Data processing agreement (Art. 28 GDPR)
Updated 1 September 2026
The German version is binding: AVV.
In short
- This text applies when a business uses Lumeton GmbH as a processor (for example editing third-party personal recordings).
- Many studio contracts are independent control; then this DPA does not apply automatically.
- Sub-processors: Hetzner Online GmbH (hosting), FormSubmit (forms, website only).
- Instructions in writing to hallo@lumeton.click.
1. Roles
Customer = controller. Lumeton GmbH = processor only where expressly engaged as such. Productions in which Lumeton jointly decides purposes stay controller or joint-controller under a separate note.
2. Subject
Storage, edit, colour, mix, handover of picture and sound files that show people. Duration: the contract plus archive 18 months unless the customer instructs a shorter period.
3. Instructions
Processing only on documented instruction, except a legal duty. Doubtful instructions we pause and query.
4. Security
Access control to the atelier by arrangement, encrypted handover links with a seven-day life, local drives without surname stickers in transit.
5. Sub-processors
Approved: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (website hosting, not automatically the film archive). FormSubmit for website forms. Further sub-processors only with a 14-day objection window after notice.
6. Assistance
We assist with data-subject requests that concern the processing data and with notification duties. Audits by appointment at Lychener Straße 47 during opening hours.
7. End
After processing ends, deletion or return on instruction, unless a legal retention applies. The default 18-month archive applies only if the customer does not object.
8. Liability and law
Art. 82 GDPR. Additionally the terms. German law, venue Berlin for merchants.
Privacy · Terms · Legal notice.