Escape Cinema Privacy Policy

We greatly appreciate your interest in our company. Data protection is particularly important to the management of Escape Cinema. In principle, our website can be used without providing any personal data. However, if a data subject wishes to use special services offered by our company through our website, it may be necessary to process personal data. Where the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain the data subject’s consent.

The processing of personal data, such as a data subject’s name, address, email address or telephone number, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the country-specific data protection regulations applicable to Escape Cinema. Through this privacy policy, our company wishes to inform the public about the nature, scope and purpose of the personal data we collect, use and process. This privacy policy also informs data subjects of their rights.

As the controller, Escape Cinema has implemented numerous technical and organizational measures to ensure the most comprehensive possible protection of personal data processed through this website. Nevertheless, internet-based data transmissions may in principle have security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.

1. Definitions

Escape Cinema’s privacy policy is based on the terminology used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would first like to explain the terminology used.

In this privacy policy, we use the following terms, among others:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing

Processing means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing means marking stored personal data with the aim of limiting its processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

f) Pseudonymization

Pseudonymization means processing personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

g) Controller

The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by European Union or Member State law, the controller or the specific criteria for its nomination may be provided for by European Union or Member State law.

h) Processor

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient

A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with European Union or Member State law shall not be regarded as recipients.

j) Third party

A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k) Consent

Consent is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to them.

2. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union, and other provisions relating to data protection is:

Forbidden ForRest GmbH
Donauweg 67
63071 Offenbach
Germany

Telephone: 01520 8861818
Email: info@escapecinema.de

3. Cookies

Escape Cinema’s websites use cookies. Cookies are text files placed and stored on a computer system through an internet browser.

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier consisting of a string of characters by which websites and servers can be assigned to the specific internet browser in which the cookie is stored. This enables visited websites and servers to distinguish the data subject’s individual browser from other internet browsers containing different cookies. A specific internet browser can be recognized and identified by its unique cookie ID.

By using cookies, Escape Cinema can provide users of this website with more user-friendly services that would not be possible without cookies.

Cookies allow us to optimize the information and offerings on our website for users. As already mentioned, cookies enable us to recognize users of our website. The purpose of this recognition is to make the website easier to use. For example, users of a website that uses cookies do not have to re-enter their login details each time they visit because the website and the cookie stored on the user’s computer system handle this. Another example is a shopping-cart cookie in an online store: the store uses a cookie to remember the items a customer has placed in their virtual shopping cart.

The data subject can prevent our website from setting cookies at any time by adjusting the settings of their internet browser and can therefore permanently object to the setting of cookies. Cookies that have already been set can also be deleted at any time using an internet browser or other software. This is possible in all commonly used internet browsers. If the data subject disables cookies in their browser, some functions of our website may not be fully available.

4. Collection of General Data and Information

Whenever Escape Cinema’s website is accessed by a data subject or an automated system, it collects a range of general data and information. This data and information is stored in the server log files. The following may be collected: (1) browser types and versions used; (2) the operating system used by the accessing system; (3) the website from which an accessing system reaches our website (the referrer); (4) the subpages accessed on our website; (5) the date and time of access; (6) an Internet Protocol address (IP address); (7) the internet service provider of the accessing system; and (8) other similar data and information used to prevent risks in the event of attacks on our information technology systems.

When using this general data and information, Escape Cinema does not draw conclusions about the data subject. Rather, this information is needed to (1) deliver our website content correctly, (2) optimize our website content and its advertising, (3) ensure the continued functioning of our information technology systems and website technology, and (4) provide law enforcement authorities with the information required for prosecution in the event of a cyberattack. Escape Cinema therefore evaluates this anonymously collected data and information both statistically and with the aim of improving data protection and data security within our company, thereby ensuring the highest possible level of protection for the personal data we process. The anonymous data in the server log files is stored separately from any personal data provided by a data subject.

5. Subscription to Our Newsletter

Escape Cinema’s website gives users the opportunity to subscribe to our company’s newsletter. The personal data transmitted to the controller when subscribing to the newsletter is determined by the input form used for this purpose.

Escape Cinema regularly informs customers and business partners about company offers by newsletter. A data subject can generally receive our company’s newsletter only if (1) they have a valid email address and (2) they register to receive the newsletter. For legal reasons, a confirmation email is sent to the email address entered for the first time using a double opt-in procedure. This confirmation email verifies whether the owner of the email address has authorized receipt of the newsletter.

When a person subscribes to the newsletter, we also store the IP address assigned by the internet service provider (ISP) to the computer system used at the time of registration, together with the date and time of registration. Collecting this data is necessary to trace possible misuse of a data subject’s email address at a later date and therefore serves to protect the controller legally.

Personal data collected as part of newsletter registration is used exclusively to send our newsletter. Subscribers may also be informed by email if this is necessary for the operation of the newsletter service or a related registration, for example in the event of changes to the newsletter offering or technical conditions. Personal data collected through the newsletter service is not disclosed to third parties. The data subject can cancel their newsletter subscription at any time. Consent to the storage of personal data provided for newsletter delivery can be withdrawn at any time. Each newsletter contains a corresponding unsubscribe link. It is also possible to unsubscribe directly on the controller’s website at any time or to notify the controller by other means.

6. Newsletter Tracking

Escape Cinema newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic embedded in emails sent in HTML format to enable log-file recording and analysis. This makes it possible to evaluate statistically the success or failure of online marketing campaigns. By means of the embedded tracking pixel, Escape Cinema can determine whether and when an email has been opened by a data subject and which links in the email have been accessed.

Personal data collected through the tracking pixels in newsletters is stored and evaluated by the controller to optimize newsletter delivery and better tailor future newsletter content to the interests of the data subject. This personal data is not disclosed to third parties. Data subjects may withdraw at any time the separate consent provided through the double opt-in procedure. Following withdrawal, the controller deletes the personal data concerned. Escape Cinema automatically treats unsubscribing from the newsletter as withdrawal of consent.

7. Contacting Us Through the Website

In accordance with legal requirements, Escape Cinema’s website provides information allowing users to contact our company quickly by electronic means and communicate with us directly, including a general email address. If a data subject contacts the controller by email or through a contact form, the personal data they provide is automatically stored. Such personal data voluntarily transmitted to the controller is stored for the purposes of processing the inquiry or contacting the data subject. This personal data is not disclosed to third parties.

8. Comment Function on the Website Blog

Escape Cinema allows users to leave individual comments on blog posts published on the controller’s website. A blog is a generally publicly accessible online portal in which one or more people, known as bloggers or web bloggers, publish articles or share thoughts in blog posts. Such posts can generally be commented on by third parties.

When a data subject leaves a comment on a blog published on this website, the comment itself, the time it was submitted and the username (pseudonym) chosen by the data subject are stored and published. In addition, the IP address assigned to the data subject by their internet service provider (ISP) is logged. The IP address is stored for security reasons and in case the data subject infringes the rights of third parties or posts unlawful content. This storage of personal data therefore serves the controller’s own interests, enabling the controller to defend itself if necessary in the event of a legal infringement. The personal data collected is not disclosed to third parties unless disclosure is required by law or is necessary for the controller’s legal defense.

9. Subscription to Blog Comments

Comments made on Escape Cinema’s blog can generally be subscribed to by third parties. In particular, a commenter may subscribe to subsequent comments on a particular blog post.

If a data subject chooses to subscribe to comments, the controller sends an automatic confirmation email under a double opt-in procedure to verify that the owner of the email address actually selected this option. The comment subscription can be canceled at any time.

10. Routine Deletion and Blocking of Personal Data

The controller processes and stores the personal data of a data subject only for the period necessary to achieve the purpose of storage, or for as long as required by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage no longer applies or a retention period prescribed by the European legislator or another competent legislator expires, personal data is routinely blocked or deleted in accordance with statutory requirements.

11. Rights of the Data Subject

a) Right to Confirmation

Every data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether personal data concerning them is being processed. To exercise this right, the data subject may contact an employee of the controller at any time.

b) Right of Access

Every data subject whose personal data is being processed has the right granted by the European legislator to obtain, at any time and free of charge, information about the personal data stored concerning them and a copy of that information. The European legislator also grants data subjects access to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations;
• where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
• the existence of a right to request rectification or erasure of personal data, restriction of processing by the controller, or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where personal data has not been collected from the data subject, any available information about its source;
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR, and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

The data subject also has the right to know whether personal data has been transferred to a third country or an international organization. If so, the data subject is entitled to information about the appropriate safeguards relating to the transfer.

To exercise the right of access, the data subject may contact an employee of the controller at any time.

c) Right to Rectification

Every data subject whose personal data is being processed has the right granted by the European legislator to obtain without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject also has the right to have incomplete personal data completed, including by providing a supplementary statement.

To exercise the right to rectification, the data subject may contact an employee of the controller at any time.

d) Right to Erasure (Right to Be Forgotten)

Every data subject whose personal data is being processed has the right to obtain from the controller the erasure of personal data concerning them without undue delay where one of the following grounds applies and insofar as processing is not necessary:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
• The data subject withdraws the consent on which the processing is based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing under Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects under Article 21(2) GDPR.
• The personal data has been unlawfully processed.
• The personal data must be erased to comply with a legal obligation under European Union or Member State law to which the controller is subject.
• The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the above grounds applies and a data subject wishes to request the erasure of personal data stored by Escape Cinema, they may contact an employee of the controller at any time. Escape Cinema will arrange for the erasure request to be fulfilled without undue delay.

Where Escape Cinema has made personal data public and is obliged under Article 17(1) GDPR to erase it, Escape Cinema will, taking account of available technology and implementation costs, take reasonable measures, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure of any links to, or copies or replications of, such personal data, insofar as processing is not necessary. Escape Cinema will take the necessary steps in each individual case.

e) Right to Restriction of Processing

Every data subject whose personal data is being processed has the right to request that the controller restrict processing if one of the following conditions applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify its accuracy.
• The processing is unlawful and the data subject opposes erasure of the personal data and requests restriction of its use instead.
• The controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defense of legal claims.
• The data subject has objected to processing under Article 21(1) GDPR pending verification of whether the controller’s legitimate grounds override those of the data subject.

If one of these conditions applies and a data subject wishes to request restriction of personal data stored by Escape Cinema, they may contact an employee of the controller at any time. The controller will arrange for processing to be restricted.

f) Right to Data Portability

Every data subject whose personal data is being processed has the right to receive personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit that data to another controller without hindrance from the controller to which it was provided, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b) GDPR, and where processing is carried out by automated means.

In exercising the right to data portability under Article 20(1) GDPR, the data subject also has the right to have the personal data transmitted directly from one controller to another where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To exercise the right to data portability, the data subject may contact Escape Cinema at any time.

g) Right to Object

Every data subject has the right granted by the European legislator to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

In the event of an objection, Escape Cinema will no longer process the personal data unless we can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defense of legal claims.

Where Escape Cinema processes personal data for direct marketing purposes, the data subject has the right to object at any time to processing for such marketing, including profiling to the extent that it is related to direct marketing. If a data subject objects to Escape Cinema processing their personal data for direct marketing, Escape Cinema will no longer process it for those purposes.

The data subject also has the right, on grounds relating to their particular situation, to object to processing by Escape Cinema for scientific or historical research purposes or statistical purposes under Article 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

To exercise the right to object, the data subject may contact Escape Cinema directly.

h) Automated Individual Decision-Making, Including Profiling

Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into or performing a contract between the data subject and the controller; (2) is authorized by European Union or Member State law to which the controller is subject and that law lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or (3) is based on the data subject’s explicit consent.

Where such a decision is necessary for entering into or performing a contract between the data subject and the controller, or is based on explicit consent, Escape Cinema takes appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject.

i) Right to Withdraw Consent Under Data Protection Law

Every data subject whose personal data is being processed has the right to withdraw consent to the processing of personal data at any time.

To exercise the right to withdraw consent, the data subject may contact Escape Cinema at any time.

12. Data Protection in Job Applications and Recruitment Procedures

The controller collects and processes applicants’ personal data for the purpose of handling the recruitment process. Processing may also take place electronically. This is particularly the case where an applicant submits application documents to the controller electronically, for example by email or through a web form on the website.

If the controller enters into an employment contract with an applicant, the data provided will be stored for the purposes of managing the employment relationship in compliance with statutory requirements. If no employment contract is concluded, the application documents will be deleted after the applicable retention period, provided that no other legitimate interests of the controller prevent their deletion.

13. Data Protection Provisions Regarding the Use of Facebook

The controller has integrated components of Facebook into this website. Facebook is a social network.

A social network is an online meeting place, an online community that generally allows users to communicate and interact with one another in a virtual environment.

Whenever an individual page of this website containing a Facebook component is accessed, the internet browser on the data subject’s information technology system may automatically be prompted to download and display the corresponding Facebook component. As part of this technical process, Facebook may learn which specific subpage of our website the data subject visits.

If the data subject is logged in to Facebook at the same time, Facebook may recognize which specific subpage of our website the data subject visits each time our website is accessed. This information may be associated with the data subject’s Facebook account.

If the data subject does not wish this information to be transmitted to Facebook, they can prevent transmission, among other ways, by logging out of their Facebook account before visiting our website.

14. Data Protection Provisions Regarding the Use of Google AdSense

The controller has integrated Google AdSense into this website. Google AdSense is an online service that facilitates the placement of advertisements on third-party websites.

The company operating the Google AdSense component is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

The purpose of the Google AdSense component is to integrate advertisements into our website. Google AdSense may set cookies on the data subject’s information technology system.

The data subject can prevent cookies from being set by our website at any time by adjusting their internet browser settings. Cookies already set can also be deleted using the internet browser or other software.

Google AdSense may also use tracking pixels. Personal data and information may be processed through Google AdSense and potentially transferred to servers outside the European Union.

15. Data Protection Provisions Regarding the Use of Google Analytics

The controller has integrated Google Analytics into this website. Google Analytics is a web analytics service.

The company operating the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

The purpose of the Google Analytics component is to analyze visitor traffic on our website. Google uses the data and information obtained, among other things, to evaluate the use of our website and compile reports about activity on our website.

Google Analytics may set cookies on the data subject’s information technology system. Personal information such as access times, pages visited, technical information about the device and the IP address may be processed.

The data subject can prevent cookies from being set through their internet browser settings and delete cookies that have already been set.

In addition, depending on the specific technical implementation, further options may be available to prevent data from being collected and processed by Google Analytics.

16. Data Protection Provisions Regarding the Use of Google Remarketing

The controller may have integrated Google Remarketing services into this website. Google Remarketing enables businesses to display interest-based advertising to users who have previously visited the company’s website.

The company operating Google Remarketing services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Google Remarketing may set cookies on the data subject’s information technology system. This may allow a visitor to our website to be recognized again.

The data subject can prevent cookies from being set by adjusting their internet browser settings and can delete cookies that have already been set.

17. Data Protection Provisions Regarding the Use of Instagram

The controller may have integrated components of Instagram into this website. Instagram is an audiovisual platform that enables users, among other things, to share photos and videos.

When a subpage containing an Instagram component is accessed, the data subject’s internet browser may be prompted to load content from Instagram. As part of this technical process, Instagram may learn which specific subpage of our website is being visited.

If the data subject is logged in to Instagram at the same time, the transmitted information may be associated with their personal Instagram account.

If the data subject does not wish this information to be transmitted, they can prevent transmission, among other ways, by logging out of their Instagram account before accessing our website.

18. Data Protection Provisions Regarding the Use of YouTube

The controller may have integrated YouTube components into this website. YouTube is an online video portal.

The company operating YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Whenever an individual page of our website containing a YouTube component or embedded YouTube video is accessed, the internet browser on the data subject’s information technology system may automatically be prompted to load the corresponding YouTube component.

As a result, YouTube and Google may learn which specific subpage of our website the data subject has visited.

If the data subject is logged in to YouTube or Google at the same time, this information may be associated with the respective user account.

19. Legal Basis for Processing

Article 6(1)(a) GDPR serves as the legal basis for processing operations for which our company obtains consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, the processing is based on Article 6(1)(b) GDPR. The same applies to processing operations necessary for taking steps prior to entering into a contract.

If our company is subject to a legal obligation requiring the processing of personal data, the processing is based on Article 6(1)(c) GDPR.

In rare cases, processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. In that case, processing would be based on Article 6(1)(d) GDPR.

Finally, processing may be based on Article 6(1)(f) GDPR. This legal basis applies to processing operations not covered by any of the above legal grounds where processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject.

20. Legitimate Interests Pursued by the Controller or a Third Party

Where the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is to conduct our business activities for the benefit and well-being of our company, our employees and our customers.

21. Period for Which Personal Data Is Stored

The criterion used to determine how long personal data is stored is the applicable statutory retention period. Once this period has expired, the relevant data is routinely deleted, provided that it is no longer needed to fulfill or initiate a contract.

22. Statutory or Contractual Requirements to Provide Personal Data; Necessity for Entering Into a Contract; Possible Consequences of Failure to Provide Data

We would like to inform you that the provision of personal data may in some cases be required by law, for example under tax regulations, or may result from contractual provisions.

In some cases, entering into a contract may require a data subject to provide us with personal data that we must subsequently process. Failure to provide the required personal data may mean that a contract with the data subject cannot be concluded.

Before providing personal data, the data subject may contact us. We will clarify on a case-by-case basis whether providing the personal data is required by law or contract, or is necessary to enter into a contract; whether there is an obligation to provide the data; and what the consequences of not providing it would be.

23. Existence of Automated Decision-Making

As a responsible company, we do not engage in automated decision-making or profiling.