Privacy Policy — Cyprus Film Crew

Data controller: KONIMO Productions LTD ("KONIMO", "we", "us", "our") Registered in: Republic of Cyprus — Company Registration No. HE 487989 Registered address: Stavrou Stylianide 100, Ergates, 2643, Nicosia, Cyprus Privacy contact: by post at our registered address above, or through the Platform Platform: cyprusfilmcrew.com

Effective date: 11 February 2026

0. Do we need a privacy policy? — Assessment

Yes — one is legally required. KONIMO is a company established in Cyprus (an EU member state) and we process personal data of individuals (crew members, vendors, producers, and people listed in our directory). The EU General Data Protection Regulation (GDPR), the Cyprus data-protection law implementing it (Law 125(I)/2018), and the ePrivacy rules therefore apply, with the Office of the Commissioner for Personal Data Protection of Cyprus as our supervisory authority. We act as a data controller. A transparent privacy notice (GDPR Arts. 13–14) is mandatory, and two features of our processing make it especially important:

1. We publish rich personal data — names, photographs, CVs, contact details, credits.
2. We create directory listings from public sources for people who have not signed up ("unclaimed" listings), which triggers the Art. 14 obligations (notice to people whose data we did not collect from them) and a clear right to object/erase.

This policy discharges those obligations.

1. What this policy covers

This policy explains what personal data we collect, why, on what legal basis, who we share it with, how long we keep it, and the rights you have. It applies to the cyprusfilmcrew.com Platform.

2. The personal data we process

All items below are grounded in our actual data model.

2.1 Account and sign-in data

• Email address, and for email/password accounts a password (stored only as a secure bcrypt hash — we never store or see your plain password).
• Name and optional profile image.
• If you sign in with Google (OAuth): we store the provider account link and the authentication tokens the provider issues so you stay signed in. We do not receive your Google password.
• Role (Producer / Crew / Vendor / Admin) and when you selected it.
• Account timestamps, email-verification status, and session/sign-in tokens (see §7 Cookies).

2.2 Crew profile data (if you are a crew member)

Skills, department/profile tags, experience, portfolio URL, rate, availability, location (city/ region), bio, phone number, spoken languages, whether you own a car and driving-licence class(es), availability locations, software/tools, gear/equipment owned, a profile picture and work gallery, an uploaded CV (PDF), and credits (production title, your role, production company, director, writer/agency, category).

2.3 Vendor / producer profile data

For vendors: business name, description, website, phone, business location, delivery options, and equipment listings (title, description, category, price, images). For producers: company name, bio, website, phone.

2.4 Location listings (if you list a location)

Title, description, address (for private venues), city, day rate, capacity, amenities, images, and listing type.

2.5 Bookings, messages and reviews

• Booking/enquiry requests: project title and details, dates, budget, status, and the parties involved.
• Messages you send to other users in connection with a booking (content, timestamps, read status).
• Reviews you write or receive (rating and comment) tied to a booking.

2.6 Directory-listing source data ("unclaimed" listings)

For listings we created from public sources, we may store a source URL and a source note recording where the information came from. See §4.

2.7 Technical, security and moderation data

• IP address and request data, used transiently for rate-limiting and anti-abuse (via a third-party in-memory/Redis store) and for our anti-bot check (Cloudflare Turnstile) on sensitive forms.
• Error and diagnostic data collected by our error-monitoring provider (Sentry) when something goes wrong, which can include technical context about your request.
• Aggregate, cookieless website analytics (Cloudflare Web Analytics) — see §7.
• Admin audit logs: an internal, append-only record of moderation actions (who did what, when, and why, with before/after snapshots) kept for accountability and security.

We do not intentionally collect special-category data (e.g. health, ethnicity). Please do not put such data in free-text fields, CVs, or images.

3. Why we process it and our legal basis (GDPR Art. 6)

Where we rely on legitimate interests, you can ask for our balancing assessment and you have a right to object (§8).

4. Directory listings created from public sources ("unclaimed" listings)

Some listings were created by us from publicly available sources to make the directory useful, before the person or business signed up. Where we did so we record the source.

• Your rights here are the same as for any personal data (§8). In particular, you can object to this processing and ask us to erase the listing.
• The Platform supports a removal-requested state and a claim flow: you can claim a listing that is about you (and then control it), or request its removal.
• To claim or request removal, use the claim / removal option in the Platform, or write to us by post at our registered address. We will action valid requests promptly and, in any event, within the time limits in §8.
• Because we obtained this data from a source other than you, this section together with §2.6 also serves as the notice required by GDPR Art. 14.

5. Who we share data with (processors and recipients)

We do not sell your personal data. We share it only as needed to run the Platform:

• Other users of the Platform — your published profile/listing information is visible to Platform users and, for public profiles, to the open internet and search engines. Contact and booking/message content is shared with the specific user you deal with.
• Hosting & delivery: Vercel (application hosting).
• Database: Neon (managed PostgreSQL), hosted in the EU/EEA (Frankfurt, aws-eu-central-1).
• File/media storage: Cloudflare R2 (profile images, work galleries, CV PDFs), served via a public CDN URL.
• Sign-in: Google (only if you choose Google sign-in).
• Security / anti-bot: Cloudflare Turnstile.
• Rate-limiting store: Upstash (Redis) — transient counters keyed to your IP/identifier.
• Analytics: Cloudflare Web Analytics (cookieless, aggregate).
• Error monitoring: Sentry.
• Transactional email: Resend (US-based) — processes recipient email address and the content of service emails (account, security, booking and notification messages). See §6 for the transfer safeguard.
• Professional advisers and authorities: where required by law, or to establish, exercise or defend legal claims.

Each provider acts as our processor (or an independent controller for their own operations) under appropriate contractual terms. Some providers may process data outside the EU/EEA (see §6).

6. International transfers

Some processors process data outside the EU/EEA — in particular US-based providers such as Vercel, Cloudflare, Google, Upstash, Sentry and Resend. Where that happens, transfers are protected by appropriate safeguards under GDPR Chapter V — the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework where the provider is certified. Our database (Neon) is hosted in the EU/EEA (Frankfurt), so core account and profile data stays in the EU at rest. You can ask us for details of the safeguards for a specific provider.

7. Cookies and similar technologies

We keep cookies to the minimum:

• Strictly necessary — authentication/session. When you sign in we set a secure session cookie (NextAuth, JWT-based) so you stay logged in. This is essential to provide the service and does not require consent.
• Security / anti-bot. Cloudflare Turnstile may set limited, short-lived storage needed to run the anti-bot check on certain forms. Used only for security, not tracking.
• Analytics — cookieless. Cloudflare Web Analytics measures aggregate traffic without cookies and without tracking you across sites.

We do not use advertising or cross-site tracking cookies. Because we set only strictly-necessary and cookieless technologies, no cookie-consent banner is currently required; if we introduce any non-essential cookies in future, we will ask for your consent first via a cookie banner. Full detail, including cookie names, is in our Cookie Policy (at /cookies).

8. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing (including objecting to legitimate-interests processing and to any direct marketing); data portability; and to withdraw consent at any time where we rely on it (without affecting prior processing).

• You can exercise many of these directly in the Platform (edit or delete your profile/listings, delete your account). For anything else, write to us by post at our registered address, or contact us through the Platform.
• We respond within one month (extendable by two further months for complex requests, with notice). We may need to verify your identity first.
• Note on deletion: when you delete content or your account, related rows are removed by cascade, but we may retain limited data where the law requires it or to defend legal claims — for example admin audit-log entries (which intentionally survive account deletion for accountability) and routine backups, which are overwritten on a rolling cycle.

Complaints. You can complain to the Cyprus supervisory authority — the Office of the Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy) — or to the authority in your EU country of residence. We'd appreciate the chance to resolve it first.

9. How long we keep data

We keep personal data only as long as we need it for the purposes above:

• Account and profile/listing data: for as long as your account is active, and deleted (or anonymised) on account deletion, subject to the retention exceptions in §8.
• Booking, message and review data: kept while relevant to the parties and for up to 24 months after the related booking closes, then deleted — longer only where needed to defend a live legal claim (up to the applicable limitation period).
• Unclaimed listings: removed on a valid removal/objection request (§4), otherwise retained while the directory purpose applies.
• Security/rate-limit data: transient — counters expire within minutes to hours.
• Error logs: kept for up to 90 days (the provider's diagnostic retention window), then purged.
• Admin audit logs: retained for accountability for 24 months.

Some records may be kept longer where the law requires it or to establish, exercise or defend legal claims (contractual-claim limitation periods in Cyprus can run to several years).

10. How we protect data

We use technical and organisational measures including encrypted transport (HTTPS), hashed passwords (bcrypt), role-based access, admin audit logging, rate-limiting and anti-bot protection, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data and will notify you and the supervisory authority of a personal-data breach where the law requires.

Publicly visible information. Information you choose to publish on a public profile or listing (for example your name, photo, skills, credits, and any contact details you add) is, by its nature, visible to anyone on the internet and may be viewed, copied or indexed by third parties (including search engines) outside our control. Please only publish what you are comfortable making public; you can edit or remove it at any time.

Limits of our responsibility. To the fullest extent permitted by law — and without affecting your rights under data-protection law or our obligations as controller — we are not responsible for the misuse of your information by other users or third parties, for security incidents at third-party providers despite appropriate safeguards, or for events beyond our reasonable control. Our overall liability is addressed in the Terms & Conditions (§12); nothing here limits liability that cannot be limited by law.

11. Children

The Platform is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us by post at our registered address and we will delete it.

12. Automated decision-making

We do not carry out solely automated decision-making that produces legal or similarly significant effects on you. Rate-limiting and anti-bot checks are security measures, not decisions about you in that sense.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new effective date and, for material changes, take reasonable steps to notify registered users.

14. Contact

KONIMO Productions LTD, Stavrou Stylianide 100, Ergates, 2643, Nicosia, Cyprus. Company Registration No. HE 487989. For any privacy question or to exercise your rights, write to us by post at that address or contact us through the Platform.