Privacy notice (punxfilm.com website)

Under Articles 13 and 14 of Regulation (EU) 2016/679. Version of 24 October 2026.

Controller. Trilathera Soc. Coop., Via Madonna delle Grazie, 18, 03011 Alatri (FR), Italy, VAT 02978680607, brand PunxFilm. For any question about personal data: distribution@punxfilm.com. No data protection officer has been appointed.

Screener request. Data: first and last name, email, festival, company or outlet, role, country (if you give it), message (if you write one) and the film title. Purpose and basis: to assess the request and reply, with a link and a password, to professionals; basis: our legitimate interest in showing the film to festivals and professionals, in protecting an unreleased film from unauthorised circulation and in knowing who we give it to (Article 6(1)(f)). Provision of data: name, email, festival, company or outlet and role are needed to assess the request; without them we cannot reply. Retention: six months from the request if it is not accepted, twelve months from our reply if it is accepted. The film is hosted on Vimeo, which records the viewing under its own privacy notice. The “I have read the privacy notice” box is not consent.

“Submit Film” form. Data: first and last name, email, role, film title, director, running time, country, viewing link and password, project description. Purpose and basis: to assess the film you propose and reply to you; basis: pre-contractual steps requested by you (Article 6(1)(b)). The link and password are used to watch the film; they may also pass through the working tools described below. Provision of data: the mandatory fields are needed to assess the film; without them we cannot reply. Retention: if no agreement is reached, twenty-four months from the last contact; if an agreement is reached, the notice attached to the agreement applies. The box in the form counts as acknowledgement of this notice and as a declaration that you hold the rights to the film; it is not consent to processing. Submissions sent up to 17 October 2026 are also kept, as a backup, in a Google spreadsheet in the personal account of PunxFilm’s legal representative, not in a company account; since 17 October 2026 the spreadsheet no longer receives data from the website. We keep it until 31 December 2026 and then delete it.

“Contact” form. Data: name, email, message and, if you give it, phone. Purpose and basis: to reply to your message; basis: legitimate interest (Article 6(1)(f)). Provision of data: name, email and message are needed to reply to you; the phone number is optional. Retention: twelve months from the last exchange.

Restricted areas for the films (registered users). Who they are: the people who have an account on the site to enter a film’s restricted pages, that is, the people who work on that film with one of our clients (the production, the director) and our staff. Registration from the site is not open: the account is created by PunxFilm. Data: username, email address and password; first and last name, display name and language; your role and the film you have access to; the registration date; website and the profile fields “Film in distribuzione” and “Testo”, if filled in; the date of your last login (which you can choose to show on the Account page). While you are logged in the site records your session (IP address, browser, login time and expiry), which lasts two days, or fourteen if you choose to stay signed in. We do not keep a log of login IP addresses; to protect your account we limit login attempts and password reset requests. You choose your password and we do not know it. Source of the data: the account is created by PunxFilm with the data provided to us by the film’s production company and/or director, or with the data you give us yourself. The automatic email with which we send you your username and the link to choose your password contains a link to this page. Purpose and basis: to create and manage the account and give you access to the restricted pages and, where applicable, to screeners; basis: performance of a contract (Article 6(1)(b)) for people who are party to the contract with PunxFilm; our legitimate interest (Article 6(1)(f)) in giving access to people who work on the film with one of our clients and in protecting unreleased films from unauthorised distribution. Provision of data: without these data we cannot create the account. Retention: as long as the account exists; you can delete it yourself from the site’s “Account” page (where you can also download your data) or ask us to delete it, and we do so within thirty days of your request; we delete it in any case when it is no longer needed for the film. If an account turns out to have been created or used without our authorisation, we deactivate it and keep it only for as long as needed to establish what happened (Article 6(1)(f)). Cookies: to log in we use technical login cookies (wordpress_logged_in_, wordpress_sec_, wordpress_test_cookie and wp-settings-*). We do not publish users’ data, sell them or profile anyone. You can object at any time to processing based on legitimate interest, on grounds relating to your situation, by writing to distribution@punxfilm.com.

Working tools and artificial intelligence. To read requests and prepare replies we use IT tools, including the artificial intelligence model of Anthropic Ireland, Limited; basis: our legitimate interest in organising our work (Article 6(1)(f)). The data you send us through the “Submit Film” and Contact forms, including your name, email address, title and message text, and for “Submit Film” also the viewing link and password, may be processed by the model in the work of our management system, including automatically (for example to sort email and prepare a draft reply); the same applies to a screener request, which reaches us by email, including your name, email address, festival, company or outlet, role and message. For that data Anthropic acts, under its terms, as an independent controller.

Recipients. (a) Providers of website hosting, email, our archive’s server and backups, which process the data on our behalf as processors under Article 28; (b) Anthropic Ireland, Limited, in the cases described above, as an independent controller; (c) Vimeo, which hosts the film on view; (d) Google Ireland Limited (Ireland), which provides the account in which the spreadsheet described above is kept. We do not sell data.

Transfers outside the European Economic Area. Google, Vimeo and Meta have offices in the United States. Transfers rely on the adequacy decision of the European Commission of 10 July 2023 (Commission Implementing Decision (EU) 2023/1795, “EU-U.S. Data Privacy Framework”), which applies to the organisations included in the list of participants at www.dataprivacyframework.gov: Google LLC and Vimeo.com, Inc. are on that list; Meta Platforms, Inc., whose tools are activated only with your consent, is on it with its re-certification under review (list checked on 23 October 2026). As for Anthropic’s model: Anthropic may transfer the data to the United States or to other countries outside the European Economic Area. Anthropic does not participate in the Data Privacy Framework; according to its privacy policy, for countries without an adequacy decision it transfers data on the basis of standard contractual clauses with some of its group companies and with third parties and, in some cases, of the derogations provided by the Regulation. Trilathera and Anthropic have no data processing agreement, and according to its privacy policy Anthropic may also use the data to improve its models. Our servers are in Italy (Aruba Cloud, Arezzo; Aruba S.p.A. email) and our archive (backups and the files we deliver) is held by Backblaze, in its European Union region.

Browsing data. When you visit the site or open a link we send you, the servers that host them automatically record some technical data about the request: your IP address, browser and device data (user agent), the page or link requested, the referring page if your browser provides it, the date, the time and the outcome. We use them to run the service and keep it secure; basis: our legitimate interest (Article 6(1)(f)). We do not use them to find out who opens what and we do not link them to other data, unless this is needed to investigate abuse or an attack. Since 24 October 2026 we keep the records of the links we send you for no more than thirty days, with your IP address shortened; the site’s records are kept by our hosting provider (Aruba) for the period set by its service. If the link leads to a file, the file is served from our archive at Backblaze, in its European Union region, which receives your IP address. You can object to the processing of your browsing data by writing to distribution@punxfilm.com.

Visit statistics. We count how many times the pages of our films are viewed, by day, by page and by language, and which site or campaign people came from (only the name of the referring site and the generic parameters in our links). We do this on our own servers, without cookies and without storing anything on your device, without recording your IP address and without recognising who you are or whether you have visited before: these are totals only. This is not the “Statistics” cookie category, which requires your consent. Basis: our legitimate interest in knowing how much our pages are read (Article 6(1)(f)). Your IP address still appears in the technical logs described under “Browsing data”; we do not use it for this count. We keep the daily totals for 24 months, then only the monthly totals. You can object by writing to distribution@punxfilm.com.

Cookies. The site uses technical cookies, which are necessary for it to work, including the one that remembers your cookie choice. Only with your consent does the site also use Google Analytics (statistics) and Meta (advertising measurement). Videos are hosted on Vimeo. If you have accepted marketing cookies, the cover trailer starts automatically; otherwise Vimeo loads only when you start a video. In either case Vimeo and its security provider Cloudflare may set technical security cookies, under their own notices. We are revising the cookie notice and will publish a cookie policy listing the cookies. Continuing to browse does not count as consent. You can block or delete cookies at any time in your browser settings.

Your rights. You can ask for access, rectification, erasure and restriction of processing, and portability where applicable, by writing to distribution@punxfilm.com. You have the right to lodge a complaint with the Italian data protection authority (the Garante, www.garanteprivacy.it). We do not carry out profiling or automated decision-making on the data in the forms.

You can object at any time to processing of your data based on legitimate interest (screener request, Contact, working tools, browsing data, visit statistics), on grounds relating to your situation, by writing to distribution@punxfilm.com.