Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. What Data We Collect

Account data

When you register or sign in via Google OAuth, we receive your Google account email address and display name. We store these in our database to manage your account and assign platform roles (filmmaker, festival, etc.).

Newsletter subscriptions

If you subscribe to our newsletter, we store your email address, name (if provided), subscription date, and group preferences. Each newsletter email contains an unsubscribe link.

Film submissions

Filmmakers who submit films provide information such as names of directors, producers, and other collaborators, along with film metadata (title, synopsis, stills, poster). This data is stored in our database and may be displayed publicly on the platform.

Usage data

We use Google Analytics 4 (GA4) to collect anonymised usage statistics, including pages visited, time on site, and device type. This data is processed by Google in accordance with their privacy policy. IP addresses are anonymised.

3. How We Use Your Data

• To manage user accounts and authenticate access.
• To send newsletters and festival-related communications (subscribers only).
• To display film content on the public catalogue.
• To improve the platform based on anonymised analytics.
• To comply with legal obligations.

4. Legal Basis (GDPR)

We process your personal data on the following legal bases:

• Contract — to provide platform services to registered users.
• Consent — for newsletter subscriptions and analytics cookies.
• Legitimate interests — for platform security and fraud prevention.

5. Third-Party Services

We use the following third-party processors:

• Supabase — database, authentication, and file storage (EU region).
• Google — Google OAuth (sign-in), Google Analytics 4 (anonymised usage statistics), Google Maps (office location embed).
• Resend — transactional and newsletter email delivery.
• hCaptcha — bot protection on registration and login forms.

Each of these services has its own privacy policy. We only share data with them to the extent necessary to operate the platform.

6. Data Retention

Account data is retained for as long as your account is active. Newsletter subscriber data is retained until you unsubscribe. Film submission data may be retained indefinitely as part of the public catalogue. You may request deletion at any time (see Section 7).

7. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict processing.
• Withdraw consent at any time (without affecting prior processing).
• Lodge a complaint with the Czech data protection authority (ÚOOÚ, uoou.cz).

To exercise any of these rights, contact us at info@cinefila.cz. We will respond within 30 days.

8. Cookies

We use a session cookie to keep you logged in and a consent cookie to remember your cookie preferences. Google Analytics sets additional cookies for usage tracking, which are only placed after you accept cookies via our cookie banner.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated effective date.

10. Contact

For any privacy-related questions or data requests: info@cinefila.cz