Privacy Policy
Draft to be validated by legal counsel before final publication.
Version: draft of 1 October 2026. Effective date: [À COMPLÉTER / TO BE COMPLETED: final publication date].
1. WHO IS RESPONSIBLE FOR YOUR DATA?
The controller is [À COMPLÉTER / TO BE COMPLETED: corporate name of the publisher], established in Tunisia, [À COMPLÉTER / TO BE COMPLETED: address of the registered office]. Contact for any data-related question: [À COMPLÉTER / TO BE COMPLETED: dedicated data protection e-mail address]. [À COMPLÉTER / TO BE COMPLETED: data protection officer, if appointed.]
Festime serves users worldwide, including residents of the European Union. Processing is subject to Tunisian Organic Law No. 2004-63 of 27 July 2004 and, for persons located in the European Union, Regulation (EU) 2016/679 (GDPR). Representative in the European Union within the meaning of Article 27 GDPR: [À COMPLÉTER / TO BE COMPLETED: name and address of the EU representative]. Declaration to or authorization from the National Authority for the Protection of Personal Data (INPDP): [À COMPLÉTER / TO BE COMPLETED: references].
Festivals that receive submissions are controllers of the processing they carry out on their own behalf (selection, jury, communication of results, organization of the event). For the hosting and tools made available to them, Festime acts as a processor or joint controller, as the case may be. [À COMPLÉTER / TO BE COMPLETED: characterization of the roles and data processing agreement with Festivals.]
2. WHAT DATA DO WE PROCESS?
Account: name, e-mail address, password (stored in hashed form), role, language, country, accessibility and notification preferences, two-factor authentication settings.
Profile and content: biography, photo, links, portfolio, film and project pages (title, synopsis, crew, technical data), uploaded files (posters, videos, subtitles, DCPs, documents), messages, comments, reactions, groups.
Submissions and jury: submissions, accepted rules, status, scores, Jurors’ comments and deliberations, conflict-of-interest declarations, access logs for protected videos.
Payments and billing: orders, amounts, currency, status, transaction identifiers provided by Stripe or PayPal, billing profile, invoices, credit notes, refund requests, disputes, Festival payout statements. Festime never receives your full payment card number.
Technical and security data: login logs, active sessions (device and browser), login attempts, technical errors, performance metrics, hashed fingerprints of the IP address and device used to combat referral fraud.
Communications: consent to commercial e-mails and its history, delivery and opening of campaign e-mails, unsubscriptions, bounced e-mails.
Verification: supporting documents submitted by Festivals applying for the “verified” badge.
3. WHY AND ON WHAT LEGAL BASIS?
Providing the Platform, managing Accounts, films, submissions, juries, messaging and the community: performance of the contract (Terms of Use).
Collecting payments, invoicing, refunding, paying out to Festivals and keeping accounts: performance of the contract and legal accounting and tax obligations.
Securing the Platform, preventing fraud and abuse (rate limiting of attempts, two-factor authentication, anti-fraud signals in the referral programme, file quarantine, audit logs): legitimate interest of Festime and its Users in a secure service.
Moderating content, handling reports, copyright claims and counter-notices: legitimate interest and, where applicable, legal obligations.
Sending service e-mails (confirmation, security, deadlines, results, renewal): performance of the contract; you may adjust non-essential notifications in your preferences.
Sending commercial communications and measuring their opening: consent, which may be withdrawn at any time via the unsubscribe link or in your preferences.
Producing aggregated statistics for Festivals (visits to their page) and improving the service: legitimate interest, on the basis of pseudonymized data.
Artificial-intelligence assistance, where a Festival enables it for a competition: the Festival’s legitimate interest in organizing the review of submissions, governed by its policy and the absence of any decision based solely on automated processing. [À COMPLÉTER / TO BE COMPLETED: validation of the legal basis and prior information of the Creators concerned.]
Responding to requests from authorities and defending our rights in legal proceedings: legal obligation and legitimate interest.
4. WHO CAN ACCESS YOUR DATA?
Other Users, for the information you make public (public profile, published film page, comments). The Festivals to which you submit and the Jurors they appoint, for the purposes of the review (with blind viewing, the Creator’s identity may be hidden from Jurors). Authorized Festime staff, according to controlled and logged roles and permissions.
Our processors and service providers, solely for the purposes of the service:
— Hostinger (hosting of the Platform, databases, files and backups; sending mailbox when Hostinger e-mail is used);
— Stripe and PayPal (processing of payments, refunds and disputes; they also act as controllers for their own obligations);
— the SMTP provider used to send e-mails: [À COMPLÉTER / TO BE COMPLETED: name of the SMTP provider if different from Hostinger];
— if AI assistance is enabled: the configured AI model provider (OpenAI or Anthropic), which receives the submission information necessary for the requested suggestion; [À COMPLÉTER / TO BE COMPLETED: selected provider, contractual terms and non-reuse of data for training];
— if a video streaming provider is enabled: [À COMPLÉTER / TO BE COMPLETED: for example Bunny.net (Bunny Stream) for the storage, encoding and streaming of videos];
— external video players (YouTube, Vimeo, Google Drive) only when you choose to display a video hosted by them.
Administrative or judicial authorities, upon a lawfully grounded request.
5. TRANSFERS OUTSIDE TUNISIA AND OUTSIDE THE EUROPEAN UNION
Festime is established in Tunisia, a country that is not the subject of an adequacy decision by the European Commission. The data of Users located in the European Union are therefore transferred to Tunisia; they may also be processed by providers located in the European Union, the United States or other countries (Hostinger, Stripe, PayPal, AI or video providers). These transfers are governed by the European Commission’s standard contractual clauses or another mechanism provided for by the GDPR and, for transfers from Tunisia, by the authorizations required by Law No. 2004-63. [À COMPLÉTER / TO BE COMPLETED: transfer mechanisms adopted, location of Hostinger servers and INPDP authorization.] A copy of the safeguards may be requested at the contact address.
6. HOW LONG DO WE KEEP YOUR DATA?
Account, profile, films, content, messages and notifications: for the lifetime of the Account. If you request deletion, you have 14 days to cancel it; it is then reviewed and carried out: the Account is anonymized, access is revoked, personal content is deleted and the associated files are placed in a verified physical-deletion queue.
Records retained after deletion, in pseudonymized form (linked to an anonymized account): orders and payments, invoices and credit notes, tax snapshots, refund requests, submissions, distribution agreements and revenue statements, acceptances of the Terms of Use, audit logs. Period: [À COMPLÉTER / TO BE COMPLETED: applicable statutory period, for example 10 years for accounting records].
Technical logs: errors and performance metrics 30 days; login events 90 days; login attempts 2 days; festival page visit fingerprints 90 days.
AI-generated suggestions: period set by the Festival for each competition, between 7 and 730 days (180 days by default).
Consent to commercial e-mails: until withdrawn; the consent history is kept as evidence for [À COMPLÉTER / TO BE COMPLETED: retention period for proof of consent].
Reports, copyright claims and counter-notices: [À COMPLÉTER / TO BE COMPLETED: retention period after the case is closed].
Backups: backups, stored in a private area, rotate automatically (7 active copies and at most 30 archived copies); data deleted from the live database disappears from the backups at the end of this rotation.
7. YOUR RIGHTS
You have the right of access, rectification, erasure, restriction, objection (in particular to direct marketing), data portability and the right to withdraw your consent at any time. From the “Privacy & Data” area, you can download an export of your data in JSON format and request the deletion of your Account. For other requests, write to [À COMPLÉTER / TO BE COMPLETED: dedicated data protection e-mail address]. A response is provided within one month, which may be extended under the conditions provided by law. Proof of identity may be requested in case of reasonable doubt.
You may lodge a complaint with the INPDP (Tunisia) or, if you reside in the European Union, with the supervisory authority of your country (for example the CNIL in France).
Certain data cannot be erased where their retention is required by law or necessary for the establishment, exercise or defence of legal claims; they are then kept in pseudonymized and restricted form.
8. AUTOMATED DECISIONS
Festime does not take any decision producing legal effects based solely on automated processing. AI suggestions and festival matches (“Smart Match”) are decision-support tools.
9. SECURITY
Festime applies appropriate security measures: encrypted connections, hashed passwords, two-factor authentication, protection against cross-site request forgery, content security policy, role-based permissions, audit logs, private file storage, temporary access tokens for videos, backups. In the event of a personal data breach presenting a risk, the authorities and the data subjects are notified under the conditions provided by law.
10. MINORS
The Platform is not intended for persons under the age of digital consent applicable in their country (for example 15 in France) without the authorization of their legal representative. [À COMPLÉTER / TO BE COMPLETED: minimum age adopted.]
11. COOKIES
The use of cookies and local storage is described in the Cookie Policy.
12. CHANGES
This policy may be updated. The version in force is published on the Platform and significant changes are brought to the attention of logged-in Users.