Privacy Policy

Last updated: August 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

FRISCHE BRISE FILM GmbH
Spichernstraße 12–14
50672 Cologne
Germany

Further company details are set out in our Legal Notice.

2. General information on data processing

Thank you for visiting our website. Protecting your personal data is important to us.

When you visit our website, certain data are processed automatically that are required for the technical operation, security and provision of the website. In addition — where you give your consent — we use technologies for the statistical analysis of website usage, for company-level attribution of website visits (firmographics), and for the embedding of external media.

Which data are processed and for which purposes is explained in this Privacy Policy.

We apply the principle of data minimisation. Non-essential services are activated only after you have expressly consented to them.

You may change or withdraw your consent at any time with effect for the future via the Cookie Settings on our website.

3. Website hosting

Our website is operated using the Next.js framework and is hosted by

Vercel Inc.
United States

Vercel provides the technical infrastructure for operating and delivering our website. This includes in particular the provision of the website, the delivery of static content, and the operation of our server-side API endpoints.

When you access our website, the technical infrastructure may process in particular the following data:

IP address,
date and time of access,
pages and resources requested,
information about the browser and operating system used,
technical request and connection data,
referrer information,
server and security logs.

To the extent that processing is necessary for providing and securing the website, it is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient operation of our website.

Server-side execution of our website generally takes place in the region we have configured: Frankfurt (fra1). Vercel additionally uses a globally distributed network for content delivery.

As Vercel is a company based in the United States and operates a globally distributed infrastructure, processing may also take place outside the European Union or the European Economic Area. Where required, transfers are based on appropriate data-protection safeguards, in particular an adequacy decision of the European Commission or appropriate standard contractual clauses.

4. Webflow as content management system and asset CDN

For managing and maintaining content on our website, we use Webflow as a headless CMS.

The website itself is not hosted by Webflow. Webflow is used in particular to manage content and to deliver certain media and static assets via the Webflow CDN.

When such content is retrieved, the following data may for technical reasons be transmitted to Webflow or its CDN:

IP address,
browser and device information,
referrer information,
technical connection data.

Processing takes place in order to provide the content and assets we request.

The provider is:

Webflow, Inc.
United States

As Webflow is a company based in the United States and uses a globally distributed infrastructure, data may also be transferred to third countries. Where required, transfers are based on appropriate data-protection safeguards.

5. Consent management and cookie settings

We use a consent management solution developed by us on our website.

It stores your decision regarding the use of optional services and technologies and ensures that your choices are respected on subsequent page visits.

For this purpose, your selection is stored locally in your browser (localStorage) under the key fbf-consent-v2.

Storing this information is technically necessary so that your consent decision can be applied and need not be requested again on every page load.

Storage continues until you change your selection or delete the corresponding data in your browser.

The consent management itself does not transmit your consent decision to an external provider.

You may change or withdraw your consent at any time via the “Cookie Settings” link in the footer of our website — or here:

6. Necessary technologies

Our website uses certain technically necessary technologies that are required for the operation and basic functionality of the website.

This includes in particular the storage of your consent decision.

These technologies cannot be disabled, as the website would otherwise be unable to provide certain basic functions reliably.

The legal basis for accessing information on your terminal device is Section 25(1) sentence 2 TDDDG, insofar as such storage or access is necessary. The associated processing of personal data is based on Art. 6(1)(f) GDPR.

7. Statistical analysis of website usage

We use our own technical solution for the statistical analysis of how our website is used.

Statistical analysis takes place only if you have consented to the “Statistics” category in our consent management.

Technical processing uses the following infrastructure:

the website visitor’s browser,
our server-side analytics API on Vercel,
a database we operate with Supabase in the European Union.

We do not use Google Analytics, Matomo, Plausible or comparable external standard analytics services.

Data processed

Depending on how the website is used, the following data in particular may be processed:

event type and timestamp,
page viewed or path,
cases visited or case slugs,
search terms,
interactions with videos,
clicks,
time spent,
previous page or referrer,
UTM campaign parameters,
landing path,
information on the device type used,
user agent,
a pseudonymous visitor identifier (visitorId), stored in the browser’s localStorage under the key fbf-visitor-id,
a pseudonymous session identifier (sessionId).

The visitor identifier is stored in the browser and is used to link returning visits technically. The same browser can therefore be recognised across visits. The session identifier is used for the respective browser session.

We do not use these data to identify individual persons by name. This is pseudonymised usage analysis, not anonymous statistics.

Statistical data are stored in our analytics database with Supabase within the European Union.

The data are retained for a maximum of 12 months and are then deleted automatically.

Statistical analysis is based on your consent pursuant to Art. 6(1)(a) GDPR. Access to information on your terminal device is based on Section 25(1) sentence 1 TDDDG.

You may withdraw your consent at any time via the Cookie Settings. Withdrawal applies for the future.

8. Company attribution / firmographics

We plan to use a service for so-called firmographics or company-level attribution.

This feature is activated only if you have previously expressly consented to the “Firmographics” category.

[PLACEHOLDER UNTIL THE PROVIDER HAS BEEN SELECTED]

We intend to use a specialised company-attribution service, for example [NAME OF PROVIDER].

After your consent, the IP address of your internet connection may be transmitted to the selected provider. The provider matches this information against its own databases to determine whether the website visit can potentially be attributed to a company or organisation.

The result of the attribution may then be stored together with the pseudonymous session and usage data in our analytics database.

Identifying a natural person individually is not the purpose of this processing. In particular, we do not provide login or authentication for website visitors and do not use reverse DNS lookups to identify individual persons.

The concrete processing depends on the provider selected. Before the service is activated, this Privacy Policy and our consent management will be updated accordingly, naming the specific provider, the data it processes, the retention period, and any third-country transfers.

Without your consent, the firmographics feature is technically disabled. Before consent is given, no IP address is transmitted for this purpose to a firmographics provider, and it is not processed for company attribution. Independently of this, the IP address may already be processed when our website and API are retrieved technically in the course of hosting (see section 3).

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. Insofar as the service accesses or stores information on your terminal device, this is based on Section 25(1) sentence 1 TDDDG.

You may withdraw your consent at any time via the Cookie Settings.

9. Vimeo – embedded videos

On our website we use videos provided by Vimeo.

The provider is:

Vimeo.com, Inc.
United States

Vimeo videos are loaded on our website only after you have expressly consented to the category “Vimeo / External media”.

Before your consent, no connection to Vimeo is established and no Vimeo video content is loaded from Vimeo servers.

After your consent, Vimeo may process in particular the following data:

IP address,
information about the browser and device used,
technical connection data,
information about use of the video,
cookies or comparable technologies, where applicable.

Data processing is carried out by Vimeo as an independent controller. Further information on Vimeo’s processing of personal data can be found in Vimeo’s privacy information.

As Vimeo is a company based in the United States and uses a globally distributed infrastructure, personal data may also be transferred to third countries. Where required, transfers are based on appropriate data-protection safeguards.

Use of Vimeo is based on your consent pursuant to Art. 6(1)(a) GDPR. Access to information on your terminal device is, where required, based on Section 25(1) sentence 1 TDDDG.

You may withdraw your consent at any time via the Cookie Settings.

Local video content

Some of our video content is not provided via Vimeo but is delivered directly through our own website infrastructure.

These videos are served via our own website or hosting infrastructure. In that case, video data are not transmitted to Vimeo.

10. Calendly – appointment booking

We plan to integrate the Calendly service on our website for scheduling consultation appointments.

The provider is:

Calendly, LLC
United States

The integration is not yet activated in production.

Once Calendly is used on our website, we will configure the integration so that it is activated only after your consent to the relevant category.

When using Calendly, the following data in particular may be processed:

name,
email address,
appointment and booking data,
technical connection data,
IP address,
information about calendars and appointment availability, where applicable.

The concrete processing and any transfers of personal data to third countries will be added to this Privacy Policy before the service is activated.

11. Contact by email

If you contact us by email, we process the personal data you transmit to us.

This may include in particular:

name,
email address,
content of your message,
other information you voluntarily provide.

Processing takes place in order to handle your enquiry and to communicate with you.

The legal basis is Art. 6(1)(f) GDPR. Where your enquiry is directed at concluding or performing a contract, Art. 6(1)(b) GDPR may additionally apply.

We store your data only for as long as necessary to handle your enquiry or as required by statutory retention obligations.

12. No contact forms and no newsletter

Our website currently does not use contact or application forms.

We also currently do not operate a newsletter and do not use a newsletter delivery system.

13. External links to social networks

Our website contains links to our profiles on social networks such as Instagram and LinkedIn.

These are external links only. We do not use social-media plugins, pixels or embedded social-media content from these providers on our website.

Accordingly, accessing our website does not transmit data to the respective social networks via these links. Only when you click such a link and visit the external platform do the privacy terms of the respective provider apply.

14. Technical libraries

For certain website functions we use JavaScript libraries embedded locally in our website, in particular GSAP and hls.js.

These libraries are delivered from our own website infrastructure and do not themselves establish a connection to the servers of the respective developers.

Use of these libraries therefore does not involve any additional transmission of personal data by us to their providers.

15. Recipients of personal data

In the course of operating our website, personal data may be transmitted to the following categories of recipients or service providers:

Vercel as hosting and infrastructure provider,
Webflow for the provision of CMS content and assets,
Supabase as database and infrastructure provider for our own analytics solution,
Vimeo for the provision of embedded videos, where you have consented,
[FIRMOGRAPHICS PROVIDER] for company attribution, where you have consented,
in future Calendly for appointment booking, where you have consented.

Where these providers process personal data on our behalf, we conclude — where legally required — corresponding data-processing agreements.

16. Transfers to third countries

Some of the service providers we use are based outside the European Union or the European Economic Area, or operate a globally distributed technical infrastructure.

This applies in particular to Vercel, Webflow and Vimeo, and where applicable to the firmographics or appointment-booking service to be used in future.

Where personal data are transferred to third countries, this takes place only if the statutory requirements for such transfers are met.

Depending on the provider, the transfer may in particular be based on an adequacy decision of the European Commission or on standard contractual clauses issued by the European Commission.

The concrete legal basis and safeguards used are explained in more detail in the respective sections of this Privacy Policy.

17. Retention period

As a rule, we store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

For our own statistical analysis, pseudonymous analytics data are retained for a maximum of 12 months and are then deleted automatically.

Data processed in the course of email contact are as a rule stored only for as long as necessary to handle the enquiry. Longer retention may occur where statutory retention obligations apply or where this is necessary for the establishment, exercise or defence of legal claims.

The concrete retention period at external service providers is governed by their respective privacy terms and the data-protection framework agreed with them.

18. Your rights

Subject to the applicable statutory provisions, you have the following rights:

Right of access

You may request information as to whether and which personal data we process about you.

Right to rectification

You may request the rectification of inaccurate personal data or the completion of incomplete personal data.

Right to erasure

You may request the erasure of your personal data subject to the statutory requirements.

Right to restriction of processing

You may request the restriction of processing of your personal data subject to the statutory requirements.

Right to data portability

Subject to the statutory requirements, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format, or to request transmission to another controller.

Right to object

You may object to the processing of your personal data where the statutory requirements for doing so are met.

Withdrawal of consent

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

You may change or withdraw your consent for optional website services at any time via the Cookie Settings.

19. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority regarding the processing of your personal data.

For FRISCHE BRISE FILM GmbH, based in Cologne, the competent authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Website: www.ldi.nrw.de

20. No automated decision-making

In connection with our website, we do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

The company attribution we plan serves exclusively statistical and business analysis purposes. It is not used to make automated decisions about individual persons.

21. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy if our website, the services we use, or statutory requirements change.

The current version is available on this website.

Last updated: August 2026

← Home