PRIVACY
POLICY

CONTROLLER

If you wish to object to the collection, processing or use of your data — in whole or for specific measures — please direct your objection to the Controller at the address above. You may save and print this Privacy Policy at any time.

Data Protection Officer

DEFINITIONS

This Privacy Policy uses the following terms within the meaning of the General Data Protection Regulation (GDPR):

TYPE, SCOPE & PURPOSE OF PROCESSING

3.1 Data we process

• Contact data (e-mail address, name) if voluntarily submitted via our contact form
• Communication data (device information, IP addresses, browser type, access times)
• Usage data (pages visited, referral sources, session duration)
• Content data (messages or files submitted through our website)

3.2 Categories of data subjects

• Visitors to our website
• Prospective clients and business partners who contact us
• Existing clients of Monkey Pictures GmbH

3.3 Purposes and legal grounds

• Providing, maintaining and improving our website — based on Art. 6(1)(f) GDPR (legitimate interest)
• Responding to enquiries submitted via the contact form or by e-mail — based on Art. 6(1)(b) GDPR
• Processing server log files for security and performance purposes — based on Art. 6(1)(f) GDPR (legitimate interest)
• Compliance with legal obligations — based on Art. 6(1)(c) GDPR

RECIPIENTS OF DATA

Personal data is only shared with third parties where necessary and legally permitted. Recipients may include hosting providers, technical infrastructure providers, and external service providers — all engaged in strict compliance with Art. 28 GDPR.

Data is not transferred to recipients in third countries (outside the EU/EEA) unless an adequate level of data protection is ensured — for example through EU standard contractual clauses pursuant to Arts. 44–50 GDPR.

We do not sell personal data to third parties, and we do not use it for advertising purposes beyond the scope described in this policy.

DELETION OF DATA

Personal data is deleted or processing is restricted as soon as the purpose for which it was collected no longer applies and no statutory retention obligations exist. Server log files are deleted no later than seven days after collection, unless retention is required for evidentiary purposes.

Pursuant to § 257 of the German Commercial Code (HGB) and § 147(1) of the German Tax Code (AO), certain business records must be retained for up to ten years (accounting documents) or six years (commercial correspondence). Data subject to these obligations will be restricted rather than deleted for the duration of the retention period.

COOKIES

Our website may use cookies — small text files stored on your device — to ensure basic functionality and to analyse usage. Session cookies are deleted when you close your browser. Where persistent cookies are used, their purpose and duration are described in our cookie settings.

You can disable or delete cookies at any time through your browser settings. Please note that disabling cookies may limit certain functions of the website.

HOSTING

Our website is hosted by a third-party provider. In the course of hosting, server log data — including IP addresses, browser type, access times and requested URLs — may be processed automatically. This processing is based on our legitimate interest in the secure and efficient operation of our website, pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR.

YOUR RIGHTS

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access — you may request confirmation of whether and how your data is being processed, and receive a copy (Art. 15 GDPR)
• Right to rectification — you may request the correction of inaccurate or incomplete data (Art. 16 GDPR)
• Right to erasure — you may request immediate deletion of your data where it is no longer necessary (Art. 17 GDPR)
• Right to restriction — you may request that processing be restricted in certain circumstances (Art. 18 GDPR)
• Right to data portability — you may receive your data in a structured, machine-readable format and transfer it to another controller (Art. 20 GDPR)
• Right to object — you may object to processing based on legitimate interests at any time (Art. 21 GDPR)
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint — you may contact the competent supervisory authority (Art. 77 GDPR). In Berlin, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit

To exercise any of these rights, please contact us at hallo@monkeyberlin.de.

DATA SECURITY

We are committed to protecting your data to the maximum extent possible within the framework of applicable data protection laws. We implement technical and organisational security measures in accordance with Art. 32 GDPR, which we continuously adapt to the current state of the art.

Data transmitted via our website is encrypted using SSL/TLS where applicable. Please note that data transmission over the internet (e.g. by e-mail) may have inherent security vulnerabilities and that complete protection against access by third parties cannot be guaranteed.

Personal data you provide is processed exclusively within our company and only shared with third parties where strictly necessary and legally permitted (see Section 4). We do not sell personal data.