Privacy Policy

This is a courtesy translation. Only the German version is legally binding.

1. Overview

This website is built so that as little data as possible is generated when you simply visit it. We do not set cookies, we do not use analytics, tracking or advertising services, and no content is loaded from third-party servers when you open our pages. We only process personal data where this is necessary to operate the website, when you write to us, or when you deliberately load a video. The details are explained below.

No automated decision-making, including profiling, takes place.

2. Controller

The controller responsible for data processing on this website is:

Mastlicht Studio UG (haftungsbeschränkt)
Im Breul 8
63486 Bruchköbel, Germany
Postal address: Frankfurter Landstraße 35, 63452 Hanau, Germany
Managing director: Maximilian Priess
Phone: +49 (0) 6181 5032205
Email: hallo(at)mastlicht.de

3. Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (Hostinger). Each time you access the site, your browser automatically transmits information that the server records in so-called log files: your IP address, the date and time of the request, the address requested, the amount of data transferred, the status code of the response, the previously visited page (referrer) and details of your browser and operating system (user agent).

This data is technically required to deliver the website and to keep it secure, for example to detect and fend off attacks. We do not analyse it for any other purpose and do not combine it with other data sources. It is deleted as soon as it is no longer needed for these purposes. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR).

Hostinger processes this data on our behalf. We have concluded a data processing agreement with Hostinger pursuant to Art. 28 GDPR.

4. Contact form

If you write to us via the contact form, we process the information you enter there: first name, last name, company, email address and your message. We also receive whether you submitted the form on the German or the English page, so that we can reply in your language. We use this data exclusively to handle your enquiry and to answer follow-up questions.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or is aimed at concluding one. In all other cases, processing is based on our legitimate interest in answering enquiries addressed to us (Art. 6(1)(f) GDPR).

We need the fields marked with * in order to handle your enquiry. You are under no statutory or contractual obligation to provide this data. Without it, however, we cannot accept the form; you can always reach us by email or phone instead.

Your enquiry reaches us as an email. For the technical delivery we use the Resend service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor. The form data is transferred to servers in the USA. Resend is certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses apply in addition.

Your enquiry remains in our mailbox until it has been fully dealt with and there is no longer any reason to keep it. If the enquiry leads to an assignment, the retention periods under German commercial and tax law apply.

To prevent abuse, the form contains a field that is invisible to people and is only filled in by automated programs. In addition, when you submit the form, the server stores a hash value (SHA-256) of your IP address together with the time of the request in a temporary file in order to reject multiple submissions within 10 seconds. Your IP address itself is not stored. The file is not analysed and not combined with other data. Entries older than 24 hours are deleted automatically the next time the form is used. The legal basis is our legitimate interest in operating the form without abuse (Art. 6(1)(f) GDPR).

5. Contact by email or phone

If you contact us by email or phone, we process your details (for example name, email address, phone number and the content of your enquiry) in order to deal with your request. The legal bases and storage period are the same as for the contact form.

6. Videos from YouTube and Vimeo

On our film pages we show films and trailers hosted on YouTube or Vimeo. When you open the page, you initially only see a button. No connection to YouTube or Vimeo is established at this point, and no data is transferred to these providers.

Only when you click “Watch video” does your browser load the player of the respective provider. The provider then receives, among other things, your IP address, the address of the page you are viewing and details of your browser, and may use cookies or similar technologies on your device. If you are logged in with the provider, it can associate the view with your account. Data may be transferred to the USA in the process.

By clicking, you consent to this transfer (Art. 6(1)(a) GDPR; where information on your device is accessed, Section 25(1) TDDDG). Your consent applies only to the respective video and only to this page view; we do not store your choice. You can withdraw it at any time with effect for the future by reloading or leaving the page.

YouTube

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed YouTube in privacy-enhanced mode (youtube-nocookie.com). Any transfer to Google LLC in the USA is based on the EU-US Data Privacy Framework, under which Google is certified. Further information: https://policies.google.com/privacy.

Vimeo

The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. We embed the Vimeo player with the parameter dnt=1, which instructs the player not to collect session data and not to set cookies. The transfer to the USA is based on the EU-US Data Privacy Framework, under which Vimeo is certified. Further information: https://vimeo.com/privacy.

7. Links to social networks and other websites

In the page header we link to our profiles on Vimeo, LinkedIn, YouTube and Instagram. Below films and posts we offer buttons for sharing (including Facebook, X, LinkedIn and WhatsApp). These are plain links: as long as you do not click on them, no data is transferred to these networks. Only when you click does the respective provider's page open, and its privacy policy then applies. The same applies to links to other websites, such as those of our partners.

8. No cookies, local fonts

This website does not set cookies and does not store any data in your browser's storage. Fonts and scripts are served from our own server; there is no connection to Google Fonts or other external providers. The only exception are videos that you load yourself (section 6).

9. SSL/TLS encryption

For security reasons this website uses TLS encryption, for example for enquiries you send us via the contact form. You can recognise an encrypted connection by “https://” in the address bar and by the lock symbol in your browser.

10. Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal. Simply contact us using the details above.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wilhelmstraße 7, 65185 Wiesbaden, Germany, https://datenschutz.hessen.de.

Last updated: September 2026