privacy policy and cookies

I. General Provisions

The internet platform "Digital Catalog of Polish Cinematography" available at www.filmfiles.pl (hereinafter: "Platform") is a project implemented as part of the undertaking - "Digital Catalog of Polish Cinematography: an innovative database of films digitized in modern formats, created for their widespread availability in Poland and abroad" - under the National Recovery and Resilience Plan, component: Resilience and competitiveness of the economy, investment A2.5.1: Program supporting the activities of entities in the culture and creative industries sector to stimulate their development.
This Privacy and Cookies Policy (hereinafter: "Policy") sets out the rules for processing personal data of all persons using the Platform, regardless of whether they are Registered Users (having an account on the Platform) or Unregistered Users (using functions available without creating an account). The Policy also regulates the rules for using cookies and other similar technologies on the Platform.
The controller of personal data in connection with the use of the Platform is Archipeak Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (02-738), at ul. Dominikańska 9, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000868844 maintained by the District Court for the Capital City of Warsaw, XIII Commercial Division of the National Court Register, NIP: 5213912259 (hereinafter: "Controller" or "Platform Controller").
A Platform User is any natural person using the Platform, regardless of having an account on the Platform (hereinafter in singular: "User", and in plural "Users").
Registered Users are persons who have registered an account on the Platform and have concluded an agreement with the Controller for the provision of electronic services - in accordance with the Terms of Use of the Digital Catalog of Polish Cinematography Internet Platform (hereinafter: "Platform Terms").
Unregistered Users are persons using the Platform without creating an account, using its publicly available functions, such as browsing content or searching for information.
Acceptance of the Policy by an Unregistered User occurs through the use of the Platform and consent to the use of cookies in accordance with the displayed message (cookie banner) during the first visit to the Platform.
Acceptance of the Policy by a Registered User also occurs during the account registration process - in accordance with the Platform Terms, by submitting an appropriate declaration of will and accepting the Platform Terms and this Policy.
The Policy is an integral supplement to the Platform Terms and should be interpreted together with its provisions regarding Registered Users.
The Platform Controller attaches particular importance to respecting the privacy of Users and protecting their personal data, processing them in accordance with applicable laws. Users' personal data is processed by the Platform Controller in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), as well as in accordance with applicable national regulations on personal data protection.
The Controller applies appropriate technical and organizational measures to protect Users' personal data against loss, destruction, modification, and unauthorized access by third parties.
The Platform may contain links to websites of third parties that are not managed by the Controller. The Controller is not responsible for the personal data protection and privacy policies applied by these entities. The User uses these websites at their own risk, and we encourage you to familiarize yourself with the privacy policies applicable on these websites.
Providing personal data by the User is voluntary, but necessary to use selected functionalities of the Platform. Failure to provide the required data may result in the inability to use these functionalities.
In all cases where the Controller requests the User to consent to the processing of personal data or the use of cookies, such consent is voluntary and is given consciously.
The Controller may indicate that consent is given by performing a specific action (e.g., clicking a button, checking a checkbox, or starting to use the Platform). In such a case, performing this action is equivalent to the User's consent.
Failure to give consent does not prevent the use of the basic functionalities of the Platform, unless otherwise expressly indicated.

II. User Categories and Nature of Platform Use

Users use the Platform for various purposes, including as consumers - in accordance with the definition contained in Article 22¹ of the Civil Code or in connection with scientific, research, educational, or professional activities.
The Platform is not intended for children under 13 years of age. The Platform may only be used by persons who have reached 13 years of age.
In the case of minors who have reached 13 years of age, the use of the Platform and the processing of their personal data takes place only with the prior and express consent of their legal guardians. The consent of the legal guardian covers both the use of the Platform and the processing of the minor User's personal data to the extent necessary for the provision of services via the Platform.
The Controller - during the registration process requires the legal guardian to submit an appropriate statement of consent for the minor to use the Platform. For this purpose, the legal guardian submits a statement on the registration form and provides their personal data provided for in this form, which constitutes an attachment to the Terms. In justified cases, the Controller may also require written confirmation of this consent from the legal guardian.
The Controller takes special care to ensure that the processing of minors' personal data is carried out in accordance with the principle of data minimization and with respect for the rights and welfare of these persons.

III. Scope of Processed Personal Data

The scope of personal data processed by the Controller depends on whether the User uses the Platform as an Unregistered User or a Registered User.
In the case of Unregistered Users, only technical and statistical data is processed - which in certain circumstances may constitute personal data within the meaning of the GDPR, in particular:
1. IP address,
2. information contained in cookies,
3. data regarding the device, web browser, and operating system,
4. statistical data regarding the manner of using the Platform, and
5. personal data voluntarily provided by the Unregistered User in the contact form or in correspondence addressed to the Controller.
In the case of Registered Users, the Controller may additionally process the following personal data:
1. first and last name,
2. email address,
3. password (in encrypted form),
4. data regarding the User's status (consumer / use in connection with scientific, research, educational, or professional activities),
5. data provided in the registration form, contact form, or in correspondence with the Controller,
6. correspondence address, if provided in a complaint.
Providing personal data required for account registration is voluntary but necessary to conclude and perform the agreement for the provision of electronic services.
In the case of minor Users over 13 years of age, the Controller processes the personal data of their legal representatives, including in particular: first and last name, email address, telephone number, and other data necessary to confirm consent to the minor's use of the Platform, which have been provided in the registration form, or provided by the legal guardian in connection with communication or correspondence with the Platform Controller.

IV. Purposes and Legal Bases for Data Processing

In the case of Unregistered Users, the Controller processes personal data only to the extent necessary for the proper functioning of the Platform and the implementation of actions taken at the User's request.
The legal basis for processing personal data of Unregistered Users is:
1. Article 6(1)(f) GDPR - the Controller's legitimate interest, consisting in ensuring the proper functioning of the Platform, its security, preventing abuse, conducting statistics on the use of the Platform, and responding to inquiries from Users and pursuing claims or defending against claims;
2. Article 6(1)(b) GDPR - taking action at the request of the data subject before concluding a contract, in particular in the case of the User contacting the Controller via the contact form;
3. Article 6(1)(c) GDPR - fulfillment of legal obligations incumbent on the Controller;
4. Article 6(1)(a) GDPR - in the case of data processed via analytical or marketing cookies, only after voluntary consent has been given by the User.
Personal data of Registered Users, including minors over 13 years of age, is processed for the following purposes:
1. enabling the use of the Platform and its functionalities, including the conclusion and performance of the agreement for the provision of electronic services (Article 6(1)(b) GDPR);
2. implementation of the Platform's educational, scientific, and research purposes, in accordance with its nature (Article 6(1)(f) GDPR);
3. communication with the User or legal guardian, including handling inquiries and complaints (Article 6(1)(b) or (f) GDPR);
4. ensuring the security of the Platform and the protection of minor Users in the digital environment (Article 6(1)(c) and (f) GDPR);
5. fulfillment of the Controller's legal obligations arising from European Union and national law (Article 6(1)(c) GDPR);
6. handling any complaints related to the use of the Platform - the legal basis is the necessity of processing for the performance of the contract (Article 6(1)(b) GDPR);
7. pursuing claims or defending against claims (Article 6(1)(f) GDPR);
8. the Controller's marketing activities, including direct marketing regarding the Platform, its functionalities, development, and educational, scientific, or informational initiatives related to it - based on the Controller's legitimate interest (Article 6(1)(f) GDPR);
9. other marketing activities of the Controller not covered by the Controller's direct marketing - only on the basis of separate, voluntary consent of the User or legal guardian (Article 6(1)(a) GDPR).
In the case of minor Users over 13 years of age, the use of the Platform and the processing of their personal data takes place only on the basis of express consent of the legal guardian, given in accordance with Article 8 GDPR:
1. The legal basis for processing the personal data of the legal guardian is:
  1. express consent of the legal guardian to the processing of their personal data (Article 6(1)(a) GDPR),
  2. fulfillment of the Controller's legal obligations arising from legal provisions (Article 6(1)(c) GDPR).
2. The purposes of processing the personal data of the legal guardian include in particular:
  1. enabling the minor User to use the Platform in accordance with legal requirements,
  2. verification and confirmation of consent to the minor's use of the Platform,
  3. fulfillment of legal obligations related to the protection of minors' personal data,
  4. communication with the legal guardian regarding the use of the Platform and the exercise of rights and obligations of the minor User,
  5. pursuing claims or defending against claims (Article 6(1)(f) GDPR).
Providing personal data by the legal guardian is voluntary but necessary to enable the minor User to use the Platform.
The Controller may process Users' personal data for the purpose of direct marketing regarding the Platform, its functionalities, development, educational, scientific, or informational initiatives related to it, and activities carried out under the "Digital Catalog of Polish Cinematography" project. The legal basis for processing personal data in this regard is the Controller's legitimate interest, consisting in direct marketing of its own services and activities (Article 6(1)(f) GDPR). The Controller indicates that the Controller's direct marketing of the Platform referred to in the preceding sentence is not equivalent to consent to the use of cookies or consent to the sending of commercial information by electronic means, which require separate consent from the User.
Sending commercial and marketing information, including as part of direct marketing - by electronic means (in particular email, push notifications) takes place only after obtaining prior consent from the User or legal guardian, in accordance with the provisions of the Act on the provision of electronic services and Telecommunications Law, regardless of the legal basis for processing personal data under the GDPR. The Controller will contact the User only after obtaining their voluntary, unambiguous consent to receive such communication, expressed during registration or at another appropriate time.

V. Data Retention Period

Users' personal data is processed for the period necessary to achieve the purposes for which it was collected, and after the completion of these purposes - for the period resulting from applicable laws or until the statute of limitations for claims expires, in particular:
1. in the case of Registered Users:
  1. data is stored for the duration of the agreement for the provision of electronic services,
  2. after the termination of the agreement, data is stored for the period necessary to fulfill legal obligations (including tax and accounting) and until the statute of limitations for any claims related to the performance of the agreement expires,
  3. data processed on the basis of consent (e.g., marketing) is stored until it is withdrawn by the User.
2. in the case of Unregistered Users:
  1. technical and statistical data (e.g., IP address, cookies) is stored according to their nature and technical settings (e.g., session files until the end of the session, persistent files until their expiration date or deletion by the user),
  2. personal data voluntarily provided by the Unregistered User in the contact form or other communication channels is stored for the period necessary to handle the inquiry or other matter, and after its completion - for the time required by law or until the statute of limitations for claims expires,
  3. in the case of data processed on the basis of consent (e.g., marketing), this data is stored until the consent is withdrawn.
3. personal data of legal representatives of minor Users is stored for the period necessary to achieve the purposes resulting from granting consent to the minor's use of the Platform and until the statute of limitations for any claims related to this use expires, as well as in accordance with the Controller's legal obligations.
The Controller makes every effort not to store personal data longer than necessary, applying appropriate technical and organizational measures to ensure data security.
The User or the minor's legal representative has the right to withdraw consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Withdrawal of consent also does not limit the possibility of using the Platform if data processing is carried out on a legal basis other than consent.

VI. Data Recipients

Personal data may be transferred to entities processing data on behalf of the Controller, such as IT and hosting service providers, only on the basis of concluded data processing agreements.
Data is not transferred to third countries or international organizations unless this results from the use of tools provided by external entities. In such cases, appropriate legal safeguards are applied.

VII. Rights of Data Subjects

Users have the following rights regarding their personal data:
1. right of access to data;
2. right to rectification of data;
3. right to erasure of data (in cases provided for by law);
4. right to restriction of processing;
5. right to data portability;
6. right to object to data processing;
7. right to withdraw consent at any time;
8. right to lodge a complaint with the President of the Personal Data Protection Office.
To exercise the above rights, the User may contact the Controller using the contact details provided in Section XIII below.

VIII. Cookies, Similar Technologies, and User Consents

The Platform uses cookies and other similar technologies (e.g., local storage, session identifiers) to ensure proper operation, security, improve the quality of services, and - only after obtaining appropriate consent - for analytical and marketing purposes.
The use of cookies is carried out in accordance with applicable GDPR provisions, Article 173 of the Telecommunications Law, and European Union law standards, including the European Data Protection Board (EDPB).
Cookies are used for all Platform Users, including Unregistered Users.
Due to the purpose of use, the Platform uses the following categories of cookies:
1. necessary (technical) cookies - necessary for the proper functioning of the Platform, ensuring security, maintaining sessions, and handling forms; their use does not require the User's consent;
2. functional/preference cookies - enable remembering the User's selected settings (e.g., language, interface configuration) and are used only after obtaining the User's prior consent;
3. analytical/statistical cookies - used to conduct anonymous analyses of how the Platform is used (e.g., number of visits, session duration, traffic sources);
4. marketing cookies - used only for the Controller's marketing activities and are used only after obtaining prior, voluntary, and express consent from the User.
The Controller indicates that the marketing consent referred to in this Policy primarily concerns the processing of the User's personal data for marketing purposes and is not equivalent to consent to the use of cookies.
Consent to the processing of personal data for marketing purposes:
1. is completely voluntary and optional;
2. may be given independently of consent to cookies;
3. may be withdrawn at any time without affecting the ability to use the Platform;
4. is not a condition for registration or use of the Platform.
The Platform does not use Users' personal data for marketing profiling or automated decision-making within the meaning of Article 22 GDPR, regardless of whether marketing consent has been given.
Analytical and marketing cookies are not activated before the User gives consent via the cookie banner or consent management center.
The Controller informs that:
1. lack of consent to analytical or marketing cookies does not affect the ability to use the basic functionalities of the Platform;
2. data obtained using cookies is not used to create behavioral profiles of Users or for automatic content targeting.
The legal basis for processing personal data in connection with cookies is:
1. Article 6(1)(f) GDPR - in the case of necessary cookies;
2. Article 6(1)(a) GDPR - in the case of functional, analytical, and marketing cookies;
3. Article 173 of the Telecommunications Law.
The storage period of cookies depends on their type and function:
1. session cookies - stored until the browser session ends;
2. persistent cookies - stored for the period specified in their parameters or until deleted by the User.
Detailed information about the cookies used, including their names, providers, and storage periods, is available in the cookie banner or in the web browser settings.

IX. Cookie Management

The User may at any time change the cookie settings via their web browser settings or the cookie banner available on the Platform.
The User may at any time change or withdraw consent to the use of cookies through the appropriate settings of their web browser. Below are sample links to instructions for managing cookies in the most popular browsers:
1. Google Chrome: https://support.google.com/chrome/answer/95647
2. Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-and-site-data
3. Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge
4. Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
Restricting the use of cookies may affect some functionalities of the Platform.

X. Safety of Minor Users in the Digital Environment

The Platform Controller considers the protection of minor Users on the Internet to be particularly important and takes measures to ensure safe use of the Platform.
The Controller applies organizational and technical measures appropriate to the risk, in particular to:
1. limit the scope of processed personal data of minors;
2. prevent unauthorized access to data;
3. protect against abuse and unauthorized use of data;
4. implement principles resulting from European Union law regarding digital security and child protection in the online environment.
The Controller does not direct marketing activities or direct marketing directly to minor Users of the Platform. Any processing of minors' personal data for marketing purposes may only take place with the prior and express consent of the legal guardian. The legal guardian gives consent to the processing of the minor's personal data for direct marketing purposes and the sending of commercial information by electronic means.

XI. Profiling and Automated Decision-Making

The Controller informs that the Platform does not use Users' personal data for profiling or automated decision-making within the meaning of Article 22 GDPR.
Users' personal data is not processed to create behavioral profiles or to make decisions that could have legal effects on them or similarly significantly affect them.

XII. Policy Changes

The Controller reserves the right to change the Policy in the event of changes in law, Platform functionality, or data processing methods.
The current version of the Policy is always published on the Platform together with the date of its entry into force.

XIII. Contact

The Controller has not appointed a Data Protection Officer (DPO). All matters related to personal data protection may be addressed directly to the Controller at the contact details provided.
In matters related to personal data protection and cookies, the User may contact the Controller:
1. by mail: Archipeak Sp. z o.o., ul. Dominikańska 9, 02-738 Warsaw;
2. by email: [email protected].

Policy effective date: January 26, 2026.