutory retention periods (up to ten years for tax-relevant documents).

7. Embedded videos (click-to-load)

Film detail pages offer trailers hosted by external video providers. Trailers are not loaded automatically when you open the page. The video player is only loaded after you deliberately click the trailer button and explicitly confirm playback in the notice that appears. Only then is data transmitted to the provider, in particular your IP address, technical device data and the URL being played.

The legal basis for loading is your explicit consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can revoke your consent at any time by stopping playback.

7.1 Vimeo

Provider: Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. When playing back, Vimeo processes at least IP address, device data, browser information and, if you are signed in, your Vimeo account. Data is transferred to the United States.
Basis for the transfer to the USA: Standard Contractual Clauses under Art. 46 (2) (c) GDPR and, where Vimeo is certified under the EU-US Data Privacy Framework, the corresponding adequacy decision (Art. 45 GDPR).
Vimeo privacy policy: https://vimeo.com/privacy

7.2 YouTube (enhanced privacy mode)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). We embed YouTube videos in enhanced privacy mode via youtube-nocookie.com. In this mode, according to Google, no cookies are stored until you actively start playback. During playback, at least IP address, device data, browser information and, if you are signed in, your YouTube/Google account are processed.
Basis for the transfer to the USA: EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR) and Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Google privacy policy: https://policies.google.com/privacy

8. Cookies

This website does not set any cookies on its own. Cookies and similar storage technologies may only be set by Vimeo and YouTube when you actively play a trailer (see Section 7).

9. Recipients and processors

Recipients of your personal data may include:

• Hostinger UAB (web hosting): processor under Art. 28 GDPR, based in the EU.
• Vimeo.com Inc. and Google Ireland Ltd. / Google LLC (trailer playback): only after your consent.
• Tax advisors and, if required by law, public authorities.

10. International data transfers

A transfer of data to third countries outside the European Economic Area only occurs if you actively play a trailer from Vimeo or YouTube. The transfer is based on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Please note that the level of data protection in the USA may differ from that in the EU and that US authorities may obtain access to data under certain conditions.

11. Retention period

We store personal data only for as long as it is necessary for the respective purpose or as required by statutory retention obligations (in particular ten years for tax-relevant documents, six years for commercial and business letters). Server log files are deleted or anonymised after a maximum of 30 days.

12. Your rights

Under the GDPR you have the following rights in particular:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

To exercise your rights, an informal message to info@cinephiles.de is sufficient.

13. Security

We implement technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. In particular, the entire website is delivered exclusively encrypted via HTTPS/TLS.

14. Changes to this policy

We reserve the right to adjust this privacy policy when the legal situation or our website changes. The version published at cinephiles.de/privacy applies in each case.

Imprint