CZWTV
Abonnieren

Privacy Policy

1. Introduction and Data Controller

This Privacy Policy explains how LISA Film GmbH ("CZWTV," "we," "us," or "our") collects, processes, stores, and protects your personal data when you access or use the CZWTV streaming platform at CZWTV.com and any associated applications (the "Service"). We are committed to protecting your privacy and processing your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Austrian Data Protection Act (Datenschutzgesetz, DSG), and all other applicable data protection legislation.

Data Controller:
LISA Film GmbH
Seecorso 4, 9220 Velden am Wörther See, Austria
Commercial Register: FN 141122h, Landesgericht Klagenfurt
Managing Director: Andrea Hroch
Email: [email protected]

If you have any questions about how we handle your personal data or wish to exercise your rights under the GDPR, please contact our Data Protection Officer at [email protected].

2. Data We Collect

2.1 Account Data

When you create an account, we collect information you provide directly, including your full name, email address, date of birth, country of residence, preferred language, and account password (stored in hashed form). If you sign up using a third-party authentication provider, we may receive your name, email address, and profile identifier from that provider.

2.2 Payment Data

When you subscribe to a paid plan, we collect billing information necessary to process your payment, including your payment method type, the last four digits of your card number, billing address, and transaction history. Full payment card details are processed and stored exclusively by our PCI DSS-compliant third-party payment processors. CZWTV does not store complete credit card numbers or security codes on its servers.

2.3 Usage Data

We automatically collect information about how you interact with the Service, including the titles you watch, viewing duration, playback events (play, pause, skip, rewind), search queries, browse history, content added to your watchlist, ratings and reviews you provide, and your interactions with platform features.

2.4 Device and Technical Data

We collect technical information about the devices you use to access the Service, including your IP address, device type and model, operating system and version, browser type and version, screen resolution, unique device identifiers, network information, and time zone settings. We also collect information about your internet connection quality to optimise streaming performance.

2.5 Cookies and Similar Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to collect data about your browsing behaviour and preferences. For detailed information about the cookies we use and how to manage them, please refer to our Cookie Policy.

2.6 Communication Data

When you contact our customer support or communicate with us through any channel, we collect the content of your communications, including emails, chat messages, and any attachments, along with associated metadata such as date, time, and communication channel.

3. Legal Basis for Processing

We process your personal data on the following legal bases as set out in Article 6(1) of the GDPR:

  • Performance of a contract (Art. 6(1)(b) GDPR): Processing necessary to provide the Service, manage your account, process subscription payments, deliver content, and fulfil our contractual obligations to you under the Terms of Service.
  • Legitimate interests (Art. 6(1)(f) GDPR): Processing necessary for our legitimate business interests, including improving and personalising the Service, content recommendation, fraud prevention and security, analytics and performance monitoring, and protecting our intellectual property rights. We conduct balancing tests to ensure our interests do not override your fundamental rights and freedoms.
  • Consent (Art. 6(1)(a) GDPR): Where you have given your explicit consent to specific processing activities, such as the use of non-essential cookies, marketing communications, and personalised advertising. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
  • Legal obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with legal obligations to which we are subject, including tax and accounting regulations, law enforcement requests, and data retention requirements.

4. How We Use Your Data

We use the personal data we collect for the following purposes:

  • Providing, operating, and maintaining the Service, including account management, authentication, and subscription processing.
  • Delivering personalised content recommendations based on your viewing history and preferences.
  • Processing payments, managing billing, and preventing fraudulent transactions.
  • Communicating with you regarding your account, subscriptions, service updates, security alerts, and customer support enquiries.
  • Improving and optimising the Service, including analysing usage patterns, conducting A/B testing, troubleshooting technical issues, and developing new features.
  • Ensuring the security of the Platform, detecting and preventing fraud, abuse, and unauthorised access, and protecting our intellectual property.
  • Complying with legal obligations, enforcing our Terms of Service, and responding to lawful requests from competent authorities.
  • Sending marketing and promotional communications where you have opted in or where permitted by applicable law, with an opt-out mechanism in every communication.

5. Data Sharing and Third Parties

We do not sell your personal data to third parties. We may share your data with the following categories of recipients, solely for the purposes described in this Privacy Policy:

  • Service Providers: Third-party companies that assist us in operating the Service, including cloud hosting providers, payment processors, email delivery services, analytics providers, customer support tools, and content delivery networks. These providers process data on our behalf under data processing agreements that comply with Article 28 of the GDPR.
  • Legal and Regulatory: Law enforcement agencies, regulatory authorities, courts, or other governmental bodies where disclosure is required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
  • Business Transfers: In connection with any merger, acquisition, reorganisation, sale of assets, or bankruptcy proceedings involving CZWTV, your data may be transferred to the acquiring entity or successor, subject to the same privacy protections described herein.
  • Copyright Enforcement Partners: Third-party services and legal representatives who assist us in monitoring for and enforcing against unauthorised use of our Content on the internet.

6. International Data Transfers

Your personal data is primarily stored and processed on servers located within the European Economic Area (EEA). Where it is necessary to transfer your data outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

  • Transfers to countries that have been recognised by the European Commission as providing an adequate level of data protection (adequacy decisions).
  • Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organisational measures where necessary.
  • Binding Corporate Rules or other approved transfer mechanisms where applicable.

You may request a copy of the safeguards we have put in place for international data transfers by contacting us at [email protected].

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting obligations. Specific retention periods are as follows:

  • Account data: Retained for the duration of your account and for up to 30 days after account deletion to allow for account recovery, after which it is permanently deleted or anonymised.
  • Payment and billing data: Retained for the period required by applicable tax and accounting laws (typically seven years under Austrian fiscal regulations).
  • Usage and viewing data: Retained for up to 24 months for personalisation and recommendation purposes. Aggregated and anonymised usage data may be retained indefinitely for analytical purposes.
  • Communication and support data: Retained for up to 36 months after the last interaction, or longer where required for legal proceedings or dispute resolution.
  • Log and security data: Retained for up to 12 months for security monitoring and incident investigation purposes.

8. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR. You may exercise any of these rights by contacting us at [email protected]. We will respond to your request within one month, which may be extended by a further two months where necessary, taking into account the complexity and number of requests.

  • Right of Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data along with information about the purposes of processing, categories of data, recipients, and retention periods.
  • Right to Rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.
  • Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed.
  • Right to Restriction of Processing (Art. 18 GDPR): You have the right to request the restriction of processing in certain circumstances, including where you contest the accuracy of the data or where the processing is unlawful but you oppose erasure.
  • Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance from us.
  • Right to Object (Art. 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interests or direct marketing purposes. Where you object to processing for direct marketing, the data shall no longer be processed for that purpose.
  • Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
  • Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria ([email protected]). You may also lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement.

9. Children's Privacy

The CZWTV Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16 without valid parental consent, we will take steps to delete that data as promptly as possible. If you believe that a child under 16 has provided personal data to us, please contact us immediately at [email protected].

10. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include, but are not limited to:

  • Encryption of data in transit using TLS/SSL protocols and encryption of sensitive data at rest.
  • Secure password hashing algorithms (bcrypt or equivalent) for storing account credentials.
  • Regular security assessments, penetration testing, and vulnerability scanning of our systems and infrastructure.
  • Access controls and role-based permissions to limit employee access to personal data to authorised personnel only.
  • Comprehensive incident response procedures for detecting, reporting, and addressing data breaches in compliance with Articles 33 and 34 of the GDPR.

While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or business operations. If we make material changes, we will notify you by posting the updated policy on the Platform and, where required by applicable law, by sending a notification to the email address associated with your account. The "Last updated" date at the bottom of this policy indicates when the most recent revisions were made. We encourage you to review this policy periodically.

12. Contact and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Data Controller:
LISA Film GmbH
Seecorso 4, 9220 Velden am Wörther See, Austria
Commercial Register: FN 141122h, Landesgericht Klagenfurt
Managing Director: Andrea Hroch

Data Protection Officer:
Email: [email protected]

General Enquiries:
Email: [email protected]

Supervisory Authority (Lead):
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
Email: [email protected]
Website: https://www.dsb.gv.at

Last updated: September 2026