Privacy policy

1. Who we are

The controller of your personal data is:

PANOPTICON FILMS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Krakowska 249
32-080 Zabierzów, Poland
KRS: 0000423376
NIP: 6762456204

In this Privacy Policy, we refer to the company as Panopticon Films.

For privacy-related questions or requests, contact us at hello@panopticon-films.com.

2. What personal data we collect

Depending on how you use the website, we may process:

• your name;
• email address;
• company name;
• project type;
• information included in your message, enquiry or brief;
• technical information such as IP address, browser type, device information, operating system, referring page and request timestamps;
• information about how you use the website, where analytics consent has been given;
• your cookie and consent preferences.

We do not intentionally collect special categories of personal data through this website.

3. Contact forms and project enquiries

When you contact us through the website, by email or through the contact form, we process the information you provide in order to:

• respond to your enquiry;
• understand the scope of a potential project;
• prepare a quotation, timeline or production proposal;
• arrange further communication;
• take steps towards entering into a contract.

The legal basis for this processing is Article 6(1)(b) GDPR where the communication concerns steps requested before entering into a contract.

For general business correspondence that does not directly lead to a contract, we may process the data on the basis of our legitimate interest in responding to enquiries and maintaining business relationships under Article 6(1)(f) GDPR.

Providing information through the contact form is voluntary, but without the necessary contact details we may not be able to respond to your enquiry.

Submissions made through the website may temporarily remain available in the Webflow administration panel. We review form submissions periodically and delete those that are no longer required. Enquiries that have not developed into an active project or business relationship are removed no later than 12 months after the last contact.

4. Website operation and security

When you visit the website, technical information may be processed automatically by our hosting, content-delivery and infrastructure providers. This information may include:

• IP address;
• browser and device information;
• requested page or file;
• date and time of the request;
• referring URL;
• technical error and performance information.

We process this information where necessary to operate the website, maintain its security, diagnose technical problems and protect it against misuse.

The legal basis is our legitimate interest in maintaining a secure and reliable website under Article 6(1)(f) GDPR.

5. Webflow and website infrastructure

Our website is built and hosted using Webflow. Webflow may process technical visitor data and information submitted through website forms on our behalf in order to provide hosting, website infrastructure and related services.

Webflow uses infrastructure and subprocessors including Amazon Web Services, which may provide hosting and content-delivery services, including delivery through CDN infrastructure.

Some website scripts and software libraries may also be delivered through jsDelivr. When such resources are requested, jsDelivr may receive technical request information such as the visitor's IP address, browser information, referring domain, requested resource and request time.

The legal basis for this processing is Article 6(1)(f) GDPR – our legitimate interest in operating, securing and efficiently delivering the website.

Webflow and some of its subprocessors may process data outside the European Economic Area. Where required, appropriate international data-transfer mechanisms are used (see section 10).

6. Cloudflare Turnstile

We use Cloudflare Turnstile to protect website forms against spam, automated submissions and abuse. When a form protected by Turnstile is used, Cloudflare may process technical information needed to determine whether the request comes from a legitimate user. This can include:

• IP address;
• browser and user-agent information;
• operating system and device signals;
• information about the interaction with the security challenge;
• technical challenge and validation data.

Turnstile does not receive the content you enter into the contact form for the purpose of performing the security check.

The legal basis for using Turnstile is Article 6(1)(f) GDPR – our legitimate interest in protecting the website and its forms against spam, automated abuse and malicious activity.

7. Video and media delivery through bunny.net

We use bunny.net infrastructure to deliver video and other media efficiently. When media is loaded, bunny.net may process technical information necessary to deliver the requested content, such as network information, request data, browser information and performance metrics. This may include information relating to playback quality, buffering, errors or network performance.

The legal basis for this processing is Article 6(1)(f) GDPR – our legitimate interest in providing efficient, secure and reliable video and media delivery.

8. Google Analytics and cookies

We use Google Analytics 4 (GA4) to understand how visitors use the website and to improve its content and performance. Analytics may process information such as:

• pages visited;
• interactions with the website;
• approximate geographic location;
• browser and device type;
• operating system;
• referring website;
• session and event information.

Google Analytics is used in accordance with your cookie and analytics preferences. The legal basis for analytics processing is your consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time through the cookie settings available on the website. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Essential technologies

Some technologies are necessary for the website to operate correctly, maintain security or remember your privacy choices. These may operate without analytics or marketing consent where they are technically necessary.

Analytics technologies

Analytics technologies help us understand how visitors use the website. They are enabled only where the required consent has been provided.

We use Google Consent Mode v2 to communicate privacy choices to Google services. If analytics storage is declined, Analytics cookies used for visitor identification are not stored.

Cookies used on this website

• _ga – Google Analytics – distinguishes visitors for analytics purposes – up to 2 years;
• _ga_JKVZQBF8YF – Google Analytics – maintains session state – up to 2 years;
• Cookie consent preference – Panopticon Films / consent manager – remembers your privacy choices – according to the consent configuration.

Browser restrictions may shorten the actual lifetime of analytics cookies. If additional cookies or tracking technologies are introduced, this section will be updated accordingly.

Managing cookies in your browser

In addition to the cookie settings on our website, you can control cookies directly in your browser. Most browsers let you block all or selected cookies, delete cookies already stored and receive a notice before a cookie is saved. These options are usually available in the browser's privacy or security settings:

• Chrome: Settings → Privacy and security → Third-party cookies / Delete browsing data;
• Safari: Settings → Privacy → Prevent cross-site tracking / Manage website data;
• Firefox: Settings → Privacy & Security → Enhanced Tracking Protection / Cookies and Site Data;
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.

You can also prevent your data from being used by Google Analytics by installing the Google Analytics Opt-out Browser Add-on provided by Google.

Blocking essential cookies or similar storage may affect how parts of the website work, for example by preventing your privacy preferences from being remembered.

9. Who receives your data

We use third-party providers where necessary to operate the website and communicate with you. These currently include:

• Webflow – website hosting, form infrastructure and website administration;
• Amazon Web Services (CDN infrastructure used by Webflow) – hosting and content delivery;
• bunny.net – video and media delivery;
• Cloudflare Turnstile – spam and bot protection for forms;
• jsDelivr – delivery of selected website scripts and software libraries;
• Google Analytics – website analytics, where consent has been given;
• our email and IT service providers;
• technical contractors who maintain the website;
• legal, accounting and professional advisers where necessary.

These providers receive or process personal data only to the extent necessary to provide their services or where they have another lawful basis to do so.

We may also disclose personal data where required by law, a court, public authority or another legally authorised body. We do not sell personal data.

10. International data transfers

Some of our technology providers or their subprocessors operate outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA, we rely on safeguards recognised under applicable data-protection law, which may include:

• an adequacy decision issued by the European Commission;
• participation in the EU-US Data Privacy Framework;
• Standard Contractual Clauses approved by the European Commission;
• other legally recognised transfer mechanisms.

11. How long we keep personal data

We retain personal data only for as long as it is needed for the purpose for which it was collected. As a general rule:

• enquiries that do not lead to a project are retained for no longer than 12 months after the last contact;
• Webflow form submissions are reviewed at least every three months and deleted when they are no longer required;
• if an enquiry develops into a business relationship, relevant correspondence and project information may be retained for the duration of the relationship and afterwards for periods required by accounting, tax or limitation rules;
• technical logs are retained only for the period required for website operation, security and diagnostics;
• records of privacy and cookie choices may be retained for as long as necessary to demonstrate compliance with legal obligations;
• Google Analytics user-level and event-level data is retained for no more than 14 months, according to the retention settings configured in GA4.

We may retain particular information for longer where this is necessary to establish, exercise or defend legal claims or to comply with a legal obligation.

12. Your rights

Under the GDPR, depending on the circumstances, you may have the right to:

• access your personal data;
• obtain a copy of your data;
• correct inaccurate or incomplete data;
• request deletion of your data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact hello@panopticon-films.com. We may need to verify your identity before responding to a request.

13. Right to lodge a complaint

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority. In Poland this is:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych)
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland

14. Automated decision-making

We do not use personal data submitted through this website to make automated decisions that produce legal effects or similarly significant effects concerning you.

15. Changes to this policy

We may update this Privacy Policy if our website, services, technology providers or legal obligations change. The current version will always be published on this page together with the date of the latest update.

‍