PRIVACY POLICY

1. Introduction

Welcome to Ourlightswitch ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website ourlightswitch.com and use our services.

2. Information We Collect

We may collect the following types of information:

Personal Information (via Forms)

• Contact Form: Name, email address, message, IP address (for rate limiting and spam prevention), user agent
• Newsletter Subscription: Email address, subscription source, IP address (for rate limiting), language preference
• Pitch Deck Request: Name, company, role, email address, phone number, message, IP address (for rate limiting)
• Any other information you voluntarily provide through our contact forms or communications

Analytics Information (Self-Hosted, Cookieless)

• Page views and navigation patterns
• Referrer information (where you came from)
• Anonymized visitor ID (generated from hashed IP address + user agent via Web Crypto API)
• No cookies are used
• No personal data is stored
• No external tracking scripts

3. How We Use Your Information

We use your information for the following purposes:

• Contact Form Data: To respond to your inquiries and fulfill your requests
• Newsletter Data: To send you updates about our films, field notes, and studio news (you can unsubscribe at any time)
• Pitch Deck Requests: To review your request and send our pitch deck to your email address
• Analytics Data: To understand how visitors use our website and improve our services (anonymized, no personal identification)
• IP Addresses: For rate limiting and spam prevention only (not for tracking or profiling)
• To comply with legal obligations
• To protect our rights and prevent fraud

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your data based on:

• Consent: When you voluntarily submit information through our forms or subscribe to our newsletter (Article 6(1)(a) GDPR)
• Legitimate Interest: For self-hosted, anonymized website analytics and spam prevention (Article 6(1)(f) GDPR)
• Contractual Necessity: When processing is needed to fulfill our services to you (Article 6(1)(b) GDPR)
• Legal Obligation: When required by law (Article 6(1)(c) GDPR)

5. Information Sharing

We do not sell, trade, or rent your personal information. We may share your data with:

• Service Providers: Third-party companies that help us operate our website and services (e.g., hosting providers), bound by data processing agreements
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Cookies and Tracking

This website does not use cookies. Our analytics system is self-hosted, does not set cookies, and does not collect personally identifiable information.

We use a privacy-first analytics approach that generates anonymized visitor identifiers through cryptographic hashing (SHA-256) of your IP address and user agent. This hash is computed locally in your browser using the Web Crypto API and cannot be reversed to identify you. No cookies are stored on your device, and no data is shared with third parties.

This system is fully GDPR-compliant by design and does not require cookie consent banners.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Contact Form Submissions: Retained for up to 24 months
• Newsletter Subscribers: Retained until you unsubscribe
• Analytics Data: Retained in anonymized, aggregated form indefinitely

When data is no longer needed, it is securely deleted or anonymized.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information.

10. Your Privacy Rights

Under the GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interest
• Right to Withdraw Consent: Withdraw previously given consent at any time (e.g., unsubscribe from newsletter)

To exercise any of these rights, contact us at info@ourlightswitch.com. We will respond within 30 days of receiving your request.

11. Do Not Track

Because our analytics system does not track individual users and does not use cookies, Do Not Track (DNT) browser signals are effectively honored by default. We do not collect any data that would allow us to track your browsing behavior across websites.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Your continued use of our website after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Ourlightswitch UG (haftungsbeschränkt)
Rosenthaler Str. 72A
10119 Berlin, Germany
Email: info@ourlightswitch.com
Phone: +49 176 27427166

Managing Director: Bart Christiaanse
Commercial Register: Amtsgericht Charlottenburg, HRB 263679 B
VAT ID: DE453994814

14. Data Management

To request access to, correction, or deletion of your personal data, email us at info@ourlightswitch.com. Include "Data Request" in the subject line. We will verify your identity before processing any request and respond within 30 days.