Logo
Login Login

LockitNetwork Tools Privacy Policy

Last updated: October 2026

1. Scope

This privacy policy informs you, in accordance with Art. 13 GDPR, about the processing of personal data when you use the web application LockitNetwork Tools (tools.lockitnetwork.com) and its interface (api.lockitnetwork.com), which the iPad app LockitScript also uses to synchronize data. For our website lockitnetwork.com, the privacy policy in the site notice applies.

2. Controller

Lockit Network GmbH
Schleißheimer Str. 181
80797 München - Germany
Phone: + 49 89 / 716 742 30
Email: hello@lockitnetwork.com

We are not legally required to appoint a data protection officer. For questions about data protection and to exercise your rights, please contact us at datenschutz@lockitnetwork.com.

3. Content of your productions (processing on behalf)

In LockitNetwork Tools and LockitScript, productions record content such as scripts, call sheets, names of cast and crew members, working hours, stills from set and the location of recordings. We process this data on behalf of our customers under a data processing agreement (Art. 28 GDPR). The respective production or customer is the controller for this data; please direct any requests regarding it to them. The following sections cover the data we process as controller about the users of our applications.

4. User account

You need a user account to use our applications. An account is created either when you register or when a project manager of your production invites you. We process:

  • Username, email address, first and last name, language
  • Password (stored only as a cryptographic hash)
  • Assignment to customer, projects, role in the project and access rights, last opened project, time of last login
  • Invitations, access requests, password resets and email address changes

The legal basis is Art. 6 (1) (b) GDPR (providing the contractually agreed services). If your production invites you, we process your email address to send the invitation on the basis of Art. 6 (1) (f) GDPR; our legitimate interest and that of our customer lies in collaborating on the project. We store account data until the account is deleted. You can delete your account in the LockitScript app or request deletion by email to datenschutz@lockitnetwork.com. Pending registration, password reset and email change requests are deleted after 24 hours.

5. Login, sessions and abuse protection

After you log in, we set a technically necessary cookie (“__Host-ln-session”) that identifies your session. The session is valid for 30 days, is extended while you use it and ends after 90 days at the latest. LockitScript app sessions end after 365 days at the latest. Ended sessions are deleted after 7 days.

To protect your account against unauthorized login attempts, we store the IP address, browser identifier (user agent), a device identifier, the username used and the outcome of each login attempt. This data and the list of trusted devices are deleted after 90 days. For the LockitScript app, we also use Apple App Attest to verify that requests come from an unmodified app; the keys stored for this are deleted after 365 days without use. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the security of our services and your data.

Storage in your browser

The web application stores a random device identifier (for abuse protection, see above), your language, recently opened projects, and display and export settings in your browser's local storage (localStorage). This storage is strictly necessary for the functions you use and is based on section 25 (2) no. 2 TDDDG. We do not use analytics, tracking or advertising cookies and do not embed third-party content.

6. Log and usage data

For every request to our servers, we log the IP address, date and time, requested address, status code, browser identifier, and device identifier and version of app and operating system. These logs serve operations, troubleshooting and defense against attacks and are deleted after 30 days.

To support you with questions and errors and to keep changes traceable, we also record which user account was active in which project with which application and when (at most one entry per minute), as well as the contents of LockitScript synchronizations. This activity data is deleted after 28 days, and synchronization data in the application after 90 days. For reports, exports, imports and interface requests, we store the time, user account and project; the associated details (e.g. browser identifier, parameters) are removed after 90 days. We also store which app and operating system versions are used in your projects so we can notify you about outdated versions.

To resolve support requests, our support staff can temporarily (for at most 8 hours) sign in as your user account. Every such access is logged.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in secure and stable operation, error analysis and supporting our customers.

7. Emails and internal notifications

We send you emails required for using our services (e.g. invitations, registration confirmations, password resets, access approvals, completed imports). They are sent via Microsoft 365; a copy of each email remains in our mailbox. In case of errors (e.g. a failed synchronization or report generation), our support team receives an internal notification via Microsoft Teams that contains the username and project. When you upload import files, we create a task in our self-hosted ticket system with the username, file name and project. The legal basis is Art. 6 (1) (b) or (f) GDPR.

8. Connecting other services

At your request, you can connect your account or project to third-party services. Only then do we exchange the data required for the function with that service (e.g. access keys, user ID, clip metadata, scripts, shooting days). Likewise, partner applications that you grant access via our consent page receive data from your account to the extent you approved. The legal basis is Art. 6 (1) (b) GDPR. You can disconnect at any time. Processing by the respective provider is governed by its own privacy policy.

9. Hosting, storage and recipients

We use the following processors, each bound by a data processing agreement under Art. 28 GDPR:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and databases in data centers in Falkenstein and Nuremberg, backups
  • intercolo GmbH, Carl-Goerdeler-Str. 114, 60320 Frankfurt am Main, Germany: storage of project files (e.g. stills, call sheets, scripts, import files), backups and log data in a data center in Frankfurt am Main
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: delivery, protection against attacks and rate limiting per IP address; all requests are routed via Cloudflare
  • Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: sending emails and internal notifications (Microsoft 365, Teams)

In addition, we back up databases and project files daily to a backup server operated by Lockit Network GmbH itself. Backups at our service providers are overwritten after 30 days at the latest.

Cloudflare and Microsoft may also process data in the USA. Both companies are certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). All other data is stored in Germany.

10. Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)

To exercise your rights, an informal message to datenschutz@lockitnetwork.com or to the address above is sufficient.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

11. Obligation to provide data and automated decision-making

Your account details are required to use LockitNetwork Tools and LockitScript; without them we cannot provide an account. No automated decision-making, including profiling (Art. 22 GDPR), takes place. The temporary lock after several failed login attempts serves solely to protect your account.