Privacy Statement - crew-united.com

The company Crew United, Lutz and Zenglein GbR Fraunhoferstraße 6, 80469 München (hereinafter 'Crew United' or 'we') operates an internet portal that can be accessed at https://www.crew-united.com/ and through the related subdirectories (hereinafter 'crew-united.com').

With this Privacy Statement, Crew United wishes to explain to you which data are processed, and how they are processed, when you visit crew-united.com, register on the site and create a profile or use one of the other functions of crew-united.com. In doing so, we also fulfil our information obligation pursuant to Art. 13 and 14 of the EU General Data Protection Regulation (GDPR).

I. Responsible party and contact details of the Data Protection Officer

Responsible from a data protection standpoint for the data processing that takes place at crew-united.com is

Crew United, Lutz and Zenglein GbR
Fraunhoferstraße 6
80469 München
Germany
E-mail: [email protected]
Tel.: +49 89 20244030

Our Data Protection Officer can be reached at:
Crew United, Lutz and Zenglein GbR
- Data Protection Officer -
Fraunhoferstraße 6
80469 München
Germany
[email protected]

II. Personal data, purposes and legal foundations for the processing of data

1. Personal data

The GDPR defines personal data as 'any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1. General use of the website

   You can use the crew-united website without giving us personal data. If you do, we do not gather or store any personal data when you visit crew-united.com. Our log files are completely anonymised.

   Irrespective of this, however, every webserver automatically records visits to its websites. When you visit our website, our host's webserver records the following information for the purpose of maintaining the system security

   • Your IP address
   • The date and time of your visit
   • The URL
   • The content you access and
   • The information transmitted.

   This information remains anonymous for us. It is impossible to associate it with you.

2. Registration and creating a profile

   You can register with Crew United and create a profile as a freelancer, actor, speaker, singer, agency, film production, film distribution or film rental company, as a service provider, product manufacturer, dealer or other company.

   You can decide what information about yourself you wish to disclose to us and the public. There are, however, some mandatory data that you do have to at least disclose to us so that we can include you in our database.

   Required information

   We always require a user name and password to complete the registration.

   The other mandatory data differ depending on whether you register as a person or a company.

   If you register as a freelancer or actor, we need at least the following to create your profile:

   • First and last name
   • Street name and number
   • Zip code and city
   • Country
   • Telephone number
   • E-mail address
   • Mobile telephone number
   • Gender
   • Date of birth
   • Acting age (for actors only)
   • Profession
   • Place of residence
   • Federal state
   • Language(s) spoken
   • Height (actors only)
   • Stature (actors only)
   • Ethnic appearance (actors only)
   • Hair colour (actors only)
   • Hair length (actors only)
   • Eye colour (actors only)
   • Nationality

   If you are registering a company, we require

   • Name of the company and a contact person
   • Field of business
   • Street name and number
   • Zip code and city
   • Country
   • Telephone number
   • E-mail address
   • Fax or mobile phone number

   Voluntary information

   You can also provide certain other information at your discretion. This differs depending on what you register as.

   For freelancers, this information encompasses

   • Self-description
   • Special skills
   • Own equipment
   • Licenses
   • Education
   • Further references
   • Preferred field of work
   • Associations
   • Possible residences
   • Billing type
   • Experience abroad
   • Agency

   For actors it includes

   • Weight
   • Clothing size
   • Dialects
   • Voice register
   • Singing
   • Instruments
   • Abilities (sports)
   • Special skills
   • Licenses
   • Immediate place of work
   • Possible residences
   • Billing type
   • Experience filming abroad
   • Agencies
   • Press agency

   For companies, this information includes company-related data such as the year of foundation, number of employees and a description of what the company does.

3. Participation in productions

   crew-united.com gathers, processes and publishes the data to make your professional experience visible, and to display the involvement of other people and companies for the purpose of verifiability, transparency and documentation.

   So one of the main purposes of crew-united.com is to show the participation and involvement of filmmakers and others (e.g. production companies) in productions, films and other audiovisual works (hereinafter referred to collectively as the "Project"). This entails not only stating your name in connection with the Project and the form of your involvement in it, but also perhaps even more importantly who you worked with on the Project and what role those people and companies played in the Project.

   For this purpose, you can state all the productions you have been involved with and that are already listed with crew-united.com in your profile, and set a direct link to them. You are then displayed alongside all the other participants as being involved in the Project. If a project that you want to include in your profile is not yet listed, you have to create the listing.

   Another way for information about your professional experience to get into your profile is if a third party, for example someone else involved in the production, adds you to the production. If this happens, we will inform you in a separate message.

4. Profile management

   Once you are registered you can add new information to your profile, update it or change it at any time. You can also determine which data you want to make publicly accessible. When registering you decide which data you want to make visible to the general public, to members only or only privately.

5. Job/Residential and market offers

   For registered users and guests, crew-united.com also offers the option of creating and publishing advertisements for jobs, apartments and other products. For this to be made possible, we need your name, e-mail address and a telephone number. If you are a guest, we also need your name/your company's name, the details of someone we can contact and a password.

6. News and information by e-mail

   From time to time we send news about our services and products to the e-mail address you have given us. If you do not want us to do so, you can unsubscribe from this service at any time, either in the e-mail we send you or in your user account. This is of course free of charge to you.

7. Registering for events (esp. Crew Calls)

   You can register on the website for events that we organise. These are predominantly our Crew Calls at the moment. In the event of a closed registration, we use the data stored in your profile. If you bring a guest with you, please enter their first and last name on the applicable form. For an open registration we have to obtain your name, what you do and your e-mail address.

2. Purpose and legal foundation for the processing of data

If you make your personal data available as a registered member, we process those data on the basis of the user agreement reached with you pursuant to Art. 6 subs. 1 lit. b) GDPR, in order to be able to make the function of crew-united.com that you request available to you. If you give us your data as a guest in order to use a function of crew-united.com (e.g. the job market), the legal basis is Art. 6 subs. 1 lit. f) GDPR. Our justified interest is the purpose pursued, namely of offering you the function you desire.

If a third party enters your data with us, we process your personal data on the basis of a justified interest, Art. 6 subs. 1 lit. f) GDPR. Our justified interest lies in offering the broadest possible overview of the projects. We assume that it is also in your interest to have your name mentioned in the applicable projects.

The legal basis for receiving news and information by e-mail is Art. 6 subs. 1 lit. f) in conjunction with Art. 95 GDPR and Art. 7 subs. 3 UWG. Our justified interest lies in informing you about our products.

When you give us information about a person accompanying you when registering for an event, we only use this information to register you for the event and to make you a name tag. The same applies if you use the open registration. The legal basis for this processing is in Art. 6 subs. 1 lit. f) GDPR. Our justified interest lies in the above-mentioned purpose.

We make the personal data that you provide available to selected scientific research institutions, which can use the data for research projects. We select these research institutions carefully and ensure by means of contractual agreements that they only use the personal information for specific purposes, and that the results of their research are only published in anonymised form. The justified interest (Art. 6 para. 1 lit. f) GDPR) for which the data is forwarded and subsequently processed by the institution is that of enabling, supporting and conducting scientific research.

Objecting to research purposes: If you do not wish your data to be transmitted for research purposes, you can adjust the settings in your profile to have your data removed from the transmission. If you only want to object to certain research institutions processing your data, please contact the address on the page cited above.

III. Recipients of the data

Within our company, the departments that have access to your data are those that are responsible for processing the matters in question. We also use external service providers for services that we cannot provide or cannot expediently provide ourselves. These external service providers are predominantly providers of IT and telecommunication services.

In terms of external recipients, Crew United's aim is to make your profile and information publicly accessible so that you can be found by potential clients. We make our users' profiles accessible through our website, but we also provide the data through selected additional partners (currently, for example, through the software Yamdu of Seriotec GmbH, Wolfratshauser Str. 157c, 81479 Munich) via interfaces, so that potential clients can find them even better. This includes both the publicly viewable data and the data that is otherwise only viewable to Crew United members. Additionally, you can choose for certain data to be shown only to potential clients via interfaces.

We also make publicly accessible personal data available to selected research institutes and projects under the principles described above. You will find a list of the current research projects, with their contact data and a description of the research instutions responsible for them, at https://www.crew-united.com/en/home/research.asp.

No information is transmitted to third-party countries, unless it is required to execute your orders, prescribed by law or if you have given us your consent to do so.

IV. Storage duration

We store your personal data as long as you have a user account with us. If you delete your account, we also delete your personal data. This does not apply, however, to your name and the links to the projects you participated in. Here we still have the justified interest stated in item II. 3. above. What is more, your participation in a project is a fact from the social sphere environment. By publishing this information we are exercising our right of free speech, so as a rule we are not obliged to delete the information pursuant to Art. 17 subs. 3 GDPR. If you have special individual reasons for the deletion, please send us a message to the addresses cited here, and we will consider your reasons when we decide whether to delete the data or not.

If you disclose data to us as a guest, or about a person accompanying you at an event, these data will be stored until we have performed the service requested by you, and then deleted.

If we no longer store the data for the above reasons, you remain in our system for a further 24 months for technical reasons in the form of backups. The data are then, however, no longer processed for any other purposes and then deleted entirely after the end of the 24-month period at the latest.

V. Rights of the data subject

The GDPR guarantees you certain rights that you can assert vis-à-vis us as long as the statutory prerequisites for doing so are fulfilled.

• Art. 15 GDPR - The data subject's right to information: You have the right to demand confirmation of whether personal data pertaining to you have been processed, and if so, what data were processed and what the circumstances of the data processing were.
• Art. 16 GDPR - Right to rectification: You have the right to demand from us the immediate rectification of incorrect personal data pertaining to you. In doing so, you also have the right, taking into account the purpose of the processing, to demand that incomplete personal data be completed - also by means of an additional declaration.
• Art. 17 GDPR - Right to erasure: You have the right to demand from us that personal data pertaining to you be deleted immediately. Please note the exception to this described in item II. 4 above.
• Art. 18 GDPR - Right to restriction of processing: You have the right to demand from us that the processing be restricted.
• Art. 20 GDPR - Right to data portability: You have the right in the case of processing based on consent or for the fulfilment of an agreement, to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another responsible party without hindrance from us, or to have the data transmitted directly to the other responsible party, in as much as this is technically possible.
• Art. 21 GDPR - Right to object: You have the right to object at any time, for reasons relating to your particular situation, to personal data pertaining to you being processed on the basis of a justified interest on our part or which is required for a responsibility in the public interest or which is conducted to exercise official authority.
  
  If you do lodge such a complaint, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend against legal claims. If we process your personal data for direct marketing purposes, you have the right to object at any time to such processing. If you do so, we will cease to process your personal data for these purposes.
  
  Objecting to research purposes: If you do not wish your data to be transmitted for research purposes, you can adjust the settings in your profile to have your data removed from the transmission. If you only want to object to certain research institutions processing your data, please contact the address on the page cited above.
• Art. 77 GDPR in conjunction with § 19 BDSG - Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority at any time, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement, if you are of the opinion that the processing of the personal data relating to you is unlawful.

Revoking your consent: If you have given us your consent, you have the right to revoke that consent at any time. In such case, all data processing we have performed up to the time of your revocation remains lawful. You can make settings in your user account for this purpose or send an e-mail to [email protected]. If you state in this e-mail that you no longer wish to receive e-mails from us, we will cease to send notifications to that e-mail address in the future.

VI. Obligation to make data available

You are not obliged contractually or by law to provide us with personal data. However, without your data, we are not able to offer you our services.

VII. Automated individual decision-making, including profiling

We do not use automated decision-making with any legal effect or restriction for you.

VIII. Internet-specific data processing

1. Userback

On this website, we use the Userback service, a feedback tool provided by Userback Pty. Ltd., 9 Aspire St, Rochedale QLD 4123, Australia. Through this tool, we provide you with access to our FAQs and give you the opportunity to contact us and provide feedback. The embedded Userback widget also allows us to collect your personal data. In addition to the specific content of your messages to us, this may include the following information.

• Email address
• Name
• Screenshots
• Other attachments

The data processing takes place on servers of Userback Pty. Ltd. Userback will then use the specified information to present your feedback to us in an organized manner. In cases of the data beeing processed outside of the EU/EEA, and there not beeing the data protection level equivalent to the European standard, we have concluded the applicable Standard Contractual Clauses of the European Union with Userback to establish an adequate level of data protection within the framework of our Data Processing Agreement (Article 28 GDPR). SCCs.

The legal basis is Article 6, Paragraph 1, Clause f) of the General Data Protection Regulation (GDPR), where our legitimate interest lies in the previously mentioned purpose.

Your personal data will be stored for the duration of our communication and will be deleted upon completion of the process.

2. JustWatch

We use the streaming guide JustWatch provided by JustWatch GmbH, Boxhagener Str. 18, 10245 Berlin. For this purpose, we have embedded a JustWatch widget in our pages to show you the availability of the respective movie or series on streaming platforms. These widgets can be identified by the JustWatch logo. Once the widget is accessed, a connection is established to JustWatch servers to present the content to you. By clicking on one of the widget buttons an ID will be assigned to you by the linked streaming service, allowing JustWatch and the linked streaming service to track whether you came to the page through our link. To localize the streaming information in the widget, your IP address is encrypted and transmitted to a JustWatch server in the European Union. This information cannot be personally associated with you.

The legal basis for the use of JustWatch is Article 6, Paragraph 1, Clause f) of the General Data Protection Regulation (GDPR). Our legitimate interest lies in the previously mentioned purpose.

Further information on data processing and data protection with JustWatch can be found at: https://www.justwatch.com/de/privacy-policy.

3. Cloudflare

We use the services of Cloudflare provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

We use Cloudflare's globally distributed Content Delivery Network (CDN), facilitating the seamless delivery of data in our website. A Content Delivery Network is a service that efficiently delivers large files, such as graphics, website content, or videos, through a network of geographically dispersed servers. The technical process involves directing the transfer of information between your browser and our website through Cloudflare's network. This utilization allows us to employ Cloudflare for security measures, particularly in countering Distributed Denial of Service (DDoS) attacks, functioning as a Web Application Firewall (WAF), and ensuring SSL encryption for your connection to the web server. By leveraging Cloudflare, we can analyze the traffic between your browser and our website, filter potential malicious data between our servers, and encrypt your access to our website during data transmission. Cloudflare processes your access data for these purposes, specifically the server log data mentioned in Section II. 1. a. It's important to note that personal data is not stored in identifiable form.

The processing for the mentioned purposes is conducted on our behalf. To facilitate the data transfer to the USA, we have implemented the standard contractual clauses issued by the EU Commission with Cloudflare. For further information, please visit:https://www.cloudflare.com/media/pdf/cloudflare-customer-dpa.pdf.

The legal basis for using Cloudflare is Article 6, Paragraph 1, Clause f) of the General Data Protection Regulation (GDPR). Our legitimate interest lies in the previously mentioned purposes of providing our website seamlessly, without errors or interruptions, and ensuring its security.

More detailed information about data processing and privacy with Cloudflare can be found at: https://www.cloudflare.com/privacypolicy/ as well as https://www.cloudflare.com/de-de/gdpr/introduction/.

4. Additional third-party content

To enhance the user-friendliness of our services, we incorporate various third-party contents. We activate this content only when you interact with it actively; otherwise, it remains inactive. In such cases, your device establishes a connection to the servers of these providers. These providers may process personal data and utilize technologies to track user behavior, aspects over which we have no control. Consequently, we recommend seeking additional information from the respective providers.

We make use of the following services:

• Youtube
  Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.
  Privacy Policy: https://policies.google.com/privacy?hl=en

5. Web analysis, monitoring, and optimization

Purposes: The web analysis is used to evaluate the users behaviour, this may include behavioral, interest, or demographic information about visitors, such as age or gender, in pseudonymous form. This allows us, for example, to identify the times when our online offering or its features or content are most frequently used. Furthermore, we can understand which areas require optimization. In addition to web analysis, we may also employ testing procedures to, for instance, test and optimize different versions of our online offering or its components.

Categories of data:

• Pseudonymous usage of data (e.g visited web pages, utilized elements and technical details such as access times), Meta-/Communication data (i.e., device information).
• In connection with Google Analytics, we utilize an IP masking procedure (i.e., pseudonymization by shortening the IP address).

Utilized service providers

• Google Analytics, Google Tag Manager
  Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.
  Third country transfers: During this process, Google may transfer data to recipients in third countries. For these purposes, Google has established standard contractual clauses with the respective recipients, unless an adequate level of protection is guaranteed through a decision by the Commission. Access to the standard contractual clauses is available here, here and here.

Legal framework: Agreement (Art. 6 para. 1 sentence 1 lit. a GDPR).

Storage duration: The data collected through Google Analytics is stored for a period of 30 days.

6. Advertising on and for our platform

Remarketing und conversion tracking

Purposes: We employ remarketing and conversion tracking technologies on our website. This enables us to present our users with targeted advertisements based on their interests. We analyze user interactions on our website, allowing us to display focused advertisements to users on other websites or platforms even after they have visited our site. Additionally, we receive information from the respective platforms about the success of our advertising campaigns, which we, in return, use to optimize our advertising efforts.

Data categories:

• Pseudonymous data usage (e.g. visited web pages and ultilized elements, technical details, access times), meta/communication data (e.g., device information).
• Interests
• Demographic information

Utilized service providers:

• Facebook Pixel
  Providers: Meta Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland
  Third country transfers: During this process, Meta Ireland Limited may transfer data to recipients in third countries. For these purposes, Meta has established standard contractual clauses with the respective recipients, unless an adequate level of protection is guaranteed through a decision by the Commission. Access to the standard contractual clauses is available here, here and here.
  Privacy Policy: https://en-us.facebook.com/privacy/

Legal framework: Art. 6 Para. 1 a GDPR

7. Cookies

7.1 Why do we use cookies (and similar technologies)?

For the purposes mentioned above, we store information on your device and access information stored on the device. This is facilitated through the use of cookies or similar technologies, such as local storage (referred collectively as "cookies" for simplicity).

Some of these cookies are strictly necessary for us to provide you with our services (§ 25 para. 2 No. 2 TTDSG). Cookies that are not strictly necessary for our offering are only used with your explicit consent (§ 25 para. 1 TTDSG), which you can withdraw at any time through our

grant, with the posibility of future retraction.

You can also view the specific cookies that are stored and how long they remain on your device in the Privacy Settings. Additionally, you will find the classification of cookies for the processing purposes mentioned above and the providers used.

7.2 What types of cookies do we use?

We use permanent and temporary cookies ("session cookies").Session cookies remain on your device only until you end your browser session. Permanent cookies remain stored on your device until they expire or are deleted.

7.3 Essential cookies

These cookies enable essential functions and are strictly necessary for the proper functioning of the website.

7.4 Performance cookies

The set cookies and processed data help us analyze your use of our services, improve our service for you, avoid bugs, and test new features. Pseudonymized profiles are also created based on your usage, for example, using a cookie ID. These profiles mainly contain information about your activities on our site and interactions with its elements.

7.5 Marketing cookies

The cookies set here and the processed data serve us and third parties to show you relevant sponsored content for our services and to address you with our ads on pages and offerings of third parties. Typically, only pseudonymized profiles are formed, containing information about your activities, interests, demographic information or location. This information may be combined with information from our sources or those of third parties. This processing may also occur across different devices.

7.6. Cookie overview

Cookie name	Source	Maximum storage duration
ASPSESSIONID[CODE]	www.crew-united.com	Session
clientToken	www.crew-united.com	Session
memberToken	www.crew-united.com	Session up to 2 months
cuPro	www.crew-united.com	Session up to 2 months
ccb	www.crew-united.com	2 years
_gat	Google Analytics	1 minute
_gid	Google Analytics	24 hours
_ga	Google Analytics	2 years
_ga_7DPHSYXZV1	Google Analytics	2 years
AMP_TOKEN	Google Analytics	30 seconds up to 1 year
_gac_[property-id]	Google Analytics	90 days
_fbp	Facebook	90 days

IX. Joint processing of data

With social Networks

Purposes: We process personal data as an independent controllers, when you send us inquiries through social media profiles. We handle this data to respond to your inquiries.

Additionally, we, as joint controllers, share responsibility with the following networks and for the following processing activities (Art. 26 GDPR).

During your visit to our profile on the Facebook and Instagram networks, the network collects aggregated statistics ("Insights data") generated from certain events logged by their servers when you interact with our profiles and related content. We receive these aggregated and anonymous statistics from the network regarding the usage of our profile. In general, we are not able to attribute this data to specific users. To some extent, we can define the criteria by which the network generates these statistics for us. We use these statistics to make our profiles more engaging and informative for you.

Further information about this data processing on Facebook and Instagram can be found in the Joint Controller Agreement at: https://www.facebook.com/legal/terms/information_about_page_insights_data

Moreover, the network is solely responsible for the processing of your data.

Legal framework: The processing is based on our legitimate interest (Art. 6 para. 1 sentence (f) DSGVO). The interest lies in the respective purpose.

Storage duration: We do not store any personal data ourselves as part of the joint responsibility. Concerning contact inquiries outside the network, the information provided above regarding contacting us apply accordingly.

X. If you have questions or comments

We take all conceivable precautions to protect the security of your data. We welcome your questions and comments regarding data protection. Just send us an e-mail to [email protected]

Munich, May 2019