1. Who processes your data
The controller of your personal data is KOVA Wytwórnia Filmów Prosta Spółka Akcyjna (simple joint-stock company), ul. Stanisławowska 47, 51-618 Wrocław, Poland, KRS 0001240233, NIP (tax ID) 8943286480, REGON 54469861100000. Studio and office: ul. Grabiszyńska 241, 53-234 Wrocław. The same controller runs the H241 studio (h241.space).
For anything related to personal data, write to studio@kova.productions.
2. What data, why and on what legal basis
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact form, project enquiry, booking a call | name, company, email, phone, message, chosen time slot, how you found us | reply, call, preparing an offer | Art. 6(1)(b) and (f) |
| Documentary School and workshop sign-ups | as above plus invoice details | entering into and performing the contract, accounting | Art. 6(1)(b) and (c) |
| Buying KOVA VOD access | email, payment ID, film, access period | sending the link, 48-hour access to the film, accounting | Art. 6(1)(b) and (c) |
| Email correspondence | email address, content, attachments | conversations and collaboration | Art. 6(1)(f) |
| Basic visit statistics (no cookies) | page visited, referral source, IP address in server logs | site security, statistics | Art. 6(1)(f) |
| Analytics and advertising (Google, Meta) | cookie identifiers, on-site events | measuring and tailoring ads | Art. 6(1)(a) — only with your consent |
We never see your card or bank details. Stripe processes them.
Providing data is voluntary. Without an email address we cannot reply to an enquiry or send the film link.
3. How long we keep it
- Enquiries and calls that did not lead to a contract: up to 3 years from the last contact.
- Contracts, invoices and payments: 5 years from the end of the year in which the tax obligation arose.
- Data based on consent: until you withdraw it.
- Server logs: up to 12 months.
4. Who receives the data
Only companies that support us technically, under data processing agreements:
- Hostinger International Ltd. — website and form server,
- OVH SAS — email,
- Google Ireland Ltd. — Analytics, Ads, calendar and Google Meet for calls, YouTube,
- Meta Platforms Ireland Ltd. — Meta pixel, shared by kova.productions and h241.space (only with consent),
- Stripe Payments Europe Ltd. — payments,
- Resend (Plus Five Five, Inc.) — sending the email with the film link,
- Vimeo.com, Inc. — VOD playback,
- our accounting office and invoicing system — accounting.
Some of these companies may process data outside the European Economic Area (mainly the USA). In that case the basis is a European Commission decision (EU-US Data Privacy Framework) or standard contractual clauses.
5. Your rights
You have the right to access your data, to rectify, erase and port it, to restrict processing and to object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect what happened before.
You can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
6. Profiling
We do not make automated decisions. With your consent, Google and Meta may use cookie data to tailor ads.
7. Cookies
See the cookie policy.
8. Changes
When we change how we process data, we will update this document and the date at the top.