Data protection information for administrators and contact persons (Art. 13 GDPR)

The protection of your personal data is important to us. With the following information, we inform you — as a contact person, administrative staff member, production manager, or administrator of our business customers and interested parties — in accordance with Art. 13 of the General Data Protection Regulation (GDPR) about which personal data we collect in the context of initiating, implementing, and processing contractual relationships with your company, how we process this data, and which rights you have as a data subject. We process personal data exclusively within the framework of the statutory provisions. This includes, in particular, data that is necessary to ensure communication with you, to provide our contractual services to your company, and to ensure smooth administration in connection with the use of our software solutions and services.

1. Name and contact details of the controller

extainia UG (limited liability)
Dreischeibenhaus 1
40211 Düsseldorf
Email: info@extainia.com
Web: www.extainia.com

2. Contact details of the data protection officer

DATENDO GmbH
Hohenzollernring 55, 50672 Cologne, Germany
Email: dsgvo@datendo.de
Web: www.datendo.de

3. Purposes of processing and legal basis

We process your personal data for the following purposes:

Communication and contract execution: To initiate, execute, and manage contractual and business relationships with the company you work for. This includes correspondence by email, telephone, or post, as well as the administration of your customer account.
Provision and use of our software/app: To provide you, as an administrator or contact person, with access data, to create users, and to enable the use of our software solutions for your company from a technical and organizational perspective.
Compliance with legal obligations: To comply with legal obligations, in particular commercial and tax law retention obligations and regulatory requirements under data protection law.
Protection of legitimate interests: Where necessary, we also process your data to protect our legitimate interests or the interests of third parties (Art. 6 (1) (f) GDPR). These include, for example, asserting legal claims and defending against legal disputes, ensuring IT security and IT operations, and measures for the further development of our services.

The processing of your personal data is based on:

Art. 6 (1) (b) GDPR (performance of a contract or implementation of pre-contractual measures),
Art. 6 (1) (c) GDPR (compliance with legal obligations), and
Art. 6 (1) (f) GDPR (safeguarding legitimate interests).

Please note: The responsibility under data protection law for the processing of personal data collected and processed when using the app lies with the respective controller (e.g., the film production company) using the app.

4. Categories of personal data and data subjects

Within the scope of the business relationship with your company, we process personal data of the following data subjects:

Clerks and contact persons in the context of contract initiation, execution, and communication,
Production managers as responsible contact persons for the use and coordination of our software solutions/app,
Administrators from the film production company who are responsible for managing user accounts within the app.

The personal data processed in this context includes in particular:

Master data (last name, first name, title if applicable, position in the company),
Contact details (email address, telephone number, address),
Company affiliation (company, department, function),
Access data in the context of the provision and administration of the software,
Communication content (e.g., email correspondence, support requests).

5. Recipients of personal data

Your personal data will only be passed on to those entities that need it to fulfill the above-mentioned purposes. These include in particular:

Internal departments of our company that are involved in managing the business relationship, contract processing, and the technical provision of the software,
IT service providers and technical operators that we use for the operation, maintenance, and further development of our software and our IT infrastructure,
Hosting providers in Belgium, where the app is operated,
Acronis International GmbH (France), where data backups are stored,
externe Berater oder Dienstleister (zum Beispiel Rechtsanwälte, Steuerberater), soweit dies für die Wahrung unserer rechtlichen und wirtschaftlichen Interessen erforderlich ist,
Behörden und öffentliche Stellen, sofern wir rechtlich dazu verpflichtet sind (zum Beispiel im Rahmen von Auskunfts- oder Nachweispflichten),
Apple Inc. (Apple App Store) and Google Ireland Limited / Google LLC (Google Play Store) as recipients of personal data insofar as such data is processed in the course of downloading, installing, or using the stores. This processing is carried out under the independent data protection responsibility of the respective providers.

No further transfer of your personal data to third parties will take place unless you have expressly consented to this or we are legally obliged to do so.

6. Duration of storage

We only store your personal data for as long as is necessary to fulfill the aforementioned purposes. In particular, the following principles apply:

We store data collected in the course of the business relationship with your company for the duration of the contractual relationship.
After termination of the business relationship, your data will be deleted unless statutory retention obligations (e.g., under commercial or tax law) require longer storage. In these cases, the data will be stored for the duration of the statutory retention period.
If we process data on the basis of your consent, we will store it until you revoke your consent, unless there are longer statutory retention obligations.
Communication data (e.g., emails) will be stored in accordance with legal archiving requirements.

After the respective periods have expired, the data will be routinely deleted or blocked in accordance with legal requirements.

7. Your rights as a data subject

You have the following rights in connection with the processing of your personal data:

Right of access (Art. 15 GDPR): Request information at any time about what data we have stored about you and for what purposes it is processed.
Right to rectification (Art. 16 GDPR): Immediate correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR): Erasure of your data, provided that there are no legal retention obligations or other legitimate reasons that prevent deletion.
Right to restriction of processing (Art. 18 GDPR): Under certain conditions, request that your data be processed only to a limited extent (e.g., if you dispute the accuracy of the data).
Right to object (Art. 21 GDPR): Object to the processing of your data if there are reasons arising from your particular situation that speak against processing.
Right to data portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used and machine-readable format and transmit it to another controller, where applicable.
Right to withdraw consent (Art. 7 GDPR): Withdraw your consent at any time.

8. Withdrawal of consent

If the processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

9. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. The supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
P.O. Box 200444, 40102 Düsseldorf, Germany
Phone: +49 (0)2 11/384 24-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

10. Provision of data and necessity

The provision of your personal data is necessary to conclude and execute the contract with us. Without this data, we may not be able to fulfill the contract. In some cases, such as voluntary marketing activities, the provision of data is based on your express consent.

11. Transfer to third countries

Your personal data will not be transferred to a third country outside the European Union or the European Economic Area.

12. Automated decision-making

There is no automated decision-making or profiling.

As of

September 2025

Note on inclusive language

For better readability, this document does not use gender-neutral language. All personal references are to be understood as gender-neutral and refer equally to all genders.