Datenschutzhinweise
I. Introduction and definitions
1. GENERAL
In operating our website at the URL www.deag.de (hereinafter referred to as the “Website”), we process personal data. We treat such data as confidential and process it in accordance with applicable law – in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). The purpose of this privacy policy is to inform you which personal data we collect from you, for which purposes and on which legal basis we use it, and to whom we may disclose it. We will also explain which rights are available to you in order to safeguard and enforce your data protection.
2. DEFINITIONS
This privacy policy contains technical terms taken from the GDPR and the BDSG. To help you understand them, we would like to explain these terms in plain language first:
2.1 Personal data
“Personal data” means any information relating to an identified or identifiable person (Art. 4 no. 1 GDPR). Information about an identified person may be, for example, a name or an e-mail address. However, data also qualifies as personal where the identity is not immediately apparent but can be determined by combining one’s own or third-party information to establish who is concerned. A person becomes identifiable, for example, through their address or bank details, date of birth or user name, IP addresses and/or location data. What matters here is any information that in any way permits conclusions to be drawn about a person.
2.2 Processing
Under Art. 4 no. 2 GDPR, “processing” means any operation performed on personal data. This includes in particular the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
II. Controller and data protection officer
1. CONTROLLER
The controller responsible for data processing is:
Company: DEAG Deutsche Entertainment AG (“we”)
Legal representatives: Detlef Kornett (CEO & International Business Affairs) | David Reinecke (CFO) | Moritz Schwenkow (CTTO)
Address: Potsdamer Str. 58, 10785 Berlin, Germany
Telephone: +49 30 81075-0
Fax: +49 30 81075-519
E-mail: datenschutz@deag.de
2. DATA PROTECTION OFFICER
We have appointed an external data protection officer for our company. You can reach them at:
Company: HABEWI GmbH & Co. KG
Legal representative: General partner HABEWI Beteiligungs GmbH, represented by Arne Platzbecker (Managing Director)
Address: Palmaille 96, 22767 Hamburg, Germany
Telephone: +49 40 46008966
Fax: +49 40 46008977
E-mail: datenschutz@habewi.de
III. Scope of processing: Website
Within the scope of the Website, we process the personal data listed individually in Section IV. below. We only process data that you actively provide on the Website (e.g. by completing forms) or that you automatically make available when using our services.
Your data is processed exclusively by us and is generally not sold, lent or passed on to third parties. Where we use external service providers to process your personal data, this takes place within the framework of what is known as processing on behalf of a controller, in which we as the client are authorised to issue instructions to our contractors. To operate our Website we use external service providers for hosting, maintenance and support. We host our Website with the external provider Bradler & Krantz GmbH & Co. KG, Kurt-Schumacher-Platz 8, https://www.providerdienste.de/, at the data centre location 44787 Bochum, Germany. For the maintenance, support, further development and backup of our Website we use the service provider DEAG Fyusion GmbH, Potsdamer Str. 58, 10785 Berlin, Germany. Should further external service providers be used for individual processing activities listed in Section IV., they will be named there.
As a matter of principle, we do not transfer data to third countries, nor is any such transfer planned. We will inform you about exceptions to this principle in the processing activities described below. Any transfer of data to third countries will then take place on the basis of the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/) or the EU Standard Contractual Clauses.
IV. Processing activities in detail
1. PROVISION OF THE WEBSITE AND SERVER LOG FILES
1.1 Description of the processing
Each time our Website is accessed, we automatically collect information that your browser transmits to our server. This concerns the following data:
- IP address
- browser software used, including its version and language
- operating system
- the website from which visitors reached our website (known as the referrer)
- the subpages accessed on the website
- the date and time of access to the website
- internet service provider
This information is also stored in what are known as the log files of our system. The temporary storage of your IP address by the system is necessary in order to deliver our Website to a user’s device. For this purpose, the user’s IP address must remain stored for the duration of the session. In the log files, the IP address is recorded exclusively in truncated form, with the last three digits removed.
1.2 Purpose
The processing takes place in order to enable access to the Website and to ensure its stability and security. The processing also serves the purpose of statistical evaluation and improvement of our online offering.
1.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated above.
1.4 Storage period
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected. Where data is collected in order to provide the website, this is the case when the respective session has ended. Log files are erased after 30 days.
2. CONTACTING US
2.1 Description of the processing
We have provided a contact form on our Website for you to get in touch with us. In this form you are asked to enter your e-mail address, your name and a message. When you click the “Send” button, the data is transmitted to us using SSL encryption (see Section V.). The contact form can only be submitted if you confirm, by ticking the corresponding checkbox, that you have taken note of this privacy policy. You may also contact us using the e-mail addresses provided on the Website. In this case, we process the personal data transmitted with your e-mail.
2.2 Purpose
By providing a contact form on our Website, we want to offer you a convenient way of getting in touch with us. The data transmitted with and in the contact form or your e-mail is used exclusively for the purpose of handling and responding to your enquiry.
2.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated above. Where e-mail contact is aimed at concluding or performing a contract, the data processing takes place for the performance of that contract (Art. 6 (1) (b) GDPR).
2.4 Storage period
We erase the data as soon as it is no longer necessary to achieve the purpose for which it was collected. This is usually the case once the respective communication with you has ended. Communication is deemed to have ended when it can be inferred from the circumstances that your enquiry has been conclusively resolved. Where statutory retention periods prevent erasure, the data is erased without undue delay once the statutory retention period has expired.
3. COOKIES
3.1 Description of the processing
Our Website uses cookies. Cookies are small text files that are stored on the user’s device when a website is visited. Cookies contain information that allows a device to be recognised and, where applicable, enables certain website functions. We distinguish between our own cookies and external cookies, known as third-party cookies. Our site uses what are known as “session cookies” and “persistent cookies”. “Session cookies” are deleted automatically when you end your internet session and close your browser. Persistent cookies remain stored on your device for a longer period. We only use cookies that are technically necessary for the operation of our Website. No consent is required for such cookies.
The following cookies are used on our Website:
| Name | Function | Storage period |
|---|---|---|
| __cmpcc | Consentmanager | 1 year |
| __cmpcc | Consentmanager | 6 minutes |
| __cmpccc* | Consentmanager | 30 days |
| __cmpccc* | Consentmanager | Persistent |
| __cmpccc* | Consentmanager | 14 days |
| __cmpccc* | Consentmanager | Persistent |
| __cmpcccu* | Consentmanager | Persistent |
| __cmpcccu* | Consentmanager | Session |
| __cmpcccu* | Consentmanager | Persistent |
| __cmpconsent* | Consentmanager | Persistent |
| __cmpconsent* | Consentmanager | Session |
| __cmpconsent* | Consentmanager | 90 days |
| __cmpconsent* | Consentmanager | Persistent |
| _ga | Google Analytics tracking | 2 years |
| _ga_* | Google Analytics tracking | 2 years |
| modernizr | WordPress (function) | Persistent |
| wp-wpml_current_language | WordPress / WPML | – |
3.2 Purpose
We use cookies to make our Website more user-friendly and to provide the functions described above.
3.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated above.
3.4 Storage period and withdrawal of consent
Cookies are deleted automatically when a session ends or when the stated storage period expires. Since cookies are stored on your device, you as the user have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted. This can also be done automatically. If cookies are disabled, deleted or restricted for our Website, it may not be possible to use individual functions of our Website, or only to a limited extent.
3.5 Recipients and transfers to third countries
When cookies are used, data may be transmitted to the respective providers of these third-party services. In some circumstances, this may also involve a transfer to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data and about any third-country transfer in the relevant passage on the third-party service in this privacy policy.
4. GOOGLE ANALYTICS
4.1 Description of the processing
Our Website uses “Google Analytics”, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). Google Analytics uses cookies that enable an analysis of your use of our services. The information generated by the cookies is generally transmitted to a Google server in the USA and stored there. However, we use Google Analytics exclusively with IP anonymisation. As a result, your IP address is truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. The statistics generated by Google Analytics record in particular how many users visit our website, from which country or place access takes place, which subpages are accessed and via which links or search terms visitors reach our Website. The Google Analytics terms of service are available at www.google.com/analytics/terms/de.html. An overview of data protection at Google Analytics is available at www.google.com/intl/de/analytics/learn/privacy.html. Google’s privacy policy can be viewed at www.google.de/intl/de/policies/privacy.
4.2 Purpose
The processing takes place in order to evaluate the use of our Website. The information obtained in this way serves to improve our online presence and to tailor it to actual needs.
4.3 Legal basis
The processing takes place on the basis of consent pursuant to Art. 6 (1) (a) GDPR. We obtain this consent via the consent tool. Such consent is voluntary.
4.4 Storage period and withdrawal of consent
We have explained the storage period as well as your control and configuration options for cookies in the section on cookies. You can withdraw the consent you have given in respect of Google Analytics at any time with effect for the future in the settings of the consent tool. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at tools.google.com/dlpage/gaoptout?hl=de. The analytics data processed and stored with Google Analytics is automatically deleted by us after 14 months.
4.5 Recipients and transfers to third countries
According to the German data protection supervisory authorities (Datenschutzkonferenz), Google Analytics acts as a joint controller with us in the data processing. Against this background, we have also concluded the “Google Measurement Controller-Controller Data Protection Terms” with Google. Google also processes your personal data in the USA.
5. YOUTUBE
5.1 Description of the processing
Our Website uses services provided by “YouTube”, a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA (hereinafter “YouTube”). YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use YouTube by embedding individual videos from the platform on our Website as an iFrame, so that they can be played directly on our Website. The videos are embedded in the “extended data protection mode” offered by YouTube, which means that no personal data about you is transmitted to Google as long as you do not play the videos. Data is only transmitted to Google once you play a video, and we have no influence over this. If you play an embedded video on a subpage of our Website, Google is informed which subpage you have visited and which video you have watched. Your IP address may also be transmitted to Google. If you are logged in as a YouTube or Google user at the time, Google will assign this information to your user account. Google stores your data as usage profiles and uses it for advertising purposes, market research and/or to tailor its websites to actual needs. You have a right to object to the creation of these user profiles; to exercise it, you must contact Google directly. Further information on data protection at Google is available at policies.google.com/privacy?hl=de-DE.
5.2 Purpose
The processing takes place in order to display YouTube videos to you on our Website.
5.3 Legal basis
The processing takes place on the basis of consent pursuant to Art. 6 (1) (a) GDPR. We obtain this consent via the consent tool or by means of a content blocker at the point on our Website where a YouTube video is to be displayed. Such consent is voluntary.
5.4 Storage period and withdrawal of consent
We have explained the storage period as well as your control and configuration options for cookies in the section on cookies. You can withdraw the consent you have given in respect of YouTube at any time with effect for the future in the settings of the consent tool.
5.5 Recipients and transfers to third countries
As a result of embedding YouTube, personal data may be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA.
6. GOOGLE MAPS
6.1 Description of the processing
Our Website uses “Google Maps”, a service for displaying maps provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). We use Google Maps by embedding a map showing our business address on our Website. The map is loaded directly from a Google server. For this to happen, your browser sends a request to a Google server. As a result, your IP address may also be transmitted to Google together with the address of our Website. However, Google Maps does not place any cookies on your device. If you are logged in to Google when visiting our site, Google Maps will assign this information to your Google user account. If you do not wish this to be assigned to your Google profile, you must log out before activating the map. Google stores your data as usage profiles and uses it for advertising purposes, market research and/or to tailor its websites to actual needs. You have a right to object to the creation of these user profiles; to exercise it, you must contact Google directly. Further information on data protection at Google is available at policies.google.com/privacy?hl=de-DE.
6.2 Purpose
The processing takes place in order to display interactive maps to you on our Website.
6.3 Legal basis
The processing takes place on the basis of consent pursuant to Art. 6 (1) (a) GDPR. We obtain this consent via the consent tool or by means of a content blocker at the point on our Website where a Google Maps map is to be displayed. Such consent is voluntary.
6.4 Storage period and withdrawal of consent
You can withdraw your consent to the display of Google Maps maps on our Website at any time with effect for the future in the settings of the consent tool.
6.5 Recipients and transfers to third countries
As a result of using Google Maps, personal data may be transmitted to Google Ireland Limited or to Google LLC. Google also processes your personal data in the USA.
7. FONT REPLACEMENT
When our Website is displayed, the standard fonts on your device are replaced with other typefaces. This is done in order to display the text on our Website in a way that is easier to read and more visually appealing. For font replacement we have opted for a privacy-friendly solution. Specifically, we do not integrate any external services such as Google Fonts or Adobe Fonts. Instead, we store the replacement fonts locally on our own server. The advantage of this is that when our site is accessed, your browser does not send any request to external font replacement services, and therefore no data whatsoever – in particular not your IP address in connection with the address of our Website – is transmitted to third parties.
8. GOOGLE WEBFONTS
8.1 Description of the processing
Our Website uses “Google Webfonts”, a font replacement service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). With Google Webfonts, the standard fonts on your device are replaced with typefaces from Google’s catalogue when our Website is displayed. If your browser prevents Google Webfonts from being integrated, the text on our Website is displayed in the standard fonts of your device. The Google fonts are loaded directly from a Google server. For this to happen, your browser sends a request to a Google server. As a result, your IP address may also be transmitted to Google together with the address of our Website. However, Google Webfonts does not place any cookies on your device. According to Google, data processed in the context of the Google Webfonts service is transmitted on resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. It is not associated with data that may arise in connection with the use of other Google services such as the search engine of the same name or Gmail.
Further information on data protection at Google Webfonts is available at developers.google.com/fonts/faq. General information on data protection at Google is available at policies.google.com/privacy?hl=de-DE.
8.2 Purpose
The processing takes place for the purpose of displaying fonts on our Website in a consistent and appealing manner.
8.3 Legal basis
The processing takes place on the basis of our legitimate interest in a consistent and appealing presentation of our Website pursuant to Art. 6 (1) (f) GDPR.
8.4 Storage period
The font files are stored by Google in the browser cache for one year. CSS requests for fonts are cached by Google for one day. Apart from this, no personal data is stored permanently by Google Webfonts.
8.5 Recipients and transfers to third countries
As a result of using Google Webfonts, personal data may be transmitted to Google. Google also processes your personal data in the USA.
9. GOOGLE RECAPTCHA
9.1 Description of the processing
Our Website uses “reCAPTCHA”, a service operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (hereinafter “Google”). reCAPTCHA allows us to check, in the context of forms, whether the input was made by a human being or by automated software – in particular so-called bots. This enables us to protect our Website against spam and misuse. In this context, your IP address, the time spent on the website, mouse movements you have made and, where applicable, further data required for the reCAPTCHA service are transmitted to Google. Further information on data protection at Google is available at policies.google.com/privacy?hl=de-DE.
9.2 Purpose
The processing takes place in order to protect forms on our Website against misuse and spam. Without such a protection mechanism, forms could be flooded with automated spam messages or fraudulent entries, which would considerably impair the functioning of our Website.
9.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated above.
9.4 Storage period
The cookies set by Google in the context of reCAPTCHA have a lifespan of up to 6 months. The usage data collected by Google is stored and processed in accordance with Google’s privacy policy. Should you object to the data processing based on legitimate interests, we point out that the protection of forms by reCAPTCHA is technically necessary in order to prevent misuse of our Website. You can prevent the storage of cookies by adjusting your browser settings accordingly; in this case, however, functional restrictions may occur on our Website.
9.5 Recipients and transfers to third countries
The recipient of the data is Google Ireland Limited, Ireland, and its parent company Google LLC. Google also processes your personal data in the USA.
10. GOOGLE TAG MANAGER
Our Website uses the “Google Tag Manager”, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). The Google Tag Manager does not collect any personal data and does not set any cookies. This service merely enables us to integrate and manage tags on our Website. Tags are small code elements on our website that are useful as a basis for measuring traffic and visitor behaviour with other tools, recording the impact of online advertising and social channels, using remarketing and audience targeting, and testing and optimising the website. As a precaution, the Google Tag Manager is nevertheless integrated on the basis of consent pursuant to Art. 6 (1) (a) GDPR, which is obtained via the consent tool and can also be withdrawn there. Further information on data protection with the Google Tag Manager is available at policies.google.com/privacy and www.google.com/intl/de/tagmanager/use-policy.html.
V. Security measures
In order to protect your personal data against access by third parties, we have secured our Website with an SSL or TLS certificate. SSL stands for “Secure Sockets Layer” and TLS for “Transport Layer Security”; both encrypt the communication of data between a website and the user’s device. You can recognise active SSL or TLS encryption by a small padlock icon displayed at the far left of your browser’s address bar.
VI. Your rights
With regard to the data processing by our company described above, you have the following data subject rights:
1. Right of access (Art. 15 GDPR)
You have the right to obtain confirmation from us as to whether we process personal data concerning you. If this is the case, you have a right of access to that personal data and to the information listed in detail in Art. 15 GDPR, subject to the conditions set out in Art. 15 GDPR.
2. Right to rectification (Art. 16 GDPR)
You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data.
3. Right to erasure (Art. 17 GDPR)
You have the right to request that we erase personal data concerning you without undue delay, provided that one of the grounds listed in detail in Art. 17 GDPR applies – for example, where your data is no longer required for the purposes pursued by us.
4. Right to restriction of processing (Art. 18 GDPR)
You have the right to request that we restrict processing where one of the conditions listed in Art. 18 GDPR is met – for example, if you contest the accuracy of your personal data, processing will be restricted for the period that enables us to verify the accuracy of your data.
5. Right to data portability (Art. 20 GDPR)
Subject to the conditions listed in Art. 20 GDPR, you have the right to request that the data concerning you be provided in a structured, commonly used and machine-readable format.
6. Withdrawal of consent (Art. 7 (3) GDPR)
Where processing is based on consent, you have the right to withdraw your consent at any time. The withdrawal takes effect from the time it is declared. In other words, it operates for the future. The processing therefore does not become unlawful retroactively as a result of the withdrawal of consent.
7. Right to lodge a complaint (Art. 77 GDPR)
If you consider that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right with a supervisory authority in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
8. Automated individual decision-making, including profiling (Art. 22 GDPR)
Decisions that produce legal effects concerning you or similarly significantly affect you may not be based solely on automated processing of personal data, including profiling. We hereby inform you that we do not use automated decision-making, including profiling, in relation to your personal data.
9. Right to object (Art. 21 GDPR)
Where we process personal data concerning you on the basis of Art. 6 (1) (f) GDPR (for the purposes of overriding legitimate interests), you have the right to object to such processing, subject to the conditions set out in Art. 21 GDPR. However, this applies only where grounds arise from your particular situation. Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. Nor are we required to cease processing where it serves the establishment, exercise or defence of legal claims. In any case – and irrespective of any particular situation – you have the right to object at any time to the processing of your personal data for direct marketing purposes.
Last updated: August 2026