Legal
Privacy Policy.
Last updated: August 15, 2025
1. Controller
The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
2. Overview of Data Processing
The following overview summarizes the types of data processed and the purposes for which they are processed, as well as the data subjects concerned.
Types of data processed:
- Inventory data (e.g., names, company names)
- Contact data (e.g., email addresses, phone numbers)
- Content data (e.g., text inputs, messages sent via forms)
- Usage data (e.g., pages visited, time of visit, browser type)
- Meta and communication data (e.g., IP addresses, device identifiers)
- Contract and billing data (e.g., payment information, invoicing details)
Categories of data subjects:
- Website visitors
- Prospective clients (leads)
- Existing clients (contractual partners)
- Communication partners
3. Legal Bases of Processing (Art. 6 GDPR)
We process personal data on the following legal bases:
Art. 6(1)(a) GDPR — Consent
Where you have given us express consent to process your data (e.g., by submitting a contact form or opting in to communication).
Art. 6(1)(b) GDPR — Contract Performance
Processing is necessary for the performance of a contract to which you are a party, or for pre-contractual steps taken at your request (e.g., responding to an enquiry).
Art. 6(1)(c) GDPR — Legal Obligation
Processing is necessary to comply with a legal obligation (e.g., tax and accounting regulations under German/EU law).
Art. 6(1)(f) GDPR — Legitimate Interests
Processing is necessary for the purposes of our legitimate interests, such as improving our website, ensuring security, and managing business communications, except where such interests are overridden by your fundamental rights.
4. Contact & Enquiry Processing
When you contact us via email, contact form, or any other communication channel, we process the data you provide (name, email address, company name, message content, and any other information you voluntarily share) solely for the purpose of responding to your enquiry and handling the business relationship.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interests in handling business communications).
Retention period: Contact data is stored for as long as necessary to respond to your enquiry. If a business relationship arises, the data is retained for the duration of the contract and for the duration of statutory retention periods under commercial and tax laws (typically 6 to 10 years).
5. Website Hosting & Technical Data
Our website is hosted via Vercel Inc., 340 Pine Street, Suite 1600, San Francisco, CA 94104, USA. When you visit our website, Vercel automatically collects and stores server log files containing:
- IP address of the requesting device (anonymized after transmission)
- Date and time of the request
- URL of the page accessed
- Browser type and version
- Operating system
- HTTP status code
- Amount of data transferred
- Referring URL (the page from which the visit originated)
This data is technically necessary for operating and securing the website and is stored for a maximum of 30 days before automatic deletion.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functional website operation).
Vercel may transfer data to the USA. This transfer is governed by Vercel's Standard Contractual Clauses (SCCs) with the European Commission. For details, see Vercel's Privacy Policy.
6. Client Data & Service Delivery
In the course of providing our services, we process client data necessary for the execution of our contractual obligations. This includes:
- Client name and company information
- Contact details (email address, phone number)
- Billing and payment information
- Brand assets, product descriptions, and media files shared by the client
- Performance data, analytics reports, and creative briefs
- Communication records (email, video calls, messaging platforms)
Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal obligation for accounting purposes).
Retention period: Client data is retained for the duration of the contractual relationship and for the duration of statutory retention periods under commercial and tax laws (typically 10 years).
7. Third-Party Tools & Services
We use the following third-party services in the course of operating our business. Each service processes data as described below:
Vercel (Hosting)
Provider: Vercel Inc., USA. Processes server logs and technical access data for website hosting. Data transfer covered by SCCs. Privacy Policy.
Google Fonts
Provider: Google LLC, USA. We load fonts via Google's CDN, which may transmit your IP address to Google. We use font loading in a privacy-friendly manner (self-hosted where possible). Privacy Policy. Legal basis: Art. 6(1)(f) GDPR.
Email Communication
We communicate with clients and leads via email. Your email address and message content are processed solely for communication purposes. Emails are stored on our email provider's servers. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.
Video Conferencing Tools
We may conduct discovery calls and strategy sessions via tools such as Google Meet or Zoom. These providers process your name, email address, and audio/video data. Please refer to each provider's privacy policy for details. Legal basis: Art. 6(1)(b) GDPR.
AI Video Production Tools
In the course of video production, we may use AI-based tools. We do not share identifiable personal data about you or your customers with these tools. Brand assets and product descriptions shared by you may be processed by these tools solely to fulfill our service. All tools we use are contractually bound to handle data confidentially.
Accounting & Invoicing Software
We use accounting software to manage invoices and financial records. Your name, company name, address, and invoice data are processed for this purpose. Legal basis: Art. 6(1)(c) GDPR (legal obligation).
8. Cookies
Our website currently uses only technically necessary cookies that are essential for the operation of the website (e.g., session management). We do not use tracking cookies, advertising cookies, or cookies for profiling purposes.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically functioning website). No consent is required for technically necessary cookies under applicable national laws implementing the ePrivacy Directive (such as Section 25(2) of the German TDDDG).
Should we introduce analytics or marketing cookies in the future, we will update this policy and implement a consent management mechanism (cookie banner) before doing so.
9. Data Transfers to Third Countries
Some of the third-party services we use (e.g., Vercel, Google) are based in the United States. Any transfer of personal data to third countries outside the EU/EEA is carried out exclusively on the basis of appropriate safeguards, specifically:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR)
- Adequacy decisions by the European Commission where applicable
10. Your Rights as a Data Subject
Under the GDPR, you have the following rights with respect to your personal data:
Right of Access (Art. 15 GDPR)
You may request a copy of all personal data we hold about you.
Right to Rectification (Art. 16 GDPR)
You may request correction of inaccurate or incomplete data.
Right to Erasure (Art. 17 GDPR)
You may request deletion of your data where no legal obligation to retain it exists.
Right to Restriction (Art. 18 GDPR)
You may request that we restrict the processing of your data in certain circumstances.
Right to Data Portability (Art. 20 GDPR)
You may request your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object to processing based on legitimate interests at any time.
Right to Withdraw Consent (Art. 7(3) GDPR)
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Right to Lodge a Complaint (Art. 77 GDPR)
You have the right to lodge a complaint with the competent supervisory authority in your EU member state.
To exercise any of your rights, please contact us at: privacy@bescene.com
The competent supervisory authority is the data protection authority of the country in which our business is located or where you reside (for Greece, the Hellenic Data Protection Authority - HDPA, www.dpa.gr).
11. Data Security
We implement appropriate technical and organizational measures (TOMs) to protect your personal data against unauthorized access, loss, destruction, or manipulation. Our website is served exclusively over HTTPS (TLS encryption). Access to personal data is restricted on a need-to-know basis.
Despite these measures, data transmission over the internet cannot be guaranteed to be completely secure. We therefore cannot guarantee absolute security of data transmitted to our website.
12. Automated Decision-Making & Profiling
We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
13. Changes to This Privacy Policy
We reserve the right to update this privacy policy from time to time to reflect changes in our business operations, legal requirements, or data processing activities. The current version is always available on this page. We recommend checking this page periodically for any updates.
14. Contact for Data Protection Enquiries
If you have any questions about how we process your personal data, or if you wish to exercise any of your rights, please contact us at:
BESCENE — Data Protection
Email: privacy@bescene.com