Please note: This English translation is provided for information only. Only the German version (Datenschutzerklärung) is legally binding.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Nico Larisch
S3PS – SOUNDSTAR | 3DMS | PM STUDIOS
Westendstraße 177, 4. OG (4th floor)
80686 München (Munich)
Germany
Phone: +49 (0)89 78796606
Email: [email protected]

Please send data protection enquiries to [email protected] or to the postal address above.

2. Overview and legal bases

We process personal data only insofar as this is necessary to operate this website, to answer enquiries or to perform contracts, or where you have given your consent. The legal bases are in particular:

Art. 6(1)(a) GDPR (consent), and for access to your device additionally Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act),
Art. 6(1)(b) GDPR (contract and pre-contractual measures),
Art. 6(1)(c) GDPR (legal obligation, e.g. retention obligations),
Art. 6(1)(f) GDPR (legitimate interests, e.g. secure and stable operation of the website), for strictly necessary access to your device in conjunction with Section 25(2) No. 2 TDDDG.

3. Hosting and server log files

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. According to the host, its servers are located exclusively in data centres in Germany. The host processes the data solely to provide and secure the hosting.

When you visit the website, technically necessary data are processed: IP address, date and time of access, page requested, amount of data transferred, status code, referrer URL, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in delivering the website and keeping it secure. The retention period of these server log files is determined by the host; they are not evaluated for any purpose other than the operation and security of the website.

4. Cloudflare (delivery and protection of the website)

We use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Traffic to this website is routed through Cloudflare’s network (content delivery network and protection against attacks). In doing so, Cloudflare processes in particular your IP address and technical connection data. To fend off automated attacks, the cookie cf_clearance may be set. The legal basis is Art. 6(1)(f) GDPR, and for the cookie Section 25(2) No. 2 TDDDG.

Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision of 10 July 2023. A data processing agreement with Cloudflare (Cloudflare Data Processing Addendum) forms part of the terms of use.

We do not use the analytics service “Cloudflare Web Analytics”.

5. Website security

To protect against attacks and misuse, we use security software that processes in particular IP addresses and access data (firewall, login protection, malware scanning). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the website against attacks.

Wordfence of Defiant, Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA (firewall, login protection, malware scanning): in particular IP addresses, requested URLs as well as HTTP headers and request data may be transmitted to Defiant’s servers. Defiant processes these data as a processor; the transfer to the USA is based on standard contractual clauses.

MalCare of The Inactiv.com Media Solutions Private Limited, Bangalore, India (malware scanning and firewall): in particular visitors’ IP addresses and information on the technical structure of the website are processed. According to the provider, the data are stored in the EU; any access from India is based on standard contractual clauses.

In addition, the plugin Sucuri Security is active without a connection to Sucuri’s services (no API key); according to the provider, no data are transmitted to Sucuri in this case.

The administrator login and password reset pages are additionally protected by the service hCaptcha of Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. hCaptcha is currently loaded only on these pages, which are not publicly linked, and uses technical characteristics (including IP address, browser and device information, interactions) to check whether a login is made by a human. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting administrative access against automated attacks. Intuition Machines processes the data in this respect as a processor and is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision of 10 July 2023.

We also use the security plugin WP Ghost, which shields the administration area of the website against automated attacks. On individual pages it may set the cookie elementor_pro_login with a lifetime of 30 days; it contains a random identifier and serves to protect the login area. The legal basis is Art. 6(1)(f) GDPR, and for the cookie Section 25(2) No. 2 TDDDG.

This website is secured by TLS encryption (HTTPS).

6. Cookies, consent and consent management

We use the consent tool Complianz. It stores your choice in cookies (cmplz_*) and makes it available to other functions of the website via the WP Consent API (wp_consent_*). Without your consent, only technically necessary cookies are set.

Currently technically necessary are: your consent decision (cmplz_*, wp_consent_*), the selected language (pll_language, lifetime 1 year), Cloudflare’s security cookie (cf_clearance) and, on individual pages, the cookie of the security plugin WP Ghost (elementor_pro_login, lifetime 30 days). Statistics cookies (_ga, _ga_HETESCJT24) are only set after your consent.

You can withdraw or change your consent at any time with effect for the future by opening the settings via the “Cookie settings” link in the footer or the “Manage consent” button. After withdrawal, no further data are transmitted to the respective service. If you withdraw your consent to the “Statistics” category, the Google Analytics cookies _ga and _ga_HETESCJT24 are automatically deleted in your browser. You can delete other cookies already stored in your browser settings. The cookies of the consent tool (cmplz_*) are stored for 365 days; after that, you will be asked for your consent again.

7. Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is integrated via our consent tool Complianz. The Google Analytics script is only loaded after you have consented to the “Statistics” category in the consent settings. No connection to Google Analytics is made before your consent.

Google Analytics uses cookies (_ga, _ga_HETESCJT24; lifetime in the browser up to 2 years, Google Analytics default) and creates pseudonymous usage statistics (e.g. pages visited, time spent, approximate location, device). According to Google, no IP addresses are stored in Google Analytics 4. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework.

The lifetime of the cookies must be distinguished from the retention period of the event data collected in Google Analytics: these are deleted automatically after the retention period set in Google Analytics has expired, at the latest after 14 months. Google processes the data as a processor; according to Google, the data processing terms form part of the Google Analytics terms of use for customers in the European Economic Area.

8. Locally hosted fonts

This website uses fonts stored on our own server. No connection to servers of Google or other font providers is made when the fonts are loaded.

9. Map and directions

Our location map is an image stored on our server. Only when you click “Route” or the map does Google Maps (Google Ireland Limited) open in a new window; from then on, Google’s privacy notices apply. The same applies to the “Add as Preferred Source” link in the footer: a Google page is only opened after you click it.

10. Merch shop (Spreadshop)

Our online shop, which is operated on the Spreadshop platform, is embedded on the “Merch Shop” page. The provider of the platform and contractual partner for orders is sprd.net AG, Gießerstraße 27, 04229 Leipzig, Germany (Leipzig Local Court, HRB 22478). The shop operator is responsible for the design and motifs of the shop (see the shop’s legal notice).

The shop is only loaded after you have consented to the “Marketing” category in the consent settings. Until then, you only see a note and a link to the shop; the link takes you directly to Spreadshop without any shop content being loaded on our page beforehand. The legal basis for the embedding is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings”; the embedded shop is then removed.

After your consent, content is loaded from servers of sprd.net AG and associated services (including myspreadshop.de, spreadshirt.de, spreadshirt.net, spreadshirtmedia.net). In particular, your IP address and technical data of your browser are transmitted. Spreadshop then shows its own cookie prompt (consent management of sprd.net AG, technically via the service OneTrust). Please refer to this cookie prompt and to the privacy notices of sprd.net AG for the cookies Spreadshop uses and how long they are stored. You decide separately vis-à-vis Spreadshop on the cookies and services offered there; these settings are managed by Spreadshop, not by us.

Orders are processed exclusively by sprd.net AG; its terms and conditions and privacy notices apply. Data protection contact of sprd.net AG: [email protected]; external data protection officer according to Spreadshop: Fresh Compliance GmbH, Berlin. According to its own information, Spreadshop also transfers data to service providers in third countries (including the USA) on the basis of standard contractual clauses.

Joint controllership: We are jointly responsible with sprd.net AG for collecting data in the embedded shop and transmitting it to sprd.net AG (Art. 26 GDPR). Under the arrangement made with sprd.net AG, sprd.net AG fulfils the information obligations under Art. 13 and 14 GDPR, handles requests from data subjects and is the central point of contact. You can exercise your rights with us or with sprd.net AG ([email protected]). Ordering, payment processing and customer service are the sole responsibility of sprd.net AG. Further information: www.spreadshirt.de/datenschutz.

11. Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, contact details, content of your enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR. For email, we use Google Workspace; the provider for customers in Europe is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.

12. Contract processing and retention

We process data received for carrying out orders in order to perform the contract (Art. 6(1)(b) GDPR). The statutory retention periods under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB) are ten years (in particular books and annual financial statements), eight years (accounting vouchers) and six years (commercial and business letters); the data are deleted afterwards.

13. Recipients and transfers to third countries

Recipients of personal data are the service providers named above. Data are transferred to third countries: to the USA by Google, Cloudflare and hCaptcha (each certified under the EU-U.S. Data Privacy Framework; European Commission adequacy decision of 10 July 2023) and by Wordfence (standard contractual clauses); to India by MalCare (standard contractual clauses); by Spreadshop, according to sprd.net AG, to service providers including in the USA (standard contractual clauses). Data are only passed on to other third parties where we are legally obliged to do so or you have consented.

14. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

We do not offer a newsletter.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

16. Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where data are processed for direct marketing, you may object to this at any time.

You can send your objection or withdrawal informally to the address given in section 1.

17. Last updated

Last updated: 9 October 2026

Privacy Policy