) . In this case, the data protection provisions of the respective website also apply.

1. General provisions
1.1 Person responsible
The controller for the processing of personal data within the scope of this privacy policy within the meaning of Art. 4 No. 7 GDPR is

captivr GmbH
represented by Andreas Peusch, Hans-Peter Meisinger
Bliesheimer-Str.3,
50374 Erftstadt,
E-mail: info@captivr.de

1.2 Contact person for data protection
If you have any questions about the processing of your personal data or your rights in relation to data protection, please contact:
Peter Quaglia
(captivr GmbH)
support@captivr.de

1.3 Legal basis for data processing, objection and revocation
We process your data for various purposes. Depending on the purpose of the processing, the following legal bases apply:
a) to provide the app services: Legal bases: performance of contracts (Art. 6 (1) b) GDPR) and in our legitimate interest (Art. 6 (1) f) GDPR),
b) for video recording of rides on amusement rides: Legal basis: Prior consent of the passenger (Art. 6 (1) a) GDPR).
c) for the purchase, retrieval and payment of the video file by the passenger Legal basis: Performance of the contract (Art. 6 (1) b) GDPR).

1.3.1 Legitimate interest and objection
If the data processing is carried out in our legitimate interest, you have the right to object to the use of your data for marketing/advertising purposes and to profiling. Your data will then not be processed for these purposes. Otherwise, you can object to data processing on the basis of legitimate interest for reasons arising from your personal situation. In this case, your data will also not be processed unless we have compelling legitimate grounds that outweigh your interests, rights and freedoms.
You can declare your objection by e-mail to support@captivr.de by post to captivr GmbH, Niederkasseler Lohweg 18, 40547 Düsseldorf, Germany. The objection may mean that the service in question cannot be used or can only be used to a limited extent.

1.3.2 Consent and revocation
If you have consented to the processing of your data, you can revoke your consent at any time without giving reasons. You can declare your revocation by e-mail to support@captivr.de, by post to captivr GmbH, Niederkasseler Lohweg 18, 40547 Düsseldorf, Germany.
The revocation has the consequence that data processing to which you have consented will no longer take place, whereby any processing of your data carried out up to the revocation remains unaffected. In the event of revocation, the service in question can no longer be provided.
If you have given your consent in the WebApp for the tracking of your behavior or access to your camera, or access to your gyroscope, you can revoke this consent in the WebApp. Under 'Menu' you can find 'My Account' and the data you have given us. From here you can directly delete all data provided to captivr.

1.4 Information on Google services
We use services of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland in our WebApp. You can find more detailed information on the individual specific Google services that we use in the further privacy policy. By integrating Google services, Google may collect and process information (including personal data). It cannot be ruled out that Google may also transmit the information to a server in a third country.
The transfer to the USA depends on the function in which personal data is transferred. As the controller, we may ourselves transfer data to Google in the USA for further use.

There is currently no adequacy decision pursuant to Art. 45 GDPR.
However, the transmission can be based on. Standard Contractual Clauses. Google has undertaken to comply with the standard contractual clauses for the transfer of personal data to third countries in accordance with Directive 95/46/EC (Standard Contractual Clauses - SCC).
Further information on SCC clauses can be found at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de and at https://policies.google.com/privacy/frameworks?hl=de.
We ourselves cannot influence which data Google actually collects and processes. However, Google states that the following information (including personal data) may be processed:

• Log data (in particular the IP address)
• Location-related information
• Unique application numbers
• Cookies and similar technologies

Information on the types of cookies used by Google can be found at https://policies.google.com/technologies/types
If you are logged into your Google account, Google may add the processed information to your account and treat it as personal data, depending on your account settings. Google states the following, among other things:
"If you are not signed in to a Google Account, we store the data we collect with unique identifiers associated with the browser, app or device you are using. This allows us to ensure, for example, that your language settings are retained for all browser sessions.
If you are logged into a Google account, we also collect data that we store in your Google account and consider to be personal data." (https://www.google.com/intl/de/policies/privacy/index.html)
You can prevent this data from being added directly by logging out of your Google account or by making the appropriate account settings in your Google account. Furthermore, you can prevent the installation of cookies - if Google sets any - by making the appropriate settings in your browser; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.
You can find out how to delete cookies in the most common browsers here:

• Google Chrome: Website
• Mozilla Firefox: Website
• Apple Safari: Website
• Microsoft Internet Explorer: Website

You can find more information in Google's privacy policy, which you can access here:
• https://www.google.com/policies/privacy/
You can find information on Google's privacy settings at https://privacy.google.com/take-control.html

2. special provisions: Data processing when using the WebApp and the video service
2.1 Data processing when using the WebApp

2.1.1 Log files and other data when accessing the WebApp
Every time when you access our WebApp, we automatically collect data and information from your device's system and store some of it in server log files.

The following data is stored on your mobile device before check-in via mail address:

Visited website (e.g., www.moviepark.captivr.net)
Date and time of access
Source/referring URL from which you accessed the site (see also § 2.4 of this privacy policy)
Browser used
Operating system used
IP address used (if applicable, anonymized)

After check-in and use of our video service - i.e. setting up an account via e-mail address or social login (Google or Apple account) and initiating a video recording, the following data is transmitted in the communication between the mobile device and our server:

Provided e-mail address or social account data (Google/ Apple) during check-in
Date and time of accessing the service
The IP address of your mobile device at the time of access.
Browser type to access the WebApp (e.g., Mozilla Firefox, Safari, Google Chrome etc.)
Scanned QR code before the start of the journey to identify the row you are in and your seat in the row that is to be recorded during the journey
Input of consent to video recording: session identification number, time of consent, version of the privacy policy against which consent was given
If you register via the e-mail address, we will save all the necessary data to send an e-mail to you once the the video from your attraction experience is finished
Payment data when purchasing a video file: amount paid, status, description, payment provider ID, last 4 characters of the payment method number, validity period, payment method issuer, holder address, holder country of origin and CVR token.
Once the video has been purchased, it will be hold in our secure cloud for 1 year. If the video has not been purchased, after 2 weeks since recording, it will be deleted

The processing of the aforementioned data is carried out for the purpose of contract initiation and contract fulfillment in accordance with Art. 6 para. 1 lit. b) GDPR. The provision of your personal data is voluntary. However, it is not possible to use our services without providing the data.

The recipient of the data is our server host, who works for us under a contract data agreement: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521.

2.1.2 Purpose of Processing

The collection of this data is solely for the purpose of ensuring the smooth operation of the website, improving our services, and maintaining the security and stability of our systems. This data is not combined with other data sources. In addition, the data processing enables your device to access the products ordered from us for viewing or products already purchased at any time. We evaluate the process of ordering products for viewing or ultimately purchasing them with the help of Google Analytics, provided you give us your consent to do so (see section 2.4 below).

2.1.3 Legal Basis

The processing of this data is based on our legitimate interest in accordance with Art. 6 (1) (f) GDPR, as it is necessary for the technical security and optimization of our online services.

2.1.4 Storage Duration

Server log files are stored for a period of 30 days and are automatically deleted afterwards. A longer storage period may apply if necessary for security reasons, such as investigating misuse incidents.

We store data collected after check-in (see 1. - 9.) as long as the user holds on to his/ her user account. The user can delete their account any time under "Menu" > "My Account"

2.1.5 Disclosure to Third Parties

This data will not be shared or used for any other purpose unless there is a legal obligation or it is necessary for legal enforcement.

2.1.6 Your Rights

You have the right to access, rectify, erase, and restrict the processing of your personal data. You also have the right to object. You can send or inform us of your objection at any time (e.g. by e-mail to support@captivr.de). The provision of personal data is neither legally nor contractually required. You are also not obliged to provide the personal data. However, failure to provide it will mean that you will not be able to use our WebApp and/or video service to its full extent.

2.2 Purchase, retrieval and download of video files
2.2.1 Storage of data
The video file is stored in the Microsoft Cloud. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521 is the recipient of the data collected in connection with the purchase of the video file.

2.2.2 Purchase
After completion of the video file, you will be given the opportunity to purchase it within 2 weeks of the link being sent at the price conditions stated there. For this purpose, you will receive a link on your device that will direct you to a payment web service, where you can purchase and pay for the file. If the video file is not purchased within 2 weeks, it will be deleted.

2.2.3 Retrieving and downloading the video file
After paying for the video file, you will receive a link to access the file in the Microsoft Cloud. The video file will be stored there for 1 year and can be accessed at any time; it can also be downloaded and saved individually. Storage in the Microsoft Cloud for longer than 1 year is possible for an additional fee. Please note that you are responsible for your further data protection-compliant use of the video file.
The processing of the data within the framework of the processes described above is based on the user contract concluded with you in accordance with Art. 6 para. 1b) GDPR.

2.3 Payment via Stripe or Pay Pal
You have the option of paying the fee for the video recording via Stripe. The provider of the service is Stripe Technology Europe, Limited, The One Building, 1, Lower Grand Canal Street, Dublin 2, Ireland. If you choose Stripe as your payment service provider, the payment will be processed via Stripe. In this respect, Stripe is also the recipient of your data required for the purchase of the video file. This allows us to accept credit and debit card payments in our webshop.
You also have the option of paying the fee for the video recording via PayPal. The provider of this service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal as your payment service provider, the payment will be processed via PayPal. In this respect, PayPal is also the recipient of your data required for the purchase of the video file.
You will be redirected to the Stripe or PayPal website.

2.3.1 Stripe
When paying via Stripe, information (including personal data) is transmitted by us to Stripe for the purpose of payment processing and processed by Stripe. When paying via Stripe, the following data in particular is transmitted by us to Stripe:

CVR token
Purchase amount and purchase date,
The description of the product or products that have been ordered
It may include the location of a ride where the on-ride video was created

As part of the transaction, we receive the following data from Stripe:
Amount, fee, net amount, status, description, ID payment provider, the last 4 characters of the number of the means of payment, fingerprint, validity period, issuer of the means of payment, holder, holder address, country of origin and CVR token.

2.3.2 PayPal
When paying via PayPal, information (including personal data) is transmitted by us to PayPal for the purpose of payment processing and processed by PayPal. When paying via PayPal, the following data in particular is transmitted by us to PayPal:

• CVR token
• Purchase amount and purchase date
• The description of the product or products that have been ordered. It may include the location of a ride where the on-ride video was created.
• PayPal email address from you

As part of the transaction, we receive the following data from PayPal:
Amount, fee, net amount, status, description, ID payment provider, the last 4 characters of the number of the means of payment, fingerprint, validity period, issuer of the means of payment, holder, holder address, country of origin and CVR token.

The legal basis for the processing of the above-mentioned data as part of the ordering process and contract processing is Art. 6 para. 1 lit. b) GDPR. The data will only be stored by us for as long as is necessary for the implementation and processing of your order and fulfillment of the statutory retention periods.
The provision of personal data is necessary for the conclusion of a contract. Failure to provide the data would result in the contract not being concluded.

2.3.3 Setting of cookies by Stripe
Stripe also places cookies on your device during payment processing. Stripe uses these cookies, among other things, to detect and prevent fraudulent activities (necessary cookies), for analysis purposes to improve Stripe's service or to place personalized advertising. Cookies for analysis purposes aim, for example, to recognize you as a customer and your preferred payment method or to evaluate the effectiveness of advertising measures.
Further information on the use of cookies by Stripe can be found here: https://stripe.com/cookies-policy/legal. Information on the further processing of personal data by Stripe can be found here: https://stripe.com/de/privacy
The legal basis for the processing of data by Stripe cookies is the consent given by you in accordance with Art. 6 para. 1 lit. a), insofar as this is necessary for the setting of cookies in compliance with data protection regulations.

2.3.4 Setting of cookies by PayPal
PayPal also places cookies on your device during payment processing. PayPal uses these cookies, among other things, to detect and prevent fraudulent activities (necessary cookies), for analysis purposes to improve PayPal's service or to place personalized advertising. Cookies for analysis purposes aim, for example, to recognize you as a customer and your preferred payment method or to evaluate the effectiveness of advertising measures.
Further information on the use of cookies by PayPal can be found here: https://www.paypal.com/DE/webapps/mpp/ua/cookie-full . Information on the further processing of personal data by Stripe can be found here: https://www.paypal.com/de/legalhub/privacy-full.
The legal basis for the processing of data by PayPal cookies is the consent given by you in accordance with Art. 6 para. 1 lit. a), insofar as this is necessary for the setting of cookies in compliance with data protection regulations.
The legal basis for the processing of data that is processed in the context of obtaining consent is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in being able to prove the consent you have given (Art. 7 para. 1 GDPR).
As the controller, we have concluded an order processing contract with PayPal for the transfer of personal data.
Under certain circumstances, the data collected and processed may be transferred to the USA or other third countries where an adequate level of data protection cannot be guaranteed. This data transfer can be based on standard contractual clauses in accordance with Art. 46, which have been included in our agreement with Stripe.
Under certain circumstances, the data collected and processed may be transferred to the USA or other third countries where an adequate level of data protection cannot be guaranteed. This data transfer can be based on standard contractual clauses in accordance with Art. 46, which have been included in our agreement with PayPal.

2.3.5 Your rights in terms of payment providers
You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
To do this, you can change your cookie settings (e.g. delete cookies, block cookies, etc. For more information, see 5.), unless these cookies are required for fraud prevention or to ensure the security of the websites managed by Stripe or PayPal. However, we would like to point out that in this case you may not be able to use all functions of Stripe or PayPal to their full extent.

2.4 Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited. ("Google"), Gordon House, Barrow Street, Dublin 4 Ireland.
Google Analytics is used to record and evaluate the occurrence of certain events in the app or web app that describe your use of the app (e.g. user registration, purchase completion, selection of content, sharing of content, ...).
An overview of all registered events can be found in the following table:

Landing page

Number of users visiting WebApp landing page (e.g., moviepark.captivr.net)
Origin from where users visiting WebApp came from (e.g., QR code from a marketing poster)
Number of users starting 360° sample video
Number of users clicking on "Scan QR code"

Check-in page

Number of users clicking registration through
1. Google
2. Apple
3. E-mail
Number of users successfully creating accounts
Number of users
1. confirming camera access
2. rejecting camera access
Number of users
1. confirming gyroscope
2. rejecting gyroscope
Number of users with successful scan through WebApp

Delivery e-mail

Number of confirmation e-mails triggered (in case of e-mail registration)
Number of e-mails triggered "Your digital souvenir at <Tenant>"
Number of users clicking e-mail button "View my media"

Media list prior to first purchase

Number of users reaching media list after delivery mail/ after media has been finished
Number of users viewing 360° video trailer
Number of users viewing 2D-video trailer
Number of users purchasing

Media list after first purchase

Number of users logging in after successful purchase
Number of users downloading video
1. 2D-Highlight video
2. 360°-video
Number of users sharing video
1. 2D-Highlight video
2. 360°-video

Information on data processing by Google in the context of the use of Google services can be found in this privacy policy above under section "A 4) Information on Google services".
The following types of data are processed by Google:
• Online identifiers (including cookie identifiers)
• IP address
• Device identifiers
• Number of users
• User behavior in the app (e.g. completing a purchase, adding goods to the shopping cart
• Meeting statistics
• Approximate location
• Browser and device information
In addition, you can find further detailed information on the information processed at https://www.google.com/intl/de/policies/privacy/#infocollect under "Data that we receive based on your use of our services" and at https://privacy.google.com/businesses/adsservices/ .

We also process the following data when you give your consent to the use of Google Analytics:
• Your IP address
• Date and time of sending

We only use Google Analytics with activated IP anonymization ("anonymize IP"). This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

Furthermore, we have concluded an order processing contract with Google for the use of Google Analytics (Art. 28 GDPR). Google processes the data on our behalf to evaluate your use of the website, to compile reports on website activity for us and to provide us with other services relating to website activity and internet usage. Google may transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

Within the scope of commissioned data processing, Google is entitled to commission subcontractors. You can find a list of subcontractors at https://privacy.google.com/businesses/subprocessors/.
By integrating Google Analytics, we pursue the purpose of analyzing user behavior on our website and being able to react to it. This enables us to continuously improve our offering.
The purpose of processing the data collected in the course of the declaration of consent is to record your consent.

The legal basis for the processing of personal data described here as part of the measurement procedure is your express consent in accordance with Art. 6 para. 1 lit. a) GDPR.
The legal basis for processing the data that is processed in the context of obtaining consent is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in being able to prove that you have given your consent to the measurement procedure (Art. 7 para. 1 GDPR).
Within the scope of order processing, Google is entitled to commission subcontractors. You can find a list of these subcontractors at https://privacy.google.com/businesses/subprocessors/.

2.5 Your rights:

2.5.1 Right of withdrawal
If you have consented to the processing of your data, you can revoke your consent at any time without giving reasons. You can declare your revocation by e-mail to support@captivr.de, by post to captivr GmbH, Niederkasseler Lohweg 18, 40547 Düsseldorf, Germany. The revocation has the consequence that data processing to which you have consented will no longer take place, whereby any processing of your data carried out up to the revocation remains unaffected. In the event of revocation, the service in question can no longer be provided. If you have given your consent in the WebApp for the tracking of your behavior or access to your camera, or access to your gyroscope, you can revoke this consent in the WebApp. Under 'Menu' you can find 'My Account' and the data you have given us. From here you can directly delete your account and thus all data provided to captivr.

You can also change your cookie settings (e.g. delete cookies, block cookies, etc.). For more information, please refer to section 2.6 Cookies.

2.5.2. Right of objection
If the processing of your data is not covered by your consent (proof of consent), you have the right to object.

You can send or inform us of your objection at any time (e.g. by e-mail to support@captivr.de ).
The data collected and processed as part of the measurement procedure is stored for 60 days and automatically deleted after this retention period has expired.
The consent log data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.
For more information on data handling in connection with Google Analytics, please refer to Google's privacy policy:
https://support.google.com/analytics/answer/6004245?hl=de
You can find information on Google's privacy settings at https://privacy.google.com/take-control.html?categories_activeEl=sign-in
The provision of personal data is not required by law or contract and is not necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it may mean that you will not be able to use our website or will not be able to use it to its full extent.

2.6 Cookies
Our WebApp uses cookies. Cookies are text files that are stored on your device, e.g. to make the use of an app more convenient or to recognize the user's device and save settings or similar. Entries and settings can be saved in cookies so that you do not have to enter them again each time you visit the website. Cookies contain a so-called cookie ID, which makes it possible to assign the device on which the cookie was stored.
Cookies help us to design our app in a user-friendly and customized way. We use our own cookies and cookies from third-party providers.

We use the following own cookies:

2.6.1 Essential cookies

Technically necessary cookies are cookies that are required for the proper functioning of our WebApp. Technically necessary cookies are stored on the basis of Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in the storage of cookies for the technically error-free and optimized provision of our services.

We use the following technical cookies:

.AspNetCore.Antiforgery*: Prevents breaches
ARRAffinity: for security reasons
ARRAffinitySameSite: for security reasons
consent-policy: stores the response to the request as to whether or not we may store cookies. This cookie has a duration of one year

2.6.2 Cookies for analysis (performance)

These cookies can be used to measure the reach of our app. Among other things, the cookie allows us to track how many users access our app and track user behavior in the app. We use this data to, among other things, optimize the WebApp.

We use Google Analytics cookies for tracking purposes:

_ga: This cookie identifies the user and has a duration of two years,

_gid: Is used to identify the user and has a runtime of 24 hours

2.6.3 Configuration of cookies

You have the option of configuring the setting of cookies at any time.
You can find out how to change the cookie settings here:
Google Chrome: Website
Mozilla Firefox: Website
Apple Safari: Website
Microsoft Internet Explorer: Website

The provision of personal data is not required by law or contract and is not necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it may mean that you will not be able to use the app or will not be able to use it to its full extent.

Other services we use also use cookies. We will inform you separately about the use of cookies in the individual services (e.g., see § 2.3).

3. Final provisions
3.1 Server hosting

Our server provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521. Our data centers are located in West Germany. All aforementioned collected data is stored in those data centers. captivr and its associates is the sole access holder of the data. Data is not sold.

3.2 Data security
We use technical and organizational measures to protect our website and other systems against loss, destruction, access, modification or dissemination of your data by unauthorized persons. Despite regular checks, however, complete protection against all risks is not possible.

3.3 Amendment of the privacy policy
Changes to the law or changes to our internal company processes may make it necessary to amend this privacy policy.
In the event of such a change, we will inform you of this at the beginning of the privacy policy.

3.4 Revocation
You have the right to withdraw your consent at any time by deleting your user account with effect for the future without affecting the lawfulness of processing based on consent before its withdrawal.

3.5 Rights of data subjects
You have the following rights:
• Right to information (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to object (Art. 21 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 et seq. GDPR)
• Right to data portability (Art. 20 GDPR)
For inquiries of this kind, please contact support@captivr.de. Please note that we must ensure that the data subject is actually the person concerned in the case of such requests.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority.
Automated decision-making does not take place on our website.

Status of the privacy policy: 06.03.2025

The following data is stored on your mobile device before check-in via mail address:

After check-in and use of our video service - i.e. setting up an account via e-mail address or social login (Google or Apple account) and initiating a video recording, the following data is transmitted in the communication between the mobile device and our server:

​

Provided e-mail address or social account data (Google/ Apple) during check-in

Date and time of accessing the service

The IP address of your mobile device at the time of access.

Browser type to access the WebApp (e.g., Mozilla Firefox, Safari, Google Chrome etc.)

Scanned QR code before the start of the journey to identify the row you are in and your seat in the row that is to be recorded during the journey

Input of consent to video recording: session identification number, time of consent, version of the privacy policy against which consent was given

If you register via the e-mail address, we will save all the necessary data to send an e-mail to you once the the video from your attraction experience is finished

Payment data when purchasing a video file: amount paid, status, description, payment provider ID, last 4 characters of the payment method number, validity period, payment method issuer, holder address, holder country of origin and CVR token.

Once the video has been purchased, it will be hold in our secure cloud for 1 year. If the video has not been purchased, after 2 weeks since recording, it will be deleted​

The processing of the aforementioned data is carried out for the purpose of contract initiation and contract fulfillment in accordance with Art. 6 para. 1 lit. b) GDPR. The provision of your personal data is voluntary. However, it is not possible to use our services without providing the data.​