Applies to: https://globallensga.com and related online services of the festival.

1. Who does this policy apply to
Website visitors, applicants (authors, producers, etc.), viewers of online screenings, newsletter subscribers, event participants and partners.

2. What data do we collect
• Account and application data: name, contact details, country/city, role, materials about the film (logline, poster, screener link/password), payment status.
• Technical data: IP address, cookie/pixel identifiers, device/browser type, error logs.
• Communications: support letters, form responses, chat entries within the platform.
• Payments: via a provider (e.g. Stripe/PayPal); we receive the transaction status but do not store full card details.
• Events: show/panel registration, voting/survey results.
• Media and security: log events related to access to protected shows (DRM/tokens).
Sources: you provide data directly; automatically via cookies and similar technologies; from integration services (payment gateways, mailing services).

3. Why we process data (purposes)
• registration and maintenance of a personal account; acceptance and evaluation of applications; holding shows/panels/awards;
• informing about selection stages and service messages;
• billing and accounting; compliance with legal obligations (taxes, reporting);
• platform security, protection from abuse, prevention of piracy and leaks;
• service improvement (analytics, statistics), if there are legitimate interests and/or consent.

4. Cookies and similar technologies
We use cookies necessary for the operation of the website and, with your consent, analytical/marketing cookies. The banner gives the option to accept/reject optional categories and change your choice later in "Cookie settings". The Swiss regulator's (FDPIC) guidelines on cookies and similar technologies clarify the requirements for transparency and user control. (edoeb.admin.ch)

5. Legal bases and principles under Swiss law
We follow the revised Swiss Federal Data Protection Act (FADP, revFADP) and the corresponding regulation (OFADP/FDPO). The key principles are lawfulness, fairness, proportionality, purpose limitation, security and transparency. (Global Investigations Review, Fedlex)
Note: If you are located in the EEA/UK, we additionally take into account the requirements of the GDPR/UK GDPR (e.g. legal bases for processing and summary notices for EU/UK residents).

6. Transfer of data to third parties
We only share data with processors (under a processing agreement):
hosting/backup, mail and mailing services, payment providers, display platform/DRM, analytics, support services. They undertake to ensure security measures and process the data according to our instructions.

7. International data transfer
• Data transfer to countries with an adequate level of protection is permitted. Since September 15, 2024, the United States has been included in the Swiss list of "adequate" countries for companies certified according to the Swiss-U.S. Data Privacy Framework (DPF). (Nouvelles de l'Administration fédérale, edoeb.admin.ch, dataprivacyframework.gov)
• For other countries, we apply suitable guarantees (e.g. standard contractual clauses with Swiss addendums) and risk assessment.

8. How long do we store data
We store only as long as necessary for the purposes of:
• registration and application data - up to 12 months after the end of the season, unless there is a legal basis for storing it longer;
• contractual/financial documents - for accounting/tax purposes;
• security logs - up to 12 months, unless longer is required for investigations;
• marketing signatures - until consent is revoked.

9. How do we protect data
Technical and organizational measures under OFADP: encryption in transit/storage where applicable; access control; logging; separate storage of keys; two-factor authentication for admins; regular updates and backups; minimization and pseudonymization where possible. (Fedlex)

10. Your rights
In accordance with revFADP, you can:
• obtain information about and access to your data;
• request the correction of inaccurate data;
• request deletion where there is no retention obligation;
• receive/transfer data (right to data portability, under statutory conditions);
• object to the disclosure of individual data and revoke consent (if the processing was based on consent). (dlapiperdataprotection.com, bvger.ch)

11. Notification of security incidents
If a data breach could result in a high risk to the identity and fundamental rights of the affected persons, we will notify the Swiss data protection regulator (FDPIC) as soon as possible, as well as the users themselves - if this is necessary for their protection or at the request of the regulator. (dlapiperdataprotection.com, edoeb.admin.ch)

12. Automated decisions and profiling
We do not make legally significant decisions based solely on automated processing. Analytics and recommendations on the site do not entail legal consequences for users.

13. Marketing communications
We send newsletters only with your consent or within the framework of the client-organizer relationship (updates on your application/ticket). You can unsubscribe with one click by clicking the Unsubscribe link.

14. Children
The site is not intended for persons under 18 years of age. If you believe that a child has provided us with data without the consent of a legal representative, please let us know - we will delete the information.

15. Complaints and contacts of the regulator
If you believe that we are processing data in violation of the law, write to us first - we will try to help. You can also contact the Swiss Data Protection Commissioner (FDPIC): edoeb.admin.ch

16. Policy Changes
We may update this page. Significant changes will be highlighted on the site and/or emailed. May 1, 2025 at the top reflects the current version.