Last updated: 29 August 2026
Controller
Thunder Films GmbH
Herzbergstrasse 124
10365 Berlin
Germany
info@wearectrl.de
Thunder Films GmbH (“ctrl.”, “we”) is the controller responsible for the processing described on this page. Further company details are listed in the Imprint.
Hosting & server logs
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany ("STRATO"). All data processed when you visit this site is handled in STRATO's data centers in Germany. When you access any page or file, the web server automatically records access log entries: the requested resource, date and time of the request, the amount of data transferred, the referring page, your browser type and version, your operating system, and your IP address. These logs are used to deliver the website reliably, to diagnose technical problems and to protect the infrastructure against abuse (legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure and functional website). Log data is not merged with other data sources and is deleted per STRATO's standard retention schedule. We have concluded a data processing agreement (Art. 28 GDPR) with STRATO. Details on STRATO's own data processing: strato.de/datenschutz.
This site itself is static: it is built once and served as plain HTML, CSS, JavaScript, images and video files, with no server-side application, database or user accounts behind it. Any processing at this stage is limited to what the hosting infrastructure does automatically to serve those files.
No cookies, no analytics, no tracking
This site does not set cookies, does not use any analytics or statistics service (such as Google Analytics or similar), does not run advertising or retargeting scripts, and does not use any other tracking technology. There is no contact form and no user account system, so no such data is collected either. Because no non-essential cookies or comparable technologies are used, no cookie consent banner is shown.
Local storage on your device
The site stores exactly one value in your browser's session storage:
a flag (ctrl.seen) recording that the opening animation has already
played, so it is not repeated on every page you open. It contains no identifier
and nothing about you, it is never transmitted to us or to anyone else, and your
browser discards it as soon as you close the tab. Legal basis: Art. 6(1)(f) GDPR
and § 25(2) TTDSG — it is used solely to deliver the presentation you
asked for.
Vimeo embeds
Selected work on the home page can be opened in a full-screen project overlay.
Only at that point — when a visitor actively opens a project — does
the page insert a Vimeo (vimeo.com,
operated by Vimeo.com, Inc., New York, USA) player as an <iframe>
and load the film from Vimeo's servers. No Vimeo content and no Vimeo player is
loaded anywhere else on the site, and nothing is loaded until the overlay is
opened.
The embed URL is built with Vimeo's dnt=1 (“Do Not
Track”) parameter, which instructs Vimeo's player not to track visitors
for analytics or advertising purposes. Even so, loading the player necessarily
connects the visitor's browser directly to Vimeo's servers, which will process
the visitor's IP address and browser/device information to deliver the video,
and Vimeo may process this data in the United States. Where that involves a
transfer of personal data outside the EU/EEA, Vimeo represents that it relies on
the EU Standard Contractual Clauses (SCCs) as a transfer safeguard. Details are
available in Vimeo's own privacy policy:
vimeo.com/privacy.
The legal basis for loading the embed on request is our legitimate interest (Art. 6(1)(f) GDPR) in presenting our film work in a working player rather than hosting large video files ourselves, weighed against the fact that the embed is loaded only when a visitor deliberately opens it.
Self-hosted fonts
This site uses the typeface JetBrains Mono for interface text. The font files are hosted on our own server and delivered together with the rest of the site — unlike an earlier version of this site, no request for fonts is sent to Google or any other third-party font service, and no data about visitors is shared with one for this purpose.
Outbound links
This site links to our Instagram profile (instagram.com/ctrl.film), our LinkedIn profile (linkedin.com) and our representation, NO/Agency (no.agency). These are plain hyperlinks: no content, script, tracking pixel or social plugin is loaded from any of them. Nothing is sent to those services unless you click through, at which point you leave this site and that service's own privacy policy applies.
Contact by email
If you email us (e.g. at info@wearectrl.de), we process the content of your message and your email address to answer your enquiry and, where relevant, to prepare or perform a contract with you. The legal basis is Art. 6(1)(b) GDPR where your message relates to a (prospective) contract, and otherwise our legitimate interest (Art. 6(1)(f) GDPR) in responding to enquiries sent to us. We keep such correspondence only as long as necessary for these purposes or as required by law.
Your rights
Under the GDPR, you have the right to request access to, rectification or erasure of, and restriction of processing of your personal data, the right to data portability, and the right to object to processing carried out on the basis of legitimate interest. To exercise any of these, contact us at info@wearectrl.de.
You also have the right to lodge a complaint with a supervisory authority. As we are based in Berlin, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI): datenschutz-berlin.de.
No automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR in connection with this site.
Changes
We may update this privacy policy as this site or applicable law changes. The current version, as displayed here, applies.