Privacy Policy

1. Controller

The controller responsible for the processing of personal data described in this Privacy Policy is Heinz Marc Schneider, trading as Get Your Lightshow.

2. Scope of this Privacy Policy

This Privacy Policy explains how personal data are processed when a person visits the website, contacts Get Your Lightshow, submits a Free Initial Project Review, uploads project materials, requests a copy of submitted information, receives or accepts a proposal, becomes a client, or otherwise communicates in connection with a project.

3. Categories of personal data

Depending on the interaction, the following categories of personal data may be processed:

• Identity and contact data, such as name, organisation, email address, telephone number, country and postal or billing details.
• Project and production data, such as production title, dates, venue situation, artistic direction, technical requirements, equipment information and project status.
• Uploaded materials, such as scripts, running orders, stage plans, technical riders, equipment lists, photographs, rehearsal material and similar project files.
• Contract, billing and accounting data, such as proposals, acceptance records, invoices, tax information and payment references.
• Communication data, including project emails, written approvals, revision requests and complaints.
• Technical website data, including IP address or anonymised/shortened IP information where applicable, browser information, timestamps, requested resources, session identifiers and security-related log information.

4. Purposes and legal bases

4.1 Website operation and security

Technical data may be processed to deliver the website, maintain security, prevent abuse, operate session-based form protection, diagnose faults and maintain the availability of the service.

Legal basis: legitimate interests in secure and reliable website operation and, where applicable, compliance with legal obligations.

4.2 Free Initial Project Review and pre-contractual enquiries

Information submitted through the Project Review is processed to evaluate whether a project is suitable, identify an appropriate service, request missing information, assess scope and feasibility, prepare an individual proposal and communicate about a possible contract.

Legal basis: processing necessary to take steps at the request of the person concerned before entering into a contract. Where a representative submits information on behalf of an organisation, processing may additionally be based on legitimate interests in handling the organisation's enquiry.

4.3 Performance of accepted projects

Once a contract exists, personal data and project information are processed to perform the agreed services, manage revisions and approvals, deliver project documentation, administer the client relationship and provide support relating to the contracted production.

Legal basis: performance of a contract and steps necessary in connection with that contract.

4.4 Billing, taxation and legal records

Billing, tax, accounting, contractual and legally relevant records are processed and retained where required for compliance with legal obligations and for the establishment, exercise or defence of legal claims.

Legal basis: compliance with legal obligations and, where applicable, legitimate interests in legal administration and defence.

4.5 Complaints and legal enquiries

Information contained in complaints, legal correspondence or rights requests is processed in order to respond, document the matter and comply with applicable legal obligations.

Legal basis: legal obligation and legitimate interests in the management and defence of claims.

5. Project uploads and third-party data

Project materials may contain information about directors, performers, technicians, employees, volunteers, minors or other third parties. The person submitting such materials must be authorised to provide them for the relevant project purpose and must avoid submitting personal data that are unnecessary for the review or service.

Identity documents, financial account credentials, medical information and other special-category or highly sensitive personal data should not be uploaded unless Get Your Lightshow has specifically requested the information and an appropriate legal basis has been established.

Where unnecessary or inappropriate personal data are identified, Get Your Lightshow may delete or decline to process the relevant material.

6. Children and minors

The Project Review form is intended to be submitted by adults or authorised representatives of organisations or productions. Minors should not independently submit project enquiries or personal data through the form.

Project materials may include information or images relating to minors only where the submitting party is lawfully authorised to provide them for the relevant production purpose.

7. Recipients and service providers

Personal data are not sold.

Data may be disclosed or made accessible to the following categories of recipients where necessary:

• Hosting and email service providers acting as processors.
• Banks or payment service providers involved in receiving or processing payments.
• Professional advisers, such as tax advisers, accountants or legal advisers, where necessary.
• Public authorities, courts or other competent bodies where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.

8. Hosting and email: STRATO

The website and email infrastructure are currently provided by STRATO GmbH, Germany. STRATO may process personal data on behalf of Get Your Lightshow as a processor in connection with hosting, email and related infrastructure.

STRATO states that its hosting data are stored in its data centres in Germany. An appropriate data-processing agreement under Article 28 GDPR should be maintained for the relevant STRATO services.

The website does not currently use Google Analytics, Meta Pixel, Google Ads tracking, Google reCAPTCHA or other third-party marketing or behavioural-tracking tools.

9. International transfers

The current website and email hosting described above are based in the European Union. Get Your Lightshow does not currently use third-country analytics, advertising or CAPTCHA providers for the Project Review.

A client's own location outside the European Economic Area does not by itself mean that website data are transferred to that country. However, project communications may naturally be exchanged with the client or its authorised contacts in the country where they are located.

If a future service provider requires an international transfer of personal data, the applicable transfer mechanism and safeguards will be assessed and this Privacy Policy will be updated where required.

10. Retention periods

10.1 Project Reviews that do not become projects

Project Review submissions and uploaded files for enquiries that do not result in a project are normally deleted within 90 days after the enquiry has been closed, declined or otherwise concluded, unless continued retention is necessary because discussions remain active or a legal issue requires retention.

10.2 Accepted and completed projects

Operational project files and client-supplied production materials are normally retained for up to one year after completion of the project. They may then be deleted unless continued retention has been specifically agreed or is necessary for an ongoing matter.

Clients should keep their own archive of final deliverables. Get Your Lightshow does not guarantee the availability of working files or replacement copies after the project retention period.

10.3 Legal, accounting and contractual records

Invoices, accounting documentation, contracts, legally relevant correspondence and other records that must be retained by law are kept for the applicable statutory retention periods. These records may therefore be retained longer than operational project files.

10.4 Technical logs and temporary data

Technical hosting and security logs are retained only for periods appropriate to operational and security purposes. STRATO currently describes short-term log and temporary-data retention as generally ranging from a few days up to approximately 60-90 days depending on the specific operational or security need. Actual retention may depend on the hosting service and configuration.

11. Security

Appropriate technical and organisational measures are used to protect personal data against unauthorised access, accidental loss, alteration or disclosure.

The Project Review currently includes server-side controls such as CSRF protection, a server-generated CAPTCHA, a honeypot, rate limiting, minimum completion time, file-extension and MIME-type validation, file-size limits and restrictions on executable uploads.

No method of electronic transmission or storage can provide absolute security. Users should therefore avoid transmitting information that is not necessary for the project.

12. Project Review file limits

The Project Review currently permits up to 10 uploaded files, with a maximum size of 8 MB per file and 20 MB in total. Supported file types are limited by the website's current technical configuration.

13. Email copy of a Project Review

If the user actively requests an email copy of submitted project information, a structured summary may be sent to the email address provided. The uploaded files themselves are not included in that customer copy.

The user is responsible for providing an accurate email address and for ensuring that the selected mailbox is appropriate for receiving project information.

14. Cookies and similar technologies

The website currently uses only technical session or equivalent storage mechanisms necessary for website and form operation, security, CAPTCHA handling, CSRF protection and abuse prevention. These technologies are described in the Cookie Policy.

No consent-based analytics or advertising cookies are currently intended to be used. If this changes, the relevant consent mechanism and legal information will be updated before non-essential tracking is activated.

15. Rights of data subjects

Subject to the conditions and limitations of applicable data-protection law, individuals may have the right to:

• obtain confirmation of whether their personal data are being processed and request access;
• request rectification of inaccurate or incomplete data;
• request erasure where the legal requirements are met;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive personal data in a portable format where the right to data portability applies;
• withdraw consent at any time where a specific processing activity is based on consent, without affecting the lawfulness of processing before withdrawal.

Requests may be sent to info@getyourlightshow.com. Reasonable information may be requested where necessary to verify the identity of the person making the request.

16. Supervisory authority

A person who considers that the processing of personal data infringes applicable data-protection law has the right to lodge a complaint with a competent supervisory authority.

In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain.

17. Automated decision-making

Get Your Lightshow does not currently use the Project Review to make decisions based solely on automated processing that produce legal effects or similarly significant effects for the person concerned. Project suitability and service recommendations are reviewed by a person.

18. Changes to this Privacy Policy

This Privacy Policy may be updated when the website, services, technical providers or data-processing practices change. The current version will be made available on the website.

Last updated: 4 September 2026.