Who we are
Cine Claus is a website operated by Digitopia Design Ltd (company number 12037302), registered at 124 City Road, London, EC1V 2NX, United Kingdom. We are the data controller for personal data collected through cineclaus.com.
ICO registration: ZC160761. For anything in this notice, including a request to see or delete your data, contact darren@digitopiadesign.com.
What we collect, and why
Six things, and only when they apply to you. Most visitors give us the third and nothing else.
If you join the mailing list. Your email address. We use it to send the printable advent checklist you asked for and a short weekly email in the run-up to Christmas. Lawful basis: your consent, which you give by confirming the link we send. We ask twice on purpose - an address typed by someone else never gets added.
If you sign in. Your email address, and a record of your sign-ins. There is no password: we email you a link. Lawful basis: performance of a contract, in that we cannot give you an account without knowing who the account belongs to. Accounts exist for people who edit the site; there is nothing behind the login for a reader.
Whenever anyone visits. Our host records the usual server information - IP address, browser, the page requested, the time. We also count requests per IP address for a few minutes at a time to stop the sign-in and sign-up forms being hammered. Lawful basis: legitimate interests, specifically keeping the site up and not letting it be abused. We think that is a fair trade because it is the minimum that makes a public form safe to offer, and none of it is used to build a profile of you.
If you vote in a readers’ poll. Your answer is added to that answer’s total, and nothing records that it was yours. To stop a device voting twice we set a random code in a cookie (cc_poll, see the cookie policy) and keep a scrambled form of it beside the poll: not your IP address, not your answer, not anything that says who you are. Lawful basis: legitimate interests, in counting each vote once. We may quote the totals in articles, as what readers said.
If you accept analytics cookies. Pages viewed, roughly where in the world you are, and whether you signed up for the checklist - recorded against a random identifier, never your email. Lawful basis: your consent, and nothing is recorded until you give it. If you decline or ignore the banner, nothing is recorded at all. See the cookie policy for the mechanics.
If you make a list or an advent calendar. Its name, description, notes and films, which anyone with its share link can see: please leave personal details off it (we refuse phone numbers, email and web addresses). We keep no name or email for it unless you are signed in and keep it with your account. If someone reports a list, we keep the reason they chose and when, and nothing about them. Lawful basis: performance of a contract, in that we cannot show the list you made without storing it.
What we deliberately do not do
We do not sell or rent your data, and we never will - there is no version of this site where that is the business model.
We do not put your email address into analytics. When the site records that someone joined the list, it records the place on the site they joined from and nothing else.
We do not track you across other websites, run advertising pixels, or use fingerprinting. There is no advertising network on this site.
Who else processes it
We use other companies to run the site. Each only gets what it needs to do its job, and each is bound to protect it.
- Vercel - hosting. Sees every request, including your IP address. Also counts page visits without cookies (the page address, the referring site and the rough device type), with no identifier kept from one day to the next.
- Supabase - the database and the sign-in system. Holds account email addresses and the film data.
- MailerLite - the mailing list. Holds your email address and whether you confirmed it. Only if you signed up.
- Upstash - the short-lived counters that rate-limit the forms. Holds a value derived from your IP address for a few minutes.
- CookieYes - the consent banner, and the record of what you chose.
- PostHog - analytics, on the European region. Only if you accepted analytics cookies.
Some of these providers process data outside the UK. Where that happens, the transfer is covered by the safeguards UK data protection law requires - either an adequacy decision, or the International Data Transfer Agreement together with a transfer risk assessment. We choose the European region where a provider offers one, which is why analytics runs on PostHog’s EU servers.
Links to shops
Some links to shops are affiliate links, which means we may earn a commission if you buy. We say so on every page that carries them, and it never changes a score - the scores are written before anything is linked.
We do not pass anything about you to those shops. But once you click, you are on their website, under their privacy policy and their cookies, not ours. That is worth knowing before you click, which is why it is here rather than in the small print.
Videos from YouTube
Some pages can play a video from YouTube, run by Google. Nothing from YouTube loads until you press play, so simply visiting a page tells Google nothing.
If you do press play, your browser connects to YouTube, which then receives your IP address and may store data on your device. Google decides what it does with that, under its own privacy policy: it is not processing data for us, and we receive nothing back from it. The Watch on YouTube link takes you to YouTube itself, where the same applies. If you would rather Google had none of it, leave the video unplayed.
Maps from OpenStreetMap
Some film pages show an interactive map of the film’s locations. To draw it, your browser fetches map pictures from tile.openstreetmap.org, run by the OpenStreetMap Foundation, as soon as the page loads. That request shares your IP address and your browser’s user agent with them, and tells them which part of the map you are looking at and that you came from cineclaus.com (our address only, never the page). They set no cookies. The Foundation decides what it does with that, under its own privacy policy: it is not processing data for us, and we receive nothing back from it.
How long we keep it
Mailing list: until you unsubscribe. Every email has a one-click unsubscribe, and we keep a minimal record that you unsubscribed so we do not add you again by mistake.
Accounts: until you ask us to close it.
Your lists and calendars: until you delete them with their edit link, or we remove one that breaks our rules.
Server logs: as long as our host keeps them, which is a matter of weeks rather than years.
Rate-limit counters: minutes. They expire on their own.
Poll votes: the totals for as long as the poll is on the site. The scrambled device code is kept with the poll so it can refuse a second vote; the cookie on your device lasts a year.
Analytics: what we collect is pseudonymous - a random identifier, never your email - and our provider retains it for at least twelve months. We review it once a year and remove what we no longer need, and you can ask us to delete anything relating to you at any time.
Session recordings: 30 days, then deleted automatically. If you accept analytics, we may record a replay of how you moved through the site - which pages, what you clicked, where you gave up. We use it to find things that are broken or confusing.
Anything you type is masked before it leaves your browser. Email addresses and every other form field are blanked at source, so we never receive them and could not read them back if we tried. As with the rest of analytics, none of this happens unless you accept.
Your rights
Under UK data protection law you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, and ask for it in a portable format. Where we rely on your consent, you can withdraw it at any time - that does not undo what we did before you withdrew it, but it stops us going forward.
Email darren@digitopiadesign.com and we will reply within one month. There is no charge.
If we get it wrong, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but you do not have to.
Children
This is a site about films for families, but it is written for the adult choosing the film. It is not aimed at children, and we do not knowingly collect data from anyone under 13. If you think a child has given us their details, email us and we will delete it.
Changes
If we change what we collect or who processes it, we change this page in the same breath, and the date at the top moves. If the change is significant and we hold your email address, we will tell you.