Privacy Policy
Last updated: September 21, 2026
This document is available in English only. Translations are not yet published; the English text is the version that applies.
Introduction
Welcome to FilmHQ. This Privacy Policy ("Policy") describes how FilmHQ OÜ ("FilmHQ", "we", "us", or "our") collects, uses, discloses, and protects personal data through our platform at filmhq.pro, the portals we operate for our Clients on their own domains (together, the "Site"), related mobile applications, and all other services we provide (collectively, the "Service").
FilmHQ is a film distribution management platform serving both business clients (film distributors, cinemas, and marketing professionals) and individual consumers (moviegoers) across the Baltic markets.
This Policy is an information notice under Articles 13 and 14 of the GDPR. It does not require your acceptance.
1. Data Controller
FilmHQ OÜ
Tööstuse 47B 10416 Tallinn Estonia
Registration Number: 17108523 VAT Code: EE102796694
Contact:
- General inquiries: info@filmhq.pro
- Privacy matters: privacy@filmhq.pro
2. Definitions
For the purposes of this Policy:
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Client" means a business entity (e.g., film distributor, cinema operator, marketing agency) that has entered into an agreement with FilmHQ to use our Service.
- "User" means any individual who accesses and uses the Service, including employees of Clients and individual consumers.
- "Consumer" (or "B2C User") means an individual who uses our consumer-facing portals to discover films, view showtimes, or access other entertainment information.
- "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
- "Processing" means any operation performed on Personal Data, such as collection, storage, use, or disclosure.
- "Sub-processor" means any third party engaged by FilmHQ to process Personal Data on behalf of a Client.
- "GDPR" means the General Data Protection Regulation (EU) 2016/679.
- "Estonian PDPA" means the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
3. Roles and Responsibilities
3.1 FilmHQ as Data Controller
FilmHQ acts as a Data Controller when we:
- Process Personal Data of Users who create accounts on our platform
- Process Personal Data of visitors to our websites
- Process Personal Data of individuals who contact us or register for our events
- Process Personal Data for our own business purposes (marketing, analytics, platform improvement)
3.2 FilmHQ as Data Processor
FilmHQ acts as a Data Processor when Clients use our Service to manage their own customer and business data. In such cases:
- The Client is the Data Controller and determines the purposes and means of processing
- FilmHQ processes data solely according to the Client's documented instructions
- Processing is governed by a Data Processing Agreement (DPA) between FilmHQ and the Client
- FilmHQ does not determine the purpose or means of processing Client Data
3.3 Consumers of Client Portals
- If you are a consumer seeking to exercise your rights regarding Personal Data processed by a FilmHQ Client (e.g., a film distributor or cinema), please contact that Client directly
- FilmHQ processes such data solely on behalf of Clients and according to their instructions
4. Personal Data We Collect
4.1 Information You Provide Directly
Account Registration (B2B and B2C Users):
- Full name
- Email address
- Phone number (optional)
- Company name and role (for B2B users)
- Country and language preferences
- Profile photo (optional)
Business Client Information:
- Company registration details
- Billing and payment information
- Tax identification numbers
- Bank account details for settlements
Consumer Preferences (B2C Users):
- Movie preferences and wishlists
- Favorite genres
- Cinema preferences
- Notification preferences
Communications:
- Information you provide when contacting our support team
- Survey responses and feedback
- Event registration information
4.2 Information Collected Automatically
Technical Data:
- IP address
- Browser type and version
- Operating system
- Device identifiers
- Time zone and language settings
- Referring URL
Usage Data:
- Pages and features accessed
- Actions performed within the Service
- Access times and frequency
- Search queries
- Clicks and navigation patterns
Cookie Data: Please see our Cookie Policy for detailed information about the cookies we use.
Ad Attribution Data (Consumer Portals): When you visit our consumer-facing portals (e.g., movie discovery sites) from advertising platforms, we collect advertising click identifiers to enable conversion tracking:
- Meta (Facebook/Instagram) click IDs (
fbclid) - TikTok click IDs (
ttclid) - Google Ads click IDs (
gclid,wbraid,gbraid)
This data is stored in a first-party cookie (_fhq_attr) for up to 90 days, together with the city and language you chose on the portal, and is used to attribute ticket-page visits to the campaign that brought you here.
4.3 Information from Third Parties
Authentication Providers: When you sign in with a third-party account (Google, Facebook or Apple), we receive the basic profile information (name, email address, profile picture) that provider releases to us as authorized by you.
Business Partners: If a Client or partner refers you to our Service, they may provide us with your contact information.
Public Sources: We may collect publicly available business information (e.g., from company registries, industry databases) for B2B purposes.
5. How We Use Personal Data
5.1 Service Provision
We process Personal Data to:
- Create and maintain your account
- Provide access to platform features
- Process transactions and settlements
- Enable collaboration features between users
- Provide customer support
- Send service-related notifications
Legal Basis: Performance of a contract (GDPR Art. 6(1)(b))
5.2 Platform Improvement
We process Personal Data to:
- Understand how users interact with our Service
- Identify and fix technical issues
- Develop new features and improvements
- Conduct analytics and generate aggregated insights
Legal Basis: Legitimate interests (GDPR Art. 6(1)(f)) — improving our Service and user experience
5.3 Security and Fraud Prevention
We process Personal Data to:
- Protect against unauthorized access and fraud
- Monitor for suspicious activities
- Investigate and prevent security incidents
- Enforce our Terms of Service
Bot Verification: We use Cloudflare Turnstile on login and registration pages to tell humans from bots. Turnstile evaluates technical characteristics of your browser and how you interact with the page; Cloudflare processes this on our behalf (see Section 6).
Legal Basis: Legitimate interests (GDPR Art. 6(1)(f)) — security and protection of rights
5.4 Communications
We process Personal Data to:
- Send essential service notifications (e.g., password resets, policy updates)
- Respond to your inquiries and support requests
- Send marketing communications, including news about features, events and the industry
Legal Basis:
- Service notifications: Performance of contract (GDPR Art. 6(1)(b))
- Marketing to consumers: Consent (GDPR Art. 6(1)(a))
- Marketing to existing customers about similar services and to business contacts: Legitimate interests (GDPR Art. 6(1)(f)), always with a one-click opt-out
5.5 Legal Compliance
We process Personal Data to:
- Comply with applicable laws and regulations
- Respond to legal requests from authorities
- Establish, exercise, or defend legal claims
Legal Basis: Legal obligation (GDPR Art. 6(1)(c)) or legitimate interests (GDPR Art. 6(1)(f))
6. Third-Party Integrations and Sub-processors
6.1 Platform Infrastructure
| Provider | Purpose | Location |
|---|---|---|
| Supabase (via AWS) | Database hosting, authentication | EU (Frankfurt) |
| Vercel | Frontend hosting and CDN | EU/US |
| Cloudflare | DNS, security, CDN, bot verification (Turnstile) | Global |
6.2 Content and Media Integrations
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Frame.io (Adobe) | Creative asset management and approvals | Frame.io Privacy |
| YouTube API Services | Video content management, analytics | Google Privacy |
6.3 Social Media and Marketing Integrations
When Clients use our social media publishing features, data may be shared with:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Meta (Facebook/Instagram) | Content distribution, advertising | Meta Privacy |
| Google Ads | Advertising campaigns | Google Privacy |
| TikTok | Content distribution | TikTok Privacy |
Note: FilmHQ's use of YouTube API Services is subject to the Google API Services User Data Policy, including the Limited Use requirements.
6.4 Server-Side Conversion Tracking
To measure advertising effectiveness, we operate server-side conversion tracking on consumer portals. When you perform key actions (such as viewing film details or clicking to purchase tickets), event data is sent from our servers to the advertising platform.
| Platform | API Used | Data Sent |
|---|---|---|
| Meta | Conversions API (CAPI) | Event type, page URL, film identifier, click ID (fbclid), timestamp |
| TikTok | Events API | Event type, page URL, film identifier, click ID (ttclid), IP address, browser user agent, timestamp |
| Google Analytics 4 | Measurement Protocol | Event type, film identifier, a client identifier, timestamp |
Events are sent only after you have given marketing consent on the portal, and only to the platforms the portal operator has connected.
Retention: Delivered events are kept for up to 90 days.
Legal Basis: Your consent (GDPR Art. 6(1)(a)), given through the portal's consent banner. You can withdraw it at any time through the same banner.
6.5 Payment Processing
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Stripe | Payment processing, invoicing | Stripe Privacy |
6.6 Cinema Data Partners
We receive showtime and box-office data from cinema operators and ticketing systems to display showtimes and produce distribution analytics.
6.7 AI Processing
Some features send text (for example a news article, a message received by a Client, or a film description) to third-party AI providers to classify, extract, summarise, translate or draft. The providers act as our processors; where the text belongs to a Client, they are sub-processors under that Client's DPA.
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Anthropic | Text analysis and drafting | Anthropic Privacy |
| Google (Gemini) | Text analysis, translation, embeddings | Google Privacy |
| TypeSafe AI | Relevance classification of public film industry news | TypeSafe Privacy |
7. Data Sharing and Disclosure
7.1 We Do Not Sell Personal Data
FilmHQ does not sell Personal Data to third parties.
7.2 Sharing Within Multi-Tenant Environment
FilmHQ operates a multi-tenant platform. Each Client's data is kept separate from other Clients' data.
7.3 Disclosure to Service Providers
We share Personal Data with service providers who assist us in operating our Service, under agreements that meet Article 28 of the GDPR.
7.4 Legal and Safety Disclosures
We may disclose Personal Data when required:
- To comply with applicable law or legal process
- To respond to requests from law enforcement or government authorities
- To protect the rights, property, or safety of FilmHQ, our users, or others
- In connection with investigations of fraud or other illegal activity
7.5 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, Personal Data may be transferred to the acquiring entity. We will inform you as required by law.
8. International Data Transfers
FilmHQ is headquartered in Estonia within the European Economic Area (EEA). However, some of our service providers operate outside the EEA.
When we transfer Personal Data outside the EEA, we ensure adequate protection through:
- Adequacy Decisions: Transfers to countries recognized by the European Commission as providing adequate protection
- Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
- EU-US Data Privacy Framework: For US-based service providers certified under the DPF
You may obtain a copy of the safeguards applied to international transfers by contacting privacy@filmhq.pro.
9. Data Retention
9.1 General Principles
We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.
9.2 Specific Retention Periods
| Data Category | Retention Period |
|---|---|
| Active user accounts | Duration of account + 90 days after closure |
| Closed paid accounts | Data deleted within 180 days of closure |
| Free trial accounts | Data deleted within 60 days of closure |
| Transaction records | 7 years (Estonian accounting requirements) |
| Support communications | 3 years after resolution |
| Marketing contact data | Until consent withdrawal + 30 days |
| Server logs | 90 days |
| Backup archives | 90 days (rolling) |
9.3 Client Data Retention
For data processed on behalf of Clients (where FilmHQ is a processor), retention periods are determined by the Client's instructions and applicable DPA.
10. Data Security
We apply technical and organisational measures appropriate to the risk (GDPR Art. 32), including encryption in transit and at rest, separation of each Client's data, least-privilege access control and multi-factor authentication.
If you believe your data has been compromised, contact us at privacy@filmhq.pro.
11. Your Rights
Under the GDPR and Estonian PDPA, you have the following rights regarding your Personal Data:
11.1 Right of Access
You have the right to obtain confirmation whether we process your Personal Data and to request a copy of that data.
11.2 Right to Rectification
You have the right to request correction of inaccurate Personal Data or completion of incomplete data.
11.3 Right to Erasure ("Right to be Forgotten")
You have the right to request deletion of your Personal Data in certain circumstances, including when:
- The data is no longer necessary for its original purpose
- You withdraw consent (where processing was based on consent)
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
11.4 Right to Restriction of Processing
You have the right to request that we restrict processing of your Personal Data in certain circumstances, such as when you contest its accuracy.
11.5 Right to Data Portability
You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller.
11.6 Right to Object
You have the right to object at any time to processing based on our legitimate interests, and to direct marketing. An objection to direct marketing is always honoured.
11.7 Right to Withdraw Consent
Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
11.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority if you believe your rights have been violated.
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) Tatari 39 10134 Tallinn Estonia Phone: +372 627 4135 Email: info@aki.ee Website: https://www.aki.ee
11.9 Exercising Your Rights
To exercise any of these rights, please contact us at:
- Email: privacy@filmhq.pro
We respond within one month. Where a request is complex or we receive many, we may extend this by two further months and will tell you within the first month.
We may need to verify your identity before processing your request to ensure we protect your Personal Data from unauthorized access.
12. Children's Privacy
FilmHQ Services are not directed to children below the age of digital consent in their country (13 in Estonia and Latvia, 14 in Lithuania). We do not knowingly collect Personal Data from children below that age.
If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us at privacy@filmhq.pro. If we learn that we hold Personal Data of a child below that age without the required parental consent, we delete it.
13. Automated Decision-Making
FilmHQ does not engage in automated decision-making that produces legal effects or similarly significant effects on individuals.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.
When we make material changes, we update the "Current as of" date at the top of this Policy and tell you through the Service or by email.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
For general privacy inquiries: Email: privacy@filmhq.pro
For all other inquiries: FilmHQ OÜ Tööstuse 47B 10416 Tallinn Estonia Email: info@filmhq.pro
16. Additional Information for Specific Jurisdictions
16.1 Latvia
For Latvian residents, you may contact the Data State Inspectorate (Datu valsts inspekcija) at dvi.gov.lv.
16.2 Lithuania
For Lithuanian residents, you may contact the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) at vdai.lrt.lt.
This Privacy Policy was last updated on September 21, 2026.