Florian Media GmbH
EnquireDE

Legal

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:
Florian Media GmbH, represented by its Managing Director Florian Schmucker
Schlangenweg 3, 70499 Stuttgart, Germany
Email: info@florian-media.de
Phone: +49 176 76703110

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning website and our content and services. Processing is carried out on the basis of the statutory provisions of the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). We have concluded data processing agreements pursuant to Art. 28 GDPR with the service providers that process data on our behalf.

This website uses TLS encryption (recognisable by “https://” in your browser’s address bar). Data you send to us – for example via the contact form – therefore cannot be read by third parties in transit.

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”), which acts as our processor. Content is delivered via Vercel’s global network, usually from a server location close to you; server-side functions of this website – such as processing the contact form – run in a data centre in Frankfurt am Main, Germany.

When you visit the website, information is automatically collected in so-called server log files (e.g. IP address, date and time of access, page accessed, browser type). This data is used for technical delivery, security and stability. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The logs are available to us at our hosting provider for no more than one day and are then deleted automatically; beyond that, Vercel only processes log data where necessary for the security of its infrastructure. We do not merge this data with other data.

Vercel is certified under the EU-U.S. Data Privacy Framework. Where data is transferred to the USA, this is therefore based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR); in addition, Vercel has agreed to the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

4. Contact

If you write to us using the contact form, we process the data you provide – your name and email address as well as your phone number and city, if you enter them – together with your message in order to handle your enquiry. We need your name, email address and message to be able to reply; without them, an enquiry via the form is not possible. All other information is voluntary. There is no statutory or contractual obligation to provide it. The legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to entering into a contract, and otherwise our legitimate interest in responding to enquiries pursuant to Art. 6 (1) (f) GDPR.

We use the email service Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (“Resend”), as our processor to deliver messages sent through the form. The data you enter is transmitted to Resend, processed there for delivery and stored in the USA together with the delivery logs for up to 30 days. Resend is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

Your message then arrives in our mailbox, which netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, operates for us as a processor. After your enquiry you automatically receive a confirmation of receipt at the email address you provided; for privacy reasons it does not repeat the content of your message. If you open it, your email program may load our logo and a portrait image from our website; section 3 applies in that case.

To prevent automated bulk submissions, we check the number of requests per IP address when a message is sent. For this purpose, your IP address is held together with the time of the request in server memory only, never written to disk, and deleted with the next submission of the contact form once the ten-minute check period has elapsed, at the latest when the server instance ends. The legal basis is our legitimate interest in preventing misuse pursuant to Art. 6 (1) (f) GDPR.

The same as for the form applies if you contact us by email or by phone. If you message us via WhatsApp, we process your phone number, profile name and the chat history to handle your enquiry (Art. 6 (1) (b) or (f) GDPR). WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, which processes your data under its own terms. Message content is end-to-end encrypted; however, WhatsApp receives metadata (such as phone numbers, timestamps and device data), which may also be transferred to Meta Platforms, Inc. in the USA. For confidential matters, please use email or phone.

We delete your enquiry data as soon as it is no longer required for the purpose for which it was collected – as a rule no later than three years after the correspondence ends, unless statutory retention obligations (for example under section 147 of the German Fiscal Code or section 257 of the German Commercial Code) apply.

5. Videos (Bunny Stream)

We deliver our videos via the video service Bunny Stream, operated by BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (“Bunny”), which acts as our processor. Two cases need to be distinguished:

  • Videos loaded automatically. On the homepage, the showreel in the hero area and the short clips in the reels section are requested from Bunny’s content delivery network without any action on your part – the showreel once the page has fully loaded (only on click if “reduce motion” is enabled in your operating system), the short clips once they come close to the visible area as you scroll. The muted preview videos on the project cards are loaded when you move your mouse over a card. Your IP address is transmitted to Bunny in the process – it is technically required to deliver the video data. The legal basis is our legitimate interest in an appealing presentation of our work pursuant to Art. 6 (1) (f) GDPR.
  • Videos on the project pages and in the project view on the homepage are only loaded once you actively start them by clicking. Until then, only a locally hosted preview image is shown and no connection to Bunny is established. The legal basis for loading them after your click is Art. 6 (1) (f) GDPR; the associated access to your device is strictly necessary for the service you have expressly requested (section 25 (2) no. 2 TDDDG).

Bunny is a European company. Delivery takes place via a global content delivery network, which means video data is usually served from a location close to you. When you start a video player, it additionally loads fonts and program components from Bunny, transmits playback and performance metrics to Bunny and, to select the fastest location, measures the response times of several Bunny servers distributed worldwide; in the process, your IP address is also transmitted to servers outside the EU. Where this happens, the transfer is based on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). No cookies are set. The player stores playback settings such as the quality level and a cached icon graphic in your browser’s local storage (in Bunny’s storage area, not that of our website); these entries serve only to operate the player you started and are not used to recognise you. Bunny evaluates the playback statistics for us in aggregated form only; we cannot identify individuals from them.

6. Audience and performance measurement (Vercel)

We use Vercel Web Analytics and Vercel Speed Insights provided by Vercel Inc. (see section 3) as our processor. When a page is loaded, your browser loads a small script from our own domain for this purpose. Web Analytics transmits the page address (including any URL parameters, such as a campaign identifier), the referring page where applicable and – derived from your request – browser, operating system, device type and approximate location (country or region). Speed Insights transmits loading-time metrics together with the page address, the approximate connection type, browser, operating system, device type and country. To distinguish visits, Vercel creates a hash value from request attributes, which is discarded after 24 hours.

No cookies are set and no identifiers are stored on your device. The scripts only read technical information from your browser (such as the browser identifier and connection type) and check whether an entry of their own exists in your browser’s local storage; we store nothing there. No cross-site or cross-device profiles are created; we only see aggregated statistics, which are retained for up to twelve months.

The purpose is the fast and error-free delivery of this website. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. Insofar as the scripts read information from your browser, we base this on section 25 (2) no. 2 TDDDG, as it is necessary for the error-free provision of the website you have requested. Section 3 applies to the transfer to the USA. You can object to the measurement at any time (section 11); you can technically prevent it by disabling JavaScript or using a content blocker – the website remains usable.

7. Cookies and local storage

This website does not set any cookies – neither for tracking or marketing purposes nor otherwise. That is why no cookie banner is shown. For the playback settings that a video player you start stores locally, see section 5; for the reading of browser information by the audience and performance measurement, see section 6.

8. Our Instagram presence

We operate a company profile on Instagram, a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). When you visit our profile, Meta processes your data (e.g. IP address, device information, interactions) under its own terms, including in the USA; Meta is certified under the EU-U.S. Data Privacy Framework. We are jointly responsible with Meta for the statistics on our profile (“Insights”), which Meta only shows us in aggregated form (Art. 26 GDPR). In the related agreement (Page Controller Addendum), Meta has undertaken to inform you and to fulfil your data subject rights; you can therefore exercise them most effectively directly with Meta, but you may also contact us. The legal basis for our presence is our legitimate interest in presenting our work and communicating with interested parties (Art. 6 (1) (f) GDPR). For more information, see Instagram’s privacy policy.

9. External links

Our website links to our Instagram profile, to our Managing Director’s LinkedIn profile and to WhatsApp. This content is not embedded – a connection to the respective provider is only established, and data only transmitted to them, once you click one of these links. The respective provider is responsible for any subsequent processing.

10. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR, see section 11)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart).

11. Right to object

Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR) – which applies in particular to the processing described in this policy for hosting, enquiries, abuse prevention, videos, audience and performance measurement and our Instagram presence – you have the right to object to that processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (Art. 21 (1) GDPR).

An informal message to info@florian-media.de is sufficient to object.

12. Validity

This privacy policy is currently valid (last updated: September 2026). As our website evolves or legal requirements change, it may become necessary to amend this policy. The current version can always be found on this page. This English version is provided for convenience only; the German version is legally binding.