1. Who is responsible

1.1. This Policy explains how personal information is handled on https://rouzbehrashidi.com/ (the “website”). The controller is the filmmaker Rouzbeh Rashidi (“I”, “me”, “my”).

1.2. For anything concerning your personal information, write to rouzbehrashidi@gmail.com.

1.3. This Policy is an information notice, not a contract. It is written to comply with the EU General Data Protection Regulation (GDPR) and applicable Irish data-protection law.

2. What information is collected

2.1. Orders. When you buy a film or edition: your name, email address, billing details and country, and the order record. Card details are entered directly with the payment provider and never reach this website.

2.2. Newsletter. Only if you subscribe: your email address, and your name if you give it.

2.3. Correspondence. Emails you send me, and my replies.

2.4. Technical information. Standard server logs, such as IP address and request data, generated automatically by the hosting infrastructure for security and operation.

3. What is not done

3.1. The website runs no analytics, no advertising trackers and no third-party marketing pixels.

3.2. Personal information is never sold, rented or traded.

3.3. Buying a film never adds you to the newsletter. Only subscribing does.

4. Why it is used, and the legal bases

• Processing your order and delivering your download: performance of a contract.
• Keeping order and accounting records: legal obligation (tax and accounting law).
• Notifying me of each new order so that it can be checked and any problem answered quickly: legitimate interests.
• Website security and protection of the film files: legitimate interests.
• Sending the newsletter: consent, which you can withdraw at any time through the unsubscribe link or by email.
• Answering your correspondence: legitimate interests.

5. Who receives it

Personal information is shared only with the providers needed to run the website:

• Payment: Stripe (card, Apple Pay, Google Pay, Link), PayPal and Klarna. Each acts as an independent controller of the payment data you give them, under its own privacy policy.
• Hosting and email: the website hosting provider, which operates the servers, databases and order emails.
• Film delivery: Bunny.net, which stores the film files and serves your download.
• Order notification: CallMeBot, a messaging relay that forwards a short notice of each new order, with the buyer’s name, to my phone through WhatsApp.
• Newsletter: subscriptions made here are held on the mailing list run by EFS Film School (https://efsfilmschool.com/), the single list behind all three of my websites, and used only for the newsletter.

Information may also be disclosed where the law requires it.

6. International transfers

Some providers may process data outside the European Economic Area. Where that happens, transfers rely on recognised safeguards, such as adequacy decisions or the European Commission’s Standard Contractual Clauses.

7. How long information is kept

• Order and accounting records: at least six years, as tax law requires.
• Newsletter data: until you unsubscribe.
• Correspondence: as long as it remains relevant to the matter concerned.

When information is no longer needed, it is deleted or anonymised.

8. Cookies

The website uses only cookies strictly necessary for it to work, such as those that keep your basket during checkout. It sets no advertising or analytics cookies, which is why there is no cookie banner. Payment elements are provided by the payment providers named above and work only on the pages where you use them.

9. Your rights

9.1. Under the GDPR, you have the right to access the personal information held about you, have it corrected, have it erased where there is no continuing need for it, restrict or object to its processing, receive a portable copy, and withdraw consent at any time.

9.2. To exercise any of these rights, write to rouzbehrashidi@gmail.com. You will receive a reply within one month.

9.3. You may also complain to a supervisory authority, including the Irish Data Protection Commission (https://www.dataprotection.ie/) or the authority in your country of residence.

10. Changes

This Policy may be updated from time to time. The version published here, identified by its effective date, is the current one.