Privacy Policy

Protecting your personal data is important to us. Personal data is information that can be used to identify you personally.

This Privacy Policy explains which personal data is processed when you visit this website or contact us, the purposes for which it is processed and the legal basis for that processing.

The controller responsible for data processing on this website is:

Email: sofiee.media@gmail.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

We process personal data only where this is necessary to provide this website, respond to enquiries, take steps prior to entering into a contract or comply with legal obligations.

The relevant legal bases include, in particular, Art. 6(1)(b) GDPR for pre-contractual measures and contracts, and Art. 6(1)(f) GDPR for legitimate interests.

Personal data is generally stored only for as long as required for the relevant purpose. It is then deleted unless statutory retention obligations or other legitimate grounds prevent deletion.

This website is provided through the hosting service

.

When you access the website, Vercel may process technical data, including IP addresses and system configuration information. This processing is technically necessary to provide the website, ensure its stability and security, and identify technical errors.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient provision of our online offering.

Vercel is a company based in the United States. For transfers of data from the European Economic Area, Vercel provides, in particular, for the use of the standard contractual clauses adopted by the European Commission. According to Vercel, customer data is encrypted using at least TLS 1.2 in transit and AES-256 at rest.

Further information about data protection at Vercel can be found in Vercel’s Privacy Policy.

For security reasons, this website uses SSL/TLS encryption. This means that data transmitted between your browser and the website cannot readily be read by third parties.

An encrypted connection can be identified in particular by the website address beginning with https://.

If you contact us by email, we process the data you provide in order to respond to your enquiry and any follow-up questions.

This may include your name, email address, company, the content of your message and any other information you choose to provide.

Where your enquiry relates to initiating an engagement or contract, processing is based on Art. 6(1)(b) GDPR.

In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is responding to business and other enquiries.

We use Gmail, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for our business email communications.

If you contact us by email, the information you provide is processed by Google as part of the provision and storage of the email service. This includes, in particular, sender and recipient addresses, the subject line, message content and technical email metadata.

Processing is based on Art. 6(1)(b) GDPR where the communication serves pre-contractual or contractual purposes, or on Art. 6(1)(f) GDPR for other business enquiries.

Further information about data protection at Google can be found in Google’s Privacy Policy.

A contact form is available on our website.

The following information may be processed:

Only the information required to respond to your enquiry is mandatory. Any further information is provided voluntarily.

The data is processed to respond to your enquiry, communicate with you and, where applicable, prepare an engagement.

Where your enquiry concerns a potential contract or engagement, processing is based on Art. 6(1)(b) GDPR. In other cases, processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in responding effectively to incoming enquiries. These legal bases correspond to the GDPR requirements for pre-contractual measures and legitimate interests.

The data is deleted once it is no longer required to handle the enquiry and no statutory retention or evidentiary obligations prevent deletion.

For the technical delivery of messages from our contact form, we use the Nodemailer software library on the server. Nodemailer sends the submitted form data to our email inbox through Gmail’s SMTP infrastructure.

The information entered in the form — in particular your name, email address, company, website or Instagram, preferred timeframe and message content — is transferred to Gmail and processed there for delivery and storage of the email.

Nodemailer is not a separate external delivery service and does not store the form data as an independent provider. Processing by Gmail takes place as part of the email service described in section 7.

Processing is based on Art. 6(1)(b) GDPR where the contact is made for pre-contractual purposes, or Art. 6(1)(f) GDPR for other enquiries.

No functions are used to analyse whether contact emails are opened or links are clicked.

Based on the website’s current technical setup, we do not use analytics, advertising or marketing cookies.

In particular, we currently do not use services such as Google Analytics, Meta Pixel or similar tracking technologies.

When you select German or English using the language switcher, your chosen language is stored exclusively in your browser’s localStorage under the key filmsbysofie-language. This storage is used only to take your selected language into account during subsequent internal navigation.

The stored language preference is not used for tracking or profiling and is not transmitted to third parties. You can delete it at any time through your browser settings or website data controls.

In addition, sessionStorage uses the key filmsbysofie-intro-seen for the duration of the current browser session to record whether the brief intro screen has already been shown. This is used solely to prevent the intro from appearing again during the same session. The information is not used for tracking or profiling, is not transmitted to third parties and is automatically deleted when the browser session ends.

If non-essential cookies or similar technologies are used in future, they will generally be activated only after you have given your consent. Section 25 TDDDG generally requires consent for storing or accessing information on a user’s device, but provides an exception in particular for operations that are strictly technically necessary.

If the use of such technologies changes in future, this Privacy Policy will be updated accordingly and a consent solution will be implemented where necessary.

The portfolio images and videos displayed on this website are provided directly through the website’s infrastructure.

Simply viewing these media therefore does not embed any external photography, video or social media service such as YouTube, Vimeo or Instagram.

Merely viewing the locally provided media does not result in any additional data being transferred to those platforms.

The website may contain links to external social networks, particularly Instagram.

These are standard external links, not embedded social media plugins or feeds.

Only when you actively click such a link do you leave our website and access the relevant third-party website. From that point onwards, the privacy terms of the respective provider apply.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

Subject to the applicable legal requirements, you have in particular the right to:

These data subject rights are expressly provided for by the GDPR.

You can contact us at any time to exercise your rights:

sofiee.media@gmail.com

Where processing is based on your consent, you may withdraw consent at any time with effect for the future.

The lawfulness of processing carried out before withdrawal remains unaffected.

We currently base the processing of the standard contact form in particular on Art. 6(1)(b) or (f) GDPR rather than on consent.

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right under Art. 21 GDPR to object to that processing on grounds relating to your particular situation.

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

For businesses established in North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia may in particular be the competent supervisory authority.