We, Media4Change gGmbH, Liptinger Str. 25, 78532 Tuttlingen, phone +49 7462 92392-15, e-mail: info@media4change.de (hereinafter „Media4Change“), inform you about the processing of personal data carried out by us.

You can contact us with your questions at info@media4change.de or by post at
Media4Change gGmbH
Data protection
Liptinger Str. 25
78532 Tuttlingen

Below we have summarised the most important information on typical data processing for you, broken down by data subject group. For certain data processing operations that only affect specific groups, the information obligations are fulfilled separately.

Where the term „data“ is used in the text, this refers solely to personal data within the meaning of the GDPR.

I. Data processing
1. visitors to the websites
1.1 Our web server processes a range of data that your browser automatically transmits to our web server with every enquiry. This is the IP address currently assigned to your device, the date and time of the request, the time zone, the specific page or file accessed, the http status code and the amount of data transferred; in addition, the website from which your request came, the browser used, the operating system of your device and the language set. The web server uses this data to display the content of this website on your device in the best possible way.
1.2 We use Google Analytics, a web analytics service provided by Google Inc („Google“). Google Analytics uses „cookies“, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. IP anonymisation is activated for this website, i.e. your IP address will be shortened beforehand by Google within the European Union or in another signatory state to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.
Google will use this information as a processor in accordance with Art. 28 GDPR to analyse your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
You can prevent the storage of cookies by selecting the appropriate settings in your browser software. You can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the available browser plug-in. Alternatively, you can also set an opt-out cookie that will prevent the future collection of your data when you visit this website.
1.3 The purpose of data processing is to present Media4Change on the Internet, to provide information about activities and offers, to sell DVDs, books and film-related merchandise and to communicate with interested parties. The purpose of evaluating user behaviour on the website is to design the website in line with requirements.

1.4 The legal basis for the processing is Article 6(1)(f) GDPR, namely our legitimate interest in the presentation of Media4Change, the offer of films, the information of visitors to the website, communication with interested parties as well as our interest in the needs-based design of the website and the protection of IT security.

1.5 Log and communication data will not be passed on to third parties without special circumstances. Data may be transmitted to the police and public prosecutor’s office if a criminal offence is suspected or in investigation proceedings. We use service providers by way of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems and the hosting of our websites.

1.6 IP addresses are anonymised after 24 hours at the latest. Pseudonymised usage data is deleted after three months. Communication content is deleted after six calendar years.

1.7 It is not possible to use the website without disclosing personal data such as the IP address. It is not possible to communicate via the website without providing data. It is also possible to use the website if the pseudonymised usage analysis has been objected to.

2 Customers, contact persons for customers, interested parties

2.1 We process your data for the purpose of establishing and implementing the contractual relationship, managing your orders and fulfilling legal requirements.

2.2 The legal basis for processing is Article 6(1)(b) GDPR (preparation and performance of the contract) for contracts with natural persons, Article 6(1)(f) GDPR (legitimate interest, namely communication with contact persons relevant to the contract) for contracts with legal persons and always Article 6(1)(c) GDPR (legal obligations, in particular tax and commercial law regulations). When examining, enforcing or rejecting claims, the legal basis is Article 6(1)(f) GDPR (legitimate interest, namely the enforcement of claims or defence against claims). Insofar as data is processed when using online systems, the additional legal basis is Article 6(1)(f) GDPR (legitimate interest, namely the protection of IT security).

2.3 Recipients of data may be banks for the processing of payments. Public authorities and offices may be recipients within the scope of their duties, insofar as we are obliged or authorised to transmit data. Furthermore, data may be transmitted to debt collection service providers, lawyers and courts in individual cases. Upon moving in, tenant data (name, address) will be transmitted once to the local utility company. Data may be transmitted to the police and public prosecutor’s office if a criminal offence is suspected or in the event of investigations. We also use service providers by way of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems.

2.4 All contract and booking-related data is stored for a period of ten calendar years after the end of the contract in accordance with retention periods under tax and commercial law. Judicial titles are stored for 30 calendar years unless the claim is settled before then.

2.5 The provision of data is mandatory for customers both by law and by contract. The contractual relationship cannot be established and executed without the provision of data.

3 Newsletter recipients, invitees and participants in events
3.1 We process your data for the purpose of sending the newsletter, inviting you to events and organising the event.
3.2 The legal basis for the processing of data for newsletters and invitations is Article 6(1)(f) GDPR (legitimate interest, namely communication with customers) if you are a customer or contact person for a customer, otherwise your consent (Article 6(1)(a) GDPR). If you have registered for an event, the legal bases are Article 6(1)(b) GDPR (contract for the organisation of the event) and Article 6(1)(c) GDPR (legal obligations, in particular tax and commercial law regulations).

3.3 We use service providers by way of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems.

3.4 All contract and booking-related data is stored for a period of ten calendar years after the end of the contract in accordance with retention periods under tax and commercial law. Data relating to newsletters will be deleted when you unsubscribe from the newsletter.

3.5 The provision of data is contractually obligatory for the receipt of newsletters and invitations as well as for participation in events. Without the provision of data, newsletters and invitations cannot be sent and participation in events is not possible.

4 Applicants for an employment relationship
4.1 The purpose of data processing is the selection of applicants for employment. There are no plans to change these purposes.
4.2 The legal basis is § 26 BDSG (2017) in conjunction with Art. 6 para. 1 lit. b) (initiation of the employment contract) and Art. 88 GDPR.

4.3 Applicant data is passed on internally to the responsible employees who make the decisions. We also use service providers by way of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems.

4.4 The data will be deleted three months after the end of the application process. If an applicant is also interested in other positions, the data will be stored for up to 12 months.

4.5 The provision of personal data is necessary for the examination of the application and, if applicable, the subsequent conclusion of an employment contract. An application cannot be considered without the provision of personal data.

5 Service providers, suppliers and their employees
5.1 The purpose of the processing is the preparation and execution of the respective contracts with the service providers or suppliers. There are no plans to change these purposes.

5.2 The legal basis for processing is Article 6(1)(b) GDPR (preparation and performance of the contract) for contracts with natural persons, Article 6(1)(f) GDPR (legitimate interest, namely communication with contact persons relevant to the contract) for contracts with legal persons and always Article 6(1)(c) GDPR (legal obligations, in particular tax and commercial law provisions). When examining, enforcing or rejecting claims, the legal basis is Article 6(1)(f) GDPR (legitimate interest, namely enforcement of claims or defence against claims).

5.3 Contact and contract data may be transmitted to other service providers and suppliers as well as offices and authorities if this is necessary for the fulfilment of the contract or order. We also use service providers by way of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems.

5.4 Data of contractual partners, service providers and customers will be deleted 10 calendar years after termination of the contract or order.

5.5 The processing of contact data of service providers, business partners and customers is necessary in order to fulfil the contract or order. If the data is not provided, communication may be significantly disrupted in the fulfilment process.

II General information and rights of data subjects
1. data is not transferred to third countries.
2. we do not use automated individual decision-making procedures.
(3) You have the right to request information about all personal data that we process about you at any time.
4. if your personal data is incorrect or incomplete, you have the right to rectification and completion.
5. you can request the deletion of your personal data at any time, unless we are legally obliged or authorised to continue processing your data.
6. if the legal requirements are met, you can request that the processing of your personal data be restricted.
7. you have the right to object to the processing if the data processing is carried out for the purpose of direct advertising or profiling. If the processing is based on a balancing of interests, you can object to the processing by stating reasons that arise from your particular situation.
8. if data processing is carried out on the basis of your consent or within the framework of a contract, you have the right to transfer the data you have provided, provided that this does not adversely affect the rights and freedoms of other persons.
9. if we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with effect for the future. The processing carried out before a revocation remains unaffected by the revocation.
10. you also have the right to lodge a complaint with a data protection supervisory authority at any time if you are of the opinion that data processing has taken place in breach of applicable law.