Privacy policy

1. Controller

The controller is onthewall® GmbH, Solmsstrasse 35, 10961 Berlin, Germany, represented by managing director Fritz Loschütz. Contact: info@onthewall.de; telephone +49 3362 8851131.

2. Hosting and server logs

The website is hosted on a server provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, and managed by us using Plesk. Requests involve your IP address, date and time, requested address, response status, data volume, browser details and, where provided, the referring page. Processing is necessary to deliver, troubleshoot and secure this website. The basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Access and error logs are rotated regularly. The current configuration retains seven archived logs in addition to the current log. With daily rotation, this normally represents approximately eight days. Data needed to investigate a specific security incident may be retained until the incident is resolved. Hosting processing is governed by the contractual data processing arrangements with STRATO under Article 28 GDPR.

3. Fonts, images and films

Fonts, images, scripts and video files are served directly by this website. Our cinematic scenes do not embed a YouTube, Vimeo or Higgsfield player. Serving these files does not send usage data to those providers.

On a first visit, films remain unloaded until you accept, reject or save the privacy settings. The visible scene can then load, and further scenes load on demand. Locally served films are independent of analytics and marketing consent. A preference for reduced motion keeps still images visible.

4. Cookie settings and local storage

We currently set no analytics or advertising cookies and load no Google tags. Your choice is stored in browser local storage under “onthewall-consent-v1”. It includes a version, the scope of services offered, analytics and marketing choices and a timestamp. The choice is used for no more than 180 days, after which we ask again.

Storage is used exclusively to respect your privacy choice and is necessary for managing that choice (Section 25(2)(2) TDDDG). Where personal data is processed, the basis is our legitimate interest in respecting and managing your choice (Article 6(1)(f) GDPR). If browser storage is blocked, the choice is remembered only for the current page.

You can reopen “Cookie settings” in the footer at any time. Optional purposes are not preselected. Adding new services requires a fresh choice; an earlier decision does not authorise them. You can also clear local storage in your browser settings.

5. Project form and contact

The project form contains company, contact person, phone number, email address and message. Contact person, email address and message are required; company and phone are optional. “Send enquiry” transmits your details over an encrypted connection to our STRATO server, whose mail service sends them to info@onthewall.de. Your email address is used as the reply address. We do not transmit form contents to analytics or AI services. Form details are not stored in browser local storage or cookies.

For enquiries through the form or by email, we process your submitted details to handle and answer the enquiry. For a contract or steps prior to a contract, the basis is Article 6(1)(b) GDPR. For other enquiries, it is our legitimate interest in answering the enquiry under Article 6(1)(f) GDPR.

Enquiries reach our business email inbox and are retained as needed to handle them, a subsequent business relationship or statutory obligations. Opening the form sets the necessary session cookie “__Host-otw-contact” (Secure, HttpOnly, SameSite Strict), which expires when the browser session ends and contains only a random identifier. The server uses short-lived sending tokens and checksums for up to two hours to protect the form and prevent duplicate sends; no form contents are stored in this session state. Salted IP checksums and sending timestamps are processed to limit spam. Entries are effective for one hour and removed at the next sending check. These measures support secure form operation (Section 25(2)(2) TDDDG; Article 6(1)(f) GDPR) independently of analytics or marketing consent.

6. Analytics and marketing

Google Analytics, Google Ads and comparable services are not currently active. Their settings are therefore disabled. Before activating them, we will identify providers, purposes, data, recipients, retention and any third-country transfers and safeguards.

Services that require consent load only after consent for the corresponding purpose. The website and contact options remain usable after rejection. Form content and contact details will not be used as measurement data.

7. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time for the future; lawful processing before withdrawal is unaffected.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

Contact info@onthewall.de to exercise your rights. You may also complain to a supervisory authority, particularly where you normally live, work or believe an infringement occurred. The supervisory authority for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information.

8. Changes

We update this policy when the actual functions or services change. New purposes requiring consent are requested separately. Updated 6 October 2026.