Privacy policy

Last updated: 12 October 2026

This notice explains which personal data we process when you visit equip4cine, contact us, subscribe to our newsletter or use our shop. The website is currently in coming-soon mode; public orders cannot yet be placed. The sections on orders, customer accounts, waiting lists and reviews apply where you actually use those features. Sendcloud is already connected to prepare shipping. WooPayments is set up as a test account; real public payments are not yet enabled. Before opening, we will add information about the payment methods and carriers actually available then.

1. Controller and contact

Jonas Michael Heinrich Hoffmann · equip4cine
Ahornweg 18
83410 Laufen · Germany
Email: kontakt@equip4cine.store

You can contact us at this address with questions about data protection or to exercise your rights.

2. Purposes and legal bases

We process data to provide the website, respond to enquiries, carry out the shop functions you request and handle orders. Depending on the activity, we rely on the following legal bases:

• Contract and pre-contractual steps (Article 6(1)(b) GDPR), for example orders, customer accounts and product enquiries.
• Consent (Article 6(1)(a) GDPR) for the newsletter and optional usage analytics. You can withdraw consent at any time with effect for the future.
• Legal obligations (Article 6(1)(c) GDPR), particularly commercial and tax records.
• Legitimate interests (Article 6(1)(f) GDPR): secure and reliable operation, prevention of misuse, responding to general enquiries and retaining necessary evidence. Where we rely on this basis, we identify the relevant interest in the corresponding section.

Storing information on, or accessing information from, your device is also subject to section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Under section 25(2) TDDDG, consent is not required for functions that are strictly necessary to provide a service you explicitly request. We obtain your consent for optional analytics.

3. Hosting, technical logs and security

The website and business email accounts are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit the website, the hosting provider processes technical connection data, including your IP address, time of access, requested address, browser and operating system information, referrer and response status. These data enable the website to be delivered and technical errors or attacks to be identified.

The legal basis is Article 6(1)(f) GDPR. Our interest is in providing a secure, functioning website. Security features may temporarily log failed login attempts, IP addresses and times to limit unauthorised access. Access is restricted to authorised people and necessary technical service providers.

According to its hosting information, STRATO makes access logs with anonymised visitor addresses available to us for up to six weeks, and error logs for five days. These access periods are distinct from other processing the provider needs for technical operations. Our local login protection processes IP addresses and failed login attempts; the attempt counter resets after 24 hours. Further security logs are reviewed for necessity and deleted when no longer needed to prevent or investigate an incident. Specific incidents may require longer retention for legal proceedings.

Further information: STRATO privacy information.

4. Cookies, local preferences and consent

WordPress and WooCommerce use technically necessary storage, for example for login, the basket and the shop session. Complianz stores your choices about optional services and allows you to reopen them. The legal bases are Article 6(1)(b) or (f) GDPR and, where applicable, Article 6(1)(c) GDPR for documenting consent.

If you select light or dark mode or a catalogue layout, your requested preference may be stored locally in your browser. This restores your choice on a later visit. These local preferences are not used as newsletter consent.

We activate optional analytics only after you consent. You can change or withdraw your choice using “Cookie settings” in the footer. The cookie policy explains storage types and durations. Deleting all cookies or local storage may also reset your basket and saved preferences.

5. Orders, customer accounts and CineDots

The shop uses WordPress and WooCommerce on our hosting. When you place an order, we process your name, billing and delivery addresses, email address, products and variants ordered, quantities, prices, payment and processing status, and any notes you provide. Guests do not need a permanent customer account. An account also involves login details and the associated orders.

These data are used to fulfil your contract, provide customer service and meet legal obligations (Article 6(1)(b) and (c) GDPR). Required information is marked in the relevant form. Without it, we cannot perform the requested activity. Optional information can be left blank.

If you use the CineDots loyalty programme, we associate your points balance, credits and redemptions with your customer account. This is necessary to provide the offered loyalty programme under Article 6(1)(b) GDPR. Creating an account or placing an order does not automatically subscribe you to the newsletter.

No public payments or deliveries are processed through the shop during the current preparation phase. The configured Sendcloud shipping connection and parcel-status display are described below. Additional planned payment methods will be explained in this notice and during checkout before public activation.

We retain order records as required by law. Depending on the document type, the usual periods are eight years for accounting vouchers, ten years for certain books and records, and six years for commercial and business correspondence. The start of the period and possible extensions are governed by law. Additional account data that are no longer needed are deleted unless a retention duty or necessary legal defence prevents this.

5a. Shipping and parcel status

Our shop is connected to Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, the Netherlands, for shipping. To process a shipment, we share the recipient’s name, delivery address, email address, any phone number provided and needed for delivery, order reference, products, quantities and shipping details. Sendcloud processes these details as our processor and passes the data needed for delivery to the appointed carrier.

This processing is necessary to fulfil your order and provide tracking (Article 6(1)(b) GDPR). Statutorily required shipping records are also processed under Article 6(1)(c) GDPR. Merely visiting our website does not create or transmit a shipping order through this connection.

Sendcloud sends us parcel updates. We store the parcel identifier, carrier, tracking number and link, status, report time and a limited status history with the associated order. Your signed-in customer account shows the last reported status. The display updates through our shop server; you contact an external tracking provider directly only when opening its link. The display is not continuous GPS tracking and updates may be delayed.

Parcel information stored in our shop is used for delivery, customer service and, where needed, evidence of the shipment’s progress. It is reviewed for necessity; there is currently no separate automatic deletion process solely for this parcel information. Order documents subject to statutory retention are governed by the periods in section 5. Under its published Data Processing Addendum, Sendcloud deletes customer order data associated with a shipment within 365 days after completion of that shipment.

Sendcloud uses subprocessors. For processing outside the EEA, the provider requires compliance with Chapter V GDPR and provides for EU standard contractual clauses in particular as a transfer mechanism. Further information: Sendcloud privacy information, Data Processing Addendum and subprocessors.

6. Contact and “Ask a question”

If you contact us by email or through the contact form, we process the contact details and message you provide. The contact form uses WPForms. An enquiry from a product page may include the product title and link so we can identify the product concerned.

We handle product and order enquiries under Article 6(1)(b) GDPR, and general enquiries under Article 6(1)(f) GDPR based on our interest in reliable communication. Your message is forwarded by email for processing; STRATO and Brevo may be used for this. Additional entry backup is not enabled in the WPForms Lite installation currently used.

We retain correspondence for as long as needed to handle and, where necessary, document the matter. Business records are subject to statutory retention periods.

7. Waiting lists and availability enquiries

If a product is temporarily unavailable, you can request a notification. We process your email address, the product or variant concerned and, where provided, your requested quantity and preferred date. The date helps us plan; it is not a confirmed delivery commitment.

We use these details solely to handle your specific availability enquiry and related notifications. The legal basis is Article 6(1)(b) GDPR for a product-related service you request. This request is separate from the newsletter and does not add you to a general marketing list. You can end the enquiry at any time by contacting kontakt@equip4cine.store.

We handle the enquiry until it is completed or you withdraw it. Completion does not currently trigger automatic deletion. Entries no longer needed are therefore deleted following manual review. If data remain necessary as evidence of the notification request or to defend specific claims, their use is restricted to that purpose.

8. Reviews, wishlist and product comparison

If you submit a product review, we process the rating, review text, name, email address and product concerned. Following review, the text and displayed name may be published; we do not publish the email address. Where a purchase can be matched, a review may be marked as a verified purchase. The legal basis is Article 6(1)(f) GDPR: our interest in reliable product information and preventing abusive reviews.

The wishlist and comparison features remember products you select. They may use browser storage or associate selections with your signed-in account. The legal basis is Article 6(1)(b) GDPR to provide the feature you request. You can remove entries in the relevant view.

9. Email delivery with Brevo

We use Brevo for shop messages and newsletters. Under the published country terms for Germany, Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, is the contracting entity; the group includes Sendinblue SAS in Paris. As our email service provider, Brevo processes the recipient, message and delivery data needed for sending.

Processing for order and account messages is based on Article 6(1)(b) and, where necessary, (c) GDPR. Newsletter processing is based on your consent under Article 6(1)(a) GDPR. Technical delivery logs help us identify errors, uncertain handovers and duplicate messages (Article 6(1)(f) GDPR).

Message content needed for sending is encrypted in our shop system and removed after confirmed handover, or at the latest during the regular maintenance run after seven days. Delivery metadata are deleted during the regular maintenance run after 90 days. These periods apply to our own sending queue. Brevo transaction logs are set to be retained for one month; message previews are not stored there. Order records and business mailboxes remain subject to the applicable statutory or purpose-related retention periods.

We do not analyse individual email opens or clicks. Technical delivery monitoring is separate. According to Brevo, its databases are hosted in the EU. Individual subprocessors or support services may involve transfers to third countries. The provider uses applicable adequacy decisions or EU standard contractual clauses and supplementary measures for these transfers.

Further information: Brevo privacy information and terms, including data processing provisions and subprocessors.

10. Newsletter and double opt-in

When you subscribe, we first send an email asking you to confirm your email address. Your subscription is recorded as confirmed only after you click the confirmation link. The newsletter covers the shop launch, products and news for set and studio. Subscribing is voluntary and does not require a purchase.

We process your email address, subscription source, consent text version, and subscription and confirmation times. The legal basis for the newsletter is Article 6(1)(a) GDPR. Necessary consent evidence is retained to meet our accountability obligations and for necessary legal defence.

You can unsubscribe at any time using the link in the newsletter or by emailing kontakt@equip4cine.store. This stops future newsletters; necessary order messages may still be sent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Unconfirmed subscription requests are deleted from our own system during the regular maintenance run after 30 days. To limit misuse, we use a keyed verification value derived from the IP address for no more than one hour; this rate-limiting function does not store a readable IP address. Confirmed subscriptions are stored for the duration of the subscription. After unsubscription, remaining data are restricted to necessary evidence and preventing further unwanted messages. Consent evidence and suppression records are kept separately from the active sending list for as long as needed to provide evidence or prevent unwanted messages. Necessity is reviewed manually; there is currently no automatic deletion period for confirmed consent evidence.

11. Google Analytics 4

We use Google Analytics 4 to analyse website usage and identify visited pages and useful content. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our integration loads the Analytics script and its configuration only after you consent to the statistics category. Without that consent, the integration remains blocked. If you withdraw consent, measurement stops and the page reloads without an active Analytics script.

After consent, page views, scrolling, outbound link clicks, site searches, file downloads and interactions with supported embedded videos may be recorded. This also includes referring pages, general technical browser and device information, and pseudonymous user and session identifiers. Automatic collection of form interactions is disabled. According to Google, the IP address is used at collection to derive general location information and is not logged or stored in GA4. This does not make the overall analysis anonymous. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG.

Our settings: Google retains event-level and user-level detail data for two months; resetting that period on new activity is disabled. This period does not apply to most aggregated standard reports. The Analytics cookies _ga and _ga_* are also set to expire two months after the first visit, without extension on subsequent visits. Your browser may shorten this duration. Cookie duration and Google's retention of data already collected are separate matters.

Google Signals, personalised advertising and granular location and device data collection are disabled. The tag's data redaction removes email addresses and selected sensitive URL parameters, such as confirmation, unsubscribe and password keys, before transmission. This protection does not replace the requirement to avoid personal content in search terms or URLs. Signed-in WordPress users are excluded from measurement by Site Kit. Additional transfer of order or payment data through plugin conversion tracking is not enabled.

Google may also have data processed by affiliated companies and service providers outside the EEA, particularly in the United States. For transfers to appropriately certified US recipients, Google relies on the EU–US Data Privacy Framework adequacy decision; EU standard contractual clauses are used for other relevant transfers. Processing is governed by Google's data processing terms. You can withdraw statistics consent at any time with effect for the future using “Cookie settings” in the footer.

Further information: Google privacy policy, privacy in Google Analytics and Google's transfer frameworks.

12. Fonts, images and external links

The font files used by the equip4cine design are served from our own website. These fonts alone do not establish a connection to Google Fonts. In emails, whether font files or images load depends on the email client; standard fonts and image descriptions are available as fallbacks.

External website links can be followed as references. If you follow one, the respective provider's privacy notice applies. A simple link is distinct from directly embedding third-party content. Additional embeds are added only after reviewing their integration.

13. Recipients and retention

Necessary data may be received by technical service providers, the payment and delivery providers needed for a particular order, tax or legal advisers where applicable, and authorities where required by law. Processors are engaged under Article 28 GDPR. We do not share data for third-party advertising without an appropriate legal basis.

As a general rule, we delete or anonymise data when their purpose no longer applies and no statutory retention requirement or necessary legal defence prevents this. If a record must still be retained, its use is restricted to that purpose. The relevant criteria and periods are set out in the sections above.

14. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). You can withdraw consent at any time with effect for the future (Article 7(3) GDPR).

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time, without having to establish a particular situation (Article 21 GDPR).

You may complain to a data protection supervisory authority, particularly in the place of your habitual residence, workplace or an alleged infringement. For private businesses in Bavaria, you can contact the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. You do not have to contact us before making a complaint.

No solely automated decision with legal or similarly significant effects within the meaning of Article 22 GDPR is intended for the activities described here. We update this notice when the actual processing changes.