Privacy Policy

Q Studios Berlin GmbH · Streaming Platform

Version 1.1 | As of: June 2026

§ 1 Controller

The controller within the meaning of the General Data Protection Regulation
(GDPR) and the German Federal Data Protection Act (BDSG) is:

  Q Studios Berlin GmbH
  Kreuzbergstraße 71
  10965 Berlin, Germany
  Email: hello@q-studios-berlin.com

A formally appointed Data Protection Officer has not been designated, as the
legal requirements under § 38 BDSG are not met. For any data protection
enquiries, please contact us directly at the email address above.

§ 2 Principles of Processing

Q Studios Berlin GmbH processes personal data exclusively on the basis of the
legal grounds provided for under the GDPR:

§ 3 Data Collected & Purposes

3.1 Registration & User Account (via Clerk)
User account registration and management is handled by Clerk (Clerk.com, Inc.,
548 Market St, PMB 72878, San Francisco, CA 94104, USA). Upon registration,
we and/or Clerk on our behalf collect:
  • Name and email address
  • Chosen password (stored in encrypted form; Clerk does not process
    plaintext passwords)
  • Date and time of registration
  • Device information and IP address for session management and fraud
    prevention
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR
(legitimate interest in account security).

3.2 Rental Transactions & Usage History
In the course of Platform use, we process:
  • Content booked, booking time, and rental fee
  • Start and end time of the 96-hour access window
  • End devices used (device ID, operating system, browser/app version)
  • Streaming quality data for fault diagnosis (bandwidth, buffering events)
Legal basis: Art. 6(1)(b) and (f) GDPR.

3.3 Communication & Support
Contact requests are stored together with the contact details provided.
Legal basis: Art. 6(1)(b) and (f) GDPR.

3.4 Server Log Files
When the Platform is accessed, the following are logged: IP address (anonymised
after 7 days), date/time, URL accessed, data volume transferred, HTTP status
code. Legal basis: Art. 6(1)(f) GDPR.

3.5 Email Communication & Newsletter
Transactional emails (including verification and password reset emails) are
partly sent via Clerk. Newsletters are only sent with separate consent pursuant
to Art. 6(1)(a) GDPR (revocable at any time).

§ 4 Authentication Service — Clerk

For user account management, login, session management, and authentication,
we use Clerk:

  Provider:     Clerk.com, Inc.
  Address:      548 Market St, PMB 72878, San Francisco, CA 94104, USA
  Website:      https://clerk.com
  Privacy:      https://clerk.com/privacy

4.1 Data Processed by Clerk
Clerk processes the following data on our behalf:
  • Email address and (optional) name of the user
  • Encrypted password (no plaintext access)
  • Session tokens and device IDs for managing active login sessions
  • IP addresses and user-agent information for fraud detection
  • Timestamps of login and logout events

4.2 Third-Country Transfer
Clerk is a US-based company. Processing takes place on servers in the USA.
The transfer is safeguarded by EU Standard Contractual Clauses (SCCs) pursuant
to Art. 46(2)(c) GDPR. A data processing agreement pursuant to Art. 28 GDPR
is in place with Clerk.

4.3 Legal Basis
Art. 6(1)(b) GDPR (performance of contract: provision of the user account) and
Art. 6(1)(f) GDPR (legitimate interest in secure authentication and fraud
prevention).

4.4 Retention Period
Clerk retains account data for the duration of the existing user account. Upon
account deletion, data is removed from Clerk's systems within 30 days, unless
statutory retention obligations apply.

§ 5 Payment Service Providers

Legal basis: Art. 6(1)(b) GDPR and data processing agreements pursuant to
Art. 28 GDPR.

§ 6 Analytics & Tracking

6.1 Vercel Web Analytics
We use Vercel Web Analytics provided by Vercel Inc., 440 N Barranca Ave #4133,
Covina, CA 91723, USA, for aggregated, cookieless usage statistics.

Data processed: page URL, referrer, anonymised visitor/location information,
device, browser, operating system, timestamp, and technical request data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and
improving platform usage). Transfers to the USA are safeguarded by standard
contractual clauses and the applicable data processing agreement.

6.2 Google Analytics
NOTE: Google Analytics transfers data to the USA. This service is only used
where a valid consent (Art. 6(1)(a) GDPR) has been obtained via our cookie
banner.

Service used:
Google Analytics 4 (GA4) provided by Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland.

Data processed:
Anonymised IP address, pages visited and time spent, device and browser type,
country of origin, conversion events.

IP anonymisation & data transfers:
IP anonymisation is enabled. Transfers to the USA are based on EU Standard
Contractual Clauses (SCCs). Further information: https://policies.google.com/privacy

Opt-out:
Via cookie settings or the browser add-on at:
https://tools.google.com/dlpage/gaoptout

§ 7 Login Services

User account management and authentication is handled exclusively via Clerk
(see § 4). No data is transferred to social networks or other external login
providers, unless the user activates a social login service (e.g. Google, Apple)
through the Clerk interface. Should such services be offered in the future, this
policy will be updated accordingly.

§ 8 Cookies

Note: Clerk sets technically necessary cookies to manage login sessions. These
are essential for the operation of the Platform and do not require separate
consent.

Cookie settings can be adjusted at any time via the cookie settings menu on
the Platform.

§ 9 Data Sharing & Third-Country Transfers

9.1 No Sharing for Advertising Purposes
Personal data is neither sold nor rented to third parties.

9.2 Processors (Overview)

All processors are bound by data processing agreements (DPAs) pursuant to
Art. 28 GDPR.

9.3 Third-Country Transfers
Data is transferred to the USA to: Clerk, Google Analytics, Vercel, Stripe, and
PayPal. All transfers are safeguarded by EU Standard Contractual Clauses (SCCs)
pursuant to Art. 46(2)(c) GDPR.

9.4 Requests from Authorities
Data is only disclosed to authorities where legally required. Users will be
informed to the extent permitted by law.

§ 10 Retention Periods

§ 11 Rights of Data Subjects

As a data subject, you are entitled to the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Competent Supervisory Authority:
  Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI)
  Friedrichstr. 219 · 10969 Berlin, Germany
  https://www.datenschutz-berlin.de

To exercise your rights, please contact:
  Email: hello@q-studios-berlin.com
  Response deadline: 30 days (Art. 12(3) GDPR)

Note on account deletion: Users may delete their account directly via the
Platform's account settings. Clerk will delete the associated authentication
data within 30 days of account closure.

§ 12 Data Security

Technical and organisational measures (TOMs) pursuant to Art. 32 GDPR include:
  • Encrypted transmission via TLS/HTTPS
  • Password storage exclusively in encrypted form via Clerk
    (bcrypt; no plaintext access)
  • Multi-factor authentication (MFA) available via Clerk
  • Access restrictions based on the principle of least privilege
  • Regular security updates and penetration testing
  • Logging of access to personal data

In the event of a data breach: notification to the BlnBDI within 72 hours and
communication to affected individuals pursuant to Art. 33 and 34 GDPR.

§ 13 Changes to This Privacy Policy

This Privacy Policy is updated as required. The current version is always
available on the Platform. Registered users will be notified by email of any
material changes.