Privacy Policy

The project request form on the Commission a Film page is the only place on this website where you are asked to type anything about yourself. It collects:

• Contact details — your name, your email address, and a phone number if you choose to give one.
• Organisation — the gallery, artist or institution you are writing on behalf of, and a website or Instagram handle.
• Project details — the type of film, the location, a preferred filming date, a deadline, an estimated budget range, your description of the project, and any reference link you add.

Only your name and your email address are required. Everything else is optional and is there so we can answer you properly.

Three technical details are saved alongside a project request. They exist to keep the form usable and free of automated spam, and they are used for nothing else:

• the page you were on immediately before you reached the form;
• your browser's user-agent string, which names your browser and operating system;
• a salted, shortened, one-way hash of your IP address.

Your actual IP address is never written to our database, and the hash cannot be turned back into it. It only lets us recognise that several submissions came from the same connection.

• To read, answer and discuss your project request.
• To prepare a quote or a proposal if the project goes further.
• To keep a record of what was agreed while a commission is running.
• To recognise and block automated submissions.

We do not sell your information, we do not share it for advertising, and we do not add you to a mailing list because you sent us a project request.

Under the GDPR our lawful basis for handling a project request is Article 6(1)(b) — steps taken at your own request before a possible contract. For the anti-spam details it is Article 6(1)(f), our legitimate interest in keeping a public form usable.

This website sets no cookies of its own for visitors. The single cookie the site can issue is a sign-in session for the private admin area, and you only ever receive it if you are a member of our team signing in.

We do use Google Analytics to see how many people visit, which films and pages they open, and roughly where in the world they are. Google Analytics sets its own cookies in your browser and processes technical information — an approximate location derived from your IP address, your device and browser, and the pages you view. We read it only in aggregate and never use it to work out who you are.

You can block analytics cookies in your browser settings or with a content blocker; the site works normally without them. The small notice at the bottom of the screen records your acknowledgement in your browser's own local storage, and that value never leaves your device.

A few third parties necessarily process technical information in order for the site to work. These are all of them:

• Hetzner Online GmbH — the server the website and its database run on, located in Nuremberg, Germany. Everything you send us is stored there, inside the EU.
• Cloudflare — sits in front of the site as its content delivery network and security layer, and handles the connection between your browser and our server.
• YouTube (Google) — our films are hosted on YouTube. Thumbnails load from YouTube's servers, and players are embedded through youtube-nocookie.com, which holds back YouTube's usual tracking cookies until you press play. Once you play a film, YouTube's own privacy policy applies.
• Google Analytics — described above.
• Gmail (Google) — a project request is emailed to us as well as saved, and that message is delivered through our Google mail account.

A project request is kept for as long as it is needed for the purpose it was sent for: while we are talking about it, and for the life of the commission if it becomes one, plus the period we are required to keep business records. Submissions filed as spam are kept only long enough to be reviewed.

If you would like your request removed sooner than that, ask us and we will delete it.

Under the GDPR you can ask us to:

• give you a copy of the personal information we hold about you;
• correct anything that is wrong or incomplete;
• delete it;
• restrict or object to the way we are using it;
• send it to you, or to someone else, in a portable format.

Write to [email protected] and we will answer within one month. There is no charge for asking.

If you believe we have handled your information badly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

We update this page when what we do changes. The date at the top says when it last changed. For anything to do with privacy, including a request to see or delete your information, write to [email protected].