Privacy

Cine Claus is a website operated by Digitopia Design Ltd (company number 12037302), registered at 124 City Road, London, EC1V 2NX, United Kingdom. We are the data controller for personal data collected through cineclaus.com.

ICO registration: ZC160761. For anything in this notice, including a request to see or delete your data, contact darren@digitopiadesign.com.

Four things, and only when they apply to you. Most visitors give us the third and nothing else.

If you join the mailing list. Your email address. We use it to send the printable advent checklist you asked for and a short weekly email in the run-up to Christmas. Lawful basis: your consent, which you give by confirming the link we send. We ask twice on purpose — an address typed by someone else never gets added.

If you sign in. Your email address, and a record of your sign-ins. There is no password: we email you a link. Lawful basis: performance of a contract, in that we cannot give you an account without knowing who the account belongs to. Accounts exist for people who edit the site; there is nothing behind the login for a reader.

Whenever anyone visits. Our host records the usual server information — IP address, browser, the page requested, the time. We also count requests per IP address for a few minutes at a time to stop the sign-in and sign-up forms being hammered. Lawful basis: legitimate interests, specifically keeping the site up and not letting it be abused. We think that is a fair trade because it is the minimum that makes a public form safe to offer, and none of it is used to build a profile of you.

If you accept analytics cookies. Pages viewed, roughly where in the world you are, and whether you signed up for the checklist — recorded against a random identifier, never your email. Lawful basis: your consent, and nothing is recorded until you give it. If you decline or ignore the banner, nothing is recorded at all. See the cookie policy for the mechanics.

We do not sell or rent your data, and we never will — there is no version of this site where that is the business model.

We do not put your email address into analytics. When the site records that someone joined the list, it records the place on the site they joined from and nothing else.

We do not track you across other websites, run advertising pixels, or use fingerprinting. There is no advertising network on this site.

We use other companies to run the site. Each only gets what it needs to do its job, and each is bound to protect it.

• Vercel — hosting. Sees every request, including your IP address.
• Supabase — the database and the sign-in system. Holds account email addresses and the film data.
• MailerLite — the mailing list. Holds your email address and whether you confirmed it. Only if you signed up.
• Upstash — the short-lived counters that rate-limit the forms. Holds a value derived from your IP address for a few minutes.
• CookieYes — the consent banner, and the record of what you chose.
• PostHog — analytics, on the European region. Only if you accepted analytics cookies.

Some of these providers process data outside the UK. Where that happens, the transfer is covered by the safeguards UK data protection law requires — either an adequacy decision, or the International Data Transfer Agreement together with a transfer risk assessment. We choose the European region where a provider offers one, which is why analytics runs on PostHog’s EU servers.

Some links to shops are affiliate links, which means we may earn a commission if you buy. We say so on every page that carries them, and it never changes a score — the scores are written before anything is linked.

We do not pass anything about you to those shops. But once you click, you are on their website, under their privacy policy and their cookies, not ours. That is worth knowing before you click, which is why it is here rather than in the small print.

Mailing list: until you unsubscribe. Every email has a one-click unsubscribe, and we keep a minimal record that you unsubscribed so we do not add you again by mistake.

Accounts: until you ask us to close it.

Server logs: as long as our host keeps them, which is a matter of weeks rather than years.

Rate-limit counters: minutes. They expire on their own.

Analytics: what we collect is pseudonymous — a random identifier, never your email — and our provider retains it for at least twelve months. We review it once a year and remove what we no longer need, and you can ask us to delete anything relating to you at any time.

Session recordings: 30 days, then deleted automatically. If you accept analytics, we may record a replay of how you moved through the site — which pages, what you clicked, where you gave up. We use it to find things that are broken or confusing.

Anything you type is masked before it leaves your browser. Email addresses and every other form field are blanked at source, so we never receive them and could not read them back if we tried. As with the rest of analytics, none of this happens unless you accept.

Under UK data protection law you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, and ask for it in a portable format. Where we rely on your consent, you can withdraw it at any time — that does not undo what we did before you withdrew it, but it stops us going forward.

Email darren@digitopiadesign.com and we will reply within one month. There is no charge.

If we get it wrong, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but you do not have to.

This is a site about films for families, but it is written for the adult choosing the film. It is not aimed at children, and we do not knowingly collect data from anyone under 13. If you think a child has given us their details, email us and we will delete it.

If we change what we collect or who processes it, we change this page in the same breath, and the date at the top moves. If the change is significant and we hold your email address, we will tell you.