Review draft · 17 October 2026

Privacy policy

1. Controller and contact

+49 (0)40 317 938 31
petra@casino-royale-spf.com

Identifying Oliver Albert Weiser as controller is based on the previous website and requires confirmation by the operator. Privacy requests may be sent to the email address above. Whether a data protection officer must be appointed, and their contact details if applicable, must be clarified before approval.

2. Scope and technical configuration

This draft describes the separate Casino Royale review version and its intended public operation. In the local preview at 127.0.0.1, website files are served from the local computer; that local access alone does not send them to Cloudflare. The hosting section below concerns public delivery through Cloudflare.

The reviewed application code contains no analytics or advertising pixels, newsletters, external video players, maps, remotely loaded fonts, AI assistants or CRM integrations. Images, films, fonts and sounds are served as website files. Visitors are not scored and no automated decisions under Article 22 GDPR are made. Any additional server-side hosting configuration must be checked separately before publication.

3. Public delivery and technical connection data

Cloudflare Workers with static assets is the intended online delivery platform. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Online access generates data such as IP address, time, requested URL, status/error information and connection details sent by the browser. The purposes are reliable delivery and detecting and preventing technical faults or attacks. The proposed legal basis is Article 6(1)(f) GDPR, based on the legitimate interest in secure and functioning operation.

Cloudflare operates a global network. Processing outside the EU or EEA cannot therefore be excluded as a general rule. Before approval, the roles of Casino Royale, OK and the hosting account holder, an Article 28 GDPR processing agreement, subprocessors and any international transfer basis under Articles 44 et seq. GDPR must be evidenced. This preview does not claim that an agreement has already been executed, that all processing is EU-only or that a particular transfer mechanism has been verified for this account.

Retention: Actual hosting and security log retention periods still require confirmation against the configuration. No standard period from the concept paper is assumed to be in effect. Deletion must follow the relevant delivery or security purpose; statutory evidence or retention duties require separate assessment.

Further information: Cloudflare privacy information and Cloudflare data processing terms.

4. Optional language preference and device storage

DE/EN switching works without persistent storage. Only if you enable “Remember language for 30 days” does this version save the selected language and an expiry time under casino-language-choice in your browser’s localStorage. Consent is optional; the website remains usable without it. The legal basis for this optional device access is section 25(1) TDDDG and, insofar as personal data is processed, Article 6(1)(a) GDPR.

The preference stops being used after at most 30 days; an expired entry is removed on the next access. You can withdraw consent prospectively by disabling the option or selecting “Delete saved language”. The button also removes the old casino-language entry if present from an earlier preview. The browser-local choice is not sent to the operator as a profile or analytics event.

5. Media, sound and interaction

Video and audio files are requested from the website host according to the scene and user interaction. Their technical delivery is covered by the hosting section. Volume, playback position, the floating contact window’s position and animation states are held temporarily in memory in this version, not stored as a visitor profile. The reviewed code uses Web Audio and Canvas for presentation and playback, not for device identification or fingerprinting.

6. Email and telephone contact

Email and telephone links open your configured application. Clicking the link alone does not automatically send an email or place an unsolicited call. If you actually contact us, we process the contact details and content you provide to handle your enquiry. Article 6(1)(b) GDPR is the proposed basis for contract-related enquiries; Article 6(1)(f) applies to other legitimate enquiries.

Recipients may include the people handling the enquiry and contracted email or telephone service providers. Those providers, applicable processing arrangements and transfers must be added before approval. Enquiry data is deleted after handling is complete unless further processing, necessary legal defence or statutory retention is required. Contract and accounting records follow their applicable separate retention periods; contacts are not all retained indefinitely.

7. Preview form

The contact form is not connected to a sending service or CRM. With JavaScript functioning, the name, email and message are processed locally; submitting the form does not send them to a server. Its response explains that the message has not been sent. Without JavaScript, the demo form is hidden. Please use email or telephone for actual contact. Before a live integration, this policy, recipients, security measures and deletion periods must be updated.

8. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). Consent can be withdrawn prospectively at any time. You may also complain to a data protection authority (Article 77).

Objection: Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21(1). You may object to direct marketing at any time; such processing is not integrated into this review version.

The Hamburg authority can be reached via Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany. You may also complain to the authority in the country of your habitual residence, place of work or the alleged infringement.

9. Required information, security and changes

Technical connection data is necessary for online delivery. Public content otherwise requires neither registration nor an enquiry. If you contact us, the information needed to handle and answer the enquiry is required; without it, handling may be limited. Sensitive information should not be sent through unencrypted email. HTTPS is a prerequisite for public delivery. This policy must be reviewed when hosting, forms, media providers or optional measurement change.

This website has no online shop, shopping cart or payment service. According to the operator, email is provided through Google. The specific Google contracting entity, contractual arrangements and any applicable transfer basis still require confirmation; no particular Workspace configuration is claimed to have been verified.

Optional usage measurement – currently disabled

An additional measurement feature for topic interest, contact actions and active visible usage time has been prepared technically, but is centrally disabled in this version. This feature therefore sends no analytics requests and reads or stores no analytics identifiers or consent preferences in the browser. Cloudflare Web Analytics has not been activated in this version's application code either. Technical connection data processed for hosting is separate.

Activation requires a separate release with updated privacy information, a valid legal basis, prior consent for the proposed optional behavioural measurement, and reviewed recipients, safeguards and deletion periods. Entering the studio or enabling sound is not consent to tracking. The website remains usable without optional analytics.