Comprehensive Data Privacy Policy & Notice

1.0 Preamble, Scope & Objectives

The EURA-FILM International Consortium (hereinafter referred to as "EURA-FILM", "we", "us", or "our") operates an innovative research, pilot validation, and industrial dissemination platform dedicated to establishing an open, human-guided digital cornerstone for European film, high-end television, and digital commercial production.

We are deeply committed to safeguarding the fundamental rights and freedoms of natural persons, particularly their right to the protection of personal data as enshrined in Article 8 of the Charter of Fundamental Rights of the European Union and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation or GDPR).

This Privacy Notice governs all processing of personal data collected through the EURA-FILM web domains, subdomains, interactive application mockups, B2B contact interfaces, newsletter/call notification registries, and research whitepaper distribution nodes.

2.0 European Union Horizon Europe Research Context

The technical architecture, pilot studies, and organizational workflows described on this platform form part of the preparatory and execution phases of the pan-European Horizon Europe Framework Programme for Research and Innovation (call HORIZON-CL2-2026-01-HERITAGE-03, 36-month Innovation Action M01–M36).

Where research data, academic surveys, or industry stakeholder inputs are collected, processing activities strictly adhere to the ethical standards established by the European Commission, the European Code of Conduct for Research Integrity, and Regulation (EU, Euratom) 2018/1046 regarding the financial rules applicable to the general budget of the Union.

3.0 Statutory Legal Definitions (Article 4 GDPR)

For the purposes of this Privacy Notice, the statutory terms defined in Article 4 of the GDPR shall apply:

• "Personal Data": Any information relating to an identified or identifiable natural person ("Data Subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their identity.
• "Processing": Any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
• "Controller": The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• "Processor": A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
• "Consent": Any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
• "Personal Data Breach": A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

4.0 Joint Controllers & Consortium Governance (Article 26 GDPR)

The EURA-FILM Consortium functions under an institutional Joint Controllership Arrangement in accordance with Article 26 of the GDPR. The 6 participating legal entities jointly determine the objectives, technical specifications, and dissemination policies of the initiative:

Under Article 26(3) of the GDPR, irrespective of the terms of the joint controllership arrangement, you may exercise your rights under the GDPR in respect of and against each of the controllers individually.

5.0 Designated Point of Contact & Inquiries

To facilitate the efficient and centralized exercise of your data protection rights, the Joint Controllers have designated the central Project Management Office at Umbrella as the primary point of contact:

6.0 Detailed Categories of Personal Data Processed

We process only those categories of personal data that are strictly necessary to deliver our website services, evaluate industrial partnerships, and distribute scientific and policy publications:

6.1 Website Access & Network Telemetry Data

When you access our platform, your web browser automatically transmits technical connection parameters that are recorded in volatile server security logs:

• Internet Protocol (IP) address of the requesting device (collected in encrypted, pseudonymized server logs);
• Date, exact time (UTC/CET), and duration of the server request;
• Uniform Resource Identifier (URI) and query parameters requested;
• HTTP status code and byte size of the server transmission;
• Referrer URL (the previous web page from which our site was accessed);
• Browser type, software build version, operating system, and user-agent string;
• Cryptographic TLS/STARTTLS handshake parameters.

6.2 Business-to-Business (B2B) & Institutional Inquiries

When an authorized representative or individual submits a formal cooperation inquiry via our B2B Contact Interface:

• Full personal name (first name, last name, honorific title);
• Name of the represented organization, film studio, university, broadcaster, or advertising agency;
• Corporate/institutional email address;
• Category of partnership track (e.g., Industry Pilot Co-production, Academic / University Cohort, Audit Ledger & AI Compliance Licensing, Press / Policy Inquiry);
• Free-form textual description of the proposed collaboration or project parameters;
• Electronic timestamp of the submission and honeypot anti-spam verification token.

6.3 Creators' Micro-Grant (M20–M22 Call) Notification Registry

When an independent filmmaker, artist, or technician registers to receive priority open-call alerts:

• Electronic mail address (email);
• Artistic / technical profile classification (e.g., Director / Screenwriter, Editor / NLE Specialist, Sound Designer, Virtual Production Specialist, Independent Producer);
• Date and time of opt-in registration;
• Cryptographic confirmation token of voluntary registration.

6.4 Whitepaper & Research Study Distribution Logs

When visitors download official consortium whitepapers (e.g., EU AI Act analysis, Cultural Diversity Study, AI Adoption Research):

• Name of the downloaded PDF document;
• HTTP download completion status;
• Session identifier ensuring rate-limiting compliance to avoid automated scraping.

7.0 Purposes and Legal Bases for Processing (Processing Activity Matrix)

In compliance with Article 6 of the GDPR, every processing operation conducted by EURA-FILM is founded upon a verified lawful basis. We never process personal data without a legitimate, documented statutory ground:

8.0 Automated Decision-Making & Artificial Intelligence Disclaimer

In strict adherence to Article 22 of the GDPR, the EURA-FILM Consortium explicitly states that:

All evaluations of B2B partnership requests and future micro-grant proposals are conducted exclusively by qualified human experts, peer-review committees, and appointed consortium representatives.

9.0 Cookies, Telemetry & Local Storage Policy

In conformity with the ePrivacy Directive (Directive 2002/58/EC), as amended by Directive 2009/136/EC, and Article 5(3) thereof, our website implements an ultra-compact, privacy-first cookie policy:

9.1 Strictly Essential Technical Cookies & Storage

These items are indispensable for the core operation, cybersecurity, and navigation state of our website. Under EU law, strictly necessary technical storage items do not require prior consent:

• `eurafilm_cookie_consent`: Stored in your browser's local storage (`localStorage`) to remember your cookie choice (whether you accepted all or restricted to essentials). Expiry: 12 months.
• Security & Anti-CSRF Tokens: Volatile session cookies employed exclusively during active form dispatch to prevent cross-site request forgery attacks. Expiry: End of browsing session.

9.2 Analytical and Third-Party Advertising Cookies

EURA-FILM employs ZERO commercial advertising cookies, zero behavioral tracking pixels, and zero cross-site remarketing beacons. We do not integrate Google Analytics, Meta Pixel, TikTok tracking, or commercial data broker scripts into our public platform.

10.0 Processors, Sub-Processors & Data Recipients

Personal data is treated with strict confidentiality. We do not sell, rent, trade, or commercially monetize personal data under any circumstances. Access is granted solely to authorized processors bound by rigorous Data Processing Agreements (DPAs) under Article 28 of the GDPR:

• Umbrella Infrastructure Cluster: Provides encrypted web hosting, DNS resolution, and secure mail dispatch nodes located in certified Tier-3 European data centers in Budapest, Hungary.
• Enterprise SMTP Relay Service: Secure mail server (`smtp.bphq.umbrella.tv`) utilizing STARTTLS transport encryption to deliver form inquiries directly to the project inbox (`project@eurafilm.eu`).
• European Commission Auditing Bodies: Where required under Horizon Europe Grant Agreements, statutory European audit authorities (such as the European Court of Auditors or OLAF) may access project communication archives solely for official grant verification purposes.

11.0 International Data Transfers (Non-EEA Jurisdictions)

As a general rule, all personal data is hosted, stored, and processed within the territory of the European Economic Area (EEA).

Where collaboration with our UK-based consortium partner (POD LDN Ltd.) involves data sharing, such transfers are carried out in full compliance with Chapter V of the GDPR (Articles 44–49) on the basis of the European Commission's formal Adequacy Decision for the United Kingdom adopted under Article 45(3) of the GDPR on June 28, 2021.

In the event that technical support requires transmission to any other third country lacking an adequacy decision, such transfers shall be governed strictly by the European Commission's approved Standard Contractual Clauses (SCCs) supplemented by appropriate technical encryption safeguards.

12.0 Data Retention Schedule & Disposal Protocols (Article 5(1)(e))

Under the principle of Storage Limitation (Article 5(1)(e) GDPR), personal data is retained only for the duration necessary to fulfill the specific purposes for which it was gathered:

13.0 Technical and Organizational Security Measures (TOMs) (Article 32)

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, the EURA-FILM Consortium enforces enterprise-grade Technical and Organizational Measures (TOMs) pursuant to Article 32 of the GDPR:

• Transport Layer Security (TLS 1.3): All HTTP traffic between client browsers and our server infrastructure is encrypted using robust 256-bit TLS encryption keys.
• Encrypted Mail Dispatch (STARTTLS): Form transmissions via our PHP SMTP backend utilize mandatory STARTTLS handshakes, ensuring messages in transit are shielded against eavesdropping and man-in-the-middle attacks.
• Decoupled Backend Architecture: The web presentation layer operates decoupled from internal databases. Web forms do not write directly to open SQL instances, eliminating SQL injection attack vectors.
• Honeypot Bot Defense: Intelligent hidden trap fields identify and discard automated spambots without requiring intrusive commercial third-party CAPTCHA trackers.
• Role-Based Access Control (RBAC): Administrative access to the project mailbox (`project@eurafilm.eu`) is restricted exclusively to authorized key personnel possessing two-factor authentication (2FA).
• Regular Vulnerability Scanning: Continuous static and dynamic code assessments ensure all script assets remain hardened against the OWASP Top 10 vulnerabilities.

14.0 Comprehensive Rights of the Data Subject (Articles 15–21 GDPR)

As a valued Data Subject residing within the European Union or accessing our European services, you possess extensive, enforceable statutory rights under Chapter III of the GDPR:

14.1 Procedure for Exercising Your Statutory Rights

To exercise any of the statutory rights enumerated above, simply send an email request to our central Data Protection Desk at:

15.0 Lead Supervisory Authority & Right to Lodge a Complaint (Article 77)

Without prejudice to any other administrative or judicial remedy, you have the statutory right under Article 77 of the GDPR to lodge a formal complaint with a competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Since the Coordinating Beneficiary of the EURA-FILM Consortium (Umbrella Kft.) maintains its registered seat in Hungary, the Lead Supervisory Authority for this initiative is:

Alternatively, if you reside in another European Union Member State, you may contact your national data protection authority (e.g., BfDI in Germany, CNIL in France, AEPD in Spain, ANSPDCP in Romania, Tietosuojavaltuutetun toimisto in Finland, or ICO in the United Kingdom).

16.0 Policy Versioning, Amendments & Notification Procedures

We may update, refine, or expand this Privacy Policy from time to time to maintain strict congruence with developing European jurisprudence, regulatory guidelines issued by the European Data Protection Board (EDPB), or changes in the operational scope of the Horizon Europe Innovation Action work plan.

Whenever material revisions are instituted, the updated text will be published directly on this URL with an incremented revision identifier and updated effective date. We encourage regular review of this page.