Privacy Policy

1. Data Controller

The Data Controller is [TO BE COMPLETED WITH LEGAL COUNSEL: company name], with registered office at [TO BE COMPLETED: address], VAT/Tax ID [TO BE COMPLETED].

Controller contacts: email [TO BE COMPLETED], certified email (PEC) [TO BE COMPLETED], phone [TO BE COMPLETED].

Data Protection Officer (DPO), where appointed: [TO BE COMPLETED WITH LEGAL COUNSEL: DPO name and contact].

2. Categories of data collected

We process the following categories of personal data:

• Registration and account data: name, email address, password (encrypted), language preferences.
• Usage and viewing data: content watched, viewing history, playback progress, favourites, searches, interactions with the Platform.
• Technical and device data: IP address, device identifiers, browser and operating system, connection data and system logs.
• Payment data (when enabled): handled by our payment provider; SANDR does not store full card details. [TO BE COMPLETED WITH LEGAL COUNSEL: payment processing details].
• Cookies and similar technologies: see our Cookie Policy.

3. Purposes of processing

Personal data is processed for the following purposes:

• Providing the service and managing the account (registration, authentication, content access).
• Managing subscriptions, pay-per-view purchases and payments.
• Personalising the experience and content recommendations (profiling), subject to consent.
• Sending marketing and promotional communications, subject to consent.
• Statistical analysis and improvement of the Platform (analytics).
• Compliance with legal, tax and accounting obligations.
• Platform security, fraud and abuse prevention.

4. Legal basis

Each purpose relies on a specific legal basis:

• Performance of a contract (Art. 6.1.b GDPR): service delivery, account management, subscriptions and payments.
• Consent (Art. 6.1.a GDPR): marketing, profiling, sharing with selected partners. Consent can be withdrawn at any time.
• Legitimate interest (Art. 6.1.f GDPR): aggregated analytics, security, fraud prevention, service improvement.
• Legal obligation (Art. 6.1.c GDPR): tax, accounting and statutory compliance.

5. Processing methods and security

Data is processed using electronic tools and appropriate technical and organisational measures to ensure security, confidentiality and integrity, including encryption in transit, role-based access control and database Row Level Security.

Access to data is restricted to authorised personnel and processors bound by confidentiality obligations.

6. Data retention

Data is retained for as long as necessary for the purposes for which it was collected and within statutory limits:

• Account data: for the duration of the relationship and thereafter for [TO BE COMPLETED WITH LEGAL COUNSEL: period, e.g. 12 months] after deletion.
• Billing and tax data: [TO BE COMPLETED: e.g. 10 years] as required by law.
• Usage and analytics data: [TO BE COMPLETED: period].
• Consent-based data: until consent is withdrawn or [TO BE COMPLETED: period].

7. Disclosure and transfer of data

Data may be processed by providers acting as processors (sub-processors), including:

• Supabase — database hosting and authentication (EU/Ireland data centres).
• Cloudflare — video streaming and CDN.
• Payment provider (e.g. Stripe) — future payment processing.
• Email service provider — transactional and, subject to consent, marketing communications.
• [TO BE COMPLETED WITH LEGAL COUNSEL: any other providers].

Some providers may process data outside the European Economic Area. In such cases the transfer is supported by appropriate safeguards under Art. 44 et seq. GDPR, in particular the Standard Contractual Clauses (SCC) approved by the European Commission. [TO BE COMPLETED WITH LEGAL COUNSEL: safeguard details].

8. Your rights

As a data subject you have the right, within the limits of the law, to:

• Access your personal data (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data / right to be forgotten (Art. 17).
• Restrict processing (Art. 18).
• Data portability (Art. 20).
• Object to processing (Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.
• Lodge a complaint with the supervisory authority (Garante per la protezione dei dati personali).

9. How to exercise your rights

You can exercise your rights by writing to [TO BE COMPLETED WITH LEGAL COUNSEL: email/contact method for privacy requests]. We will respond within the timeframes set by the GDPR (generally within one month).

10. Cookies

The Platform uses necessary technical cookies and, subject to consent, analytics, profiling and marketing cookies. For more information see the Cookie Policy.

11. Minors and minimum age

The Platform may include content reserved for an adult audience (e.g. sports betting widgets). The minimum age for registration is 18. We do not knowingly collect data from persons under 18; should we become aware of such processing, we will delete the data.

12. Changes to this policy

We may update this policy for regulatory or service reasons. Changes will be published on this page with the update date; we will give appropriate notice of any material changes.

13. Contacts and DPO

For any request regarding the processing of personal data you can contact the Controller at the details above or the Data Protection Officer (DPO): [TO BE COMPLETED WITH LEGAL COUNSEL: DPO contact].