Privacy Policy

This Privacy Policy explains how personal data is processed when you visit the website of the documentary Growing Up (the “Website”). We process as little data as possible: the Website has no analytics, no advertising and no social media plugins.

1. Controller

The controller of your personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) is:

Adam Roszkowski, trading as Okay Films
[Business or correspondence address], Poland
NIP: 9512062345, REGON: 146650354
Entered in the Central Register and Information on Economic Activity (CEIDG)

(“we”, “us”). For any privacy matter, write to [email protected]. We have not appointed a Data Protection Officer.

2. What we process, why, and on what legal basis

2.1 Visiting the Website

When you open the Website, your browser automatically sends technical information to the server of our hosting provider, which records it in log files: your IP address, the date and time of the request, the page or file requested, the amount of data transferred, the referring address and your browser and operating system (user agent).

• Purpose: to deliver the Website and keep it stable and secure, including detecting and preventing abuse.
• Legal basis: Article 6(1)(f) GDPR, our legitimate interest in operating a secure, working website.
• Retention: log files are kept only as long as our hosting provider needs them for operation and security, and are then deleted automatically, unless they are needed longer to investigate a specific security incident.

Requests to the Website pass through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”), which protects it against attacks and delivers it faster. Cloudflare processes the same technical data, including your IP address, on our behalf and on the same legal basis. Data may be transferred to the USA on the basis of the EU-U.S. Data Privacy Framework, to the extent Cloudflare is certified under it, and otherwise on Standard Contractual Clauses (Article 46(2)(c) GDPR).

2.2 Contacting us

If you contact us by email or phone, for example about festival programming, screeners or press materials, we process the data you share with us: usually your name, email address or phone number, organisation and the content of your message.

• Purpose: to handle your enquiry and any further correspondence.
• Legal basis: Article 6(1)(f) GDPR, our legitimate interest in answering enquiries. Where your enquiry concerns entering into an agreement (for example a screening or licence), Article 6(1)(b) GDPR.
• Retention: for as long as needed to handle the matter, and afterwards until the limitation period for possible claims expires, where we have a legitimate reason to keep it.

2.3 Watching the trailer (Vimeo)

The trailer is hosted by Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA (“Vimeo”). The Vimeo player is not loaded when you open the page. It loads only after you press play and agree, either in the notice shown on the player or in Cookie settings. Only then does your browser connect to Vimeo, which receives your IP address, device and browser information, the address of our page and information about how you use the player. Vimeo may store cookies or similar technologies on your device.

We embed the player with Vimeo’s “do not track” setting (dnt=1), which according to Vimeo’s documentation prevents the player from tracking session data, including cookies.

• Purpose: to show you the trailer.
• Legal basis: your consent, Article 6(1)(a) GDPR, and for storing or reading information on your device, the consent required by the Polish Electronic Communications Law, which implements Article 5(3) of Directive 2002/58/EC (ePrivacy Directive).
• Withdrawal: you can withdraw consent at any time in Cookie settings. Withdrawal does not affect the lawfulness of processing carried out before it.
• Role of Vimeo: Vimeo processes this data as an independent controller. See Vimeo’s Privacy Policy.
• Transfer to the USA: based on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to the extent Vimeo is certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR).

2.4 Remembering your privacy choices

We save your consent choice and the date you made it in your browser’s local storage (key gu-consent) for 12 months, so you are not asked on every visit. No cookie is set for this and the information does not leave your device. This storage is strictly necessary to respect your choice and does not require consent. To the extent it involves personal data, the legal basis is Article 6(1)(f) GDPR.

2.5 Fonts

All fonts are served from our own server. Your browser does not connect to Google or any other font provider.

2.6 Links to other websites

The Website links to external profiles and websites, such as LinkedIn, Instagram and okayfilms.eu. These are plain links: no data is sent to those services unless you click them. After that, the privacy policy of the respective provider applies.

3. Recipients

Your data may be disclosed to:

• our hosting provider, SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Poland, which processes data on our behalf under a data processing agreement (Article 28 GDPR);
• Cloudflare, Inc., which delivers and protects the Website as our processor (Article 28 GDPR);
• providers of our email and IT services, acting as processors on our behalf;
• Vimeo, as an independent controller, only if you consent to loading the trailer;
• public authorities, where we are legally required to disclose it.

4. Transfers outside the European Economic Area

Apart from Cloudflare (section 2.1) and Vimeo (section 2.3), we do not transfer your data outside the European Economic Area. If one of our processors does, it must rely on a safeguard required by Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses.

5. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict processing (Article 18);
• data portability, where processing is based on consent or a contract (Article 20);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21);
• withdraw your consent at any time, without affecting earlier processing (Article 7(3)).

To exercise your rights, write to [email protected]. We will reply within one month, as required by Article 12(3) GDPR.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You may also contact the authority in the EU country where you live or work.

6. Is providing data required?

Providing data is voluntary. Without the technical data recorded in server logs, the Website cannot be displayed. Without your contact details, we cannot reply to your message.

7. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

8. Changes to this policy

We may update this policy when the Website or the law changes. The current version is always available on this page, with the date of the last update shown at the top. See also our Cookie Policy.