Privacy Policy

1Who processes the data

The data controller is:

The law does not require us to appoint a data protection officer (DPO) for our business: for anything related to privacy, write to the email address above.

2Who this policy is for

This policy covers:

• visitors to the website www.sigrafilm.it, including the GiuLi page;
• the cinemas that use GiuLi, our theatre management system (TMS), and the people who work there or contact us on their behalf.

It is written in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).

3The website

The website is made of static pages and collects as little as possible:

• no cookies, neither ours nor anyone else's: that is why there is no banner to accept;
• no analytics on visits, no advertising, no social buttons that track you;
• no forms: we do not ask you to enter any data on the website;
• the fonts are served from our own domain, not from external services.

The website is hosted by GitHub Pages (GitHub, Inc.). Like any web server, GitHub records some data about each visit in its technical logs, such as the IP address, the browser and the page requested, to run the service and protect it from abuse. We do not receive or use this data. How GitHub handles it is explained in its privacy statement.

The website contains links to WhatsApp, to your email app and to Google Maps. They only come into play if you tap them: from then on, those services' privacy rules apply.

4GiuLi and the cinema's data

GiuLi runs on the cinema's PC. The data it manages stays on that PC and is not sent to us. This includes, for example, the users and their passwords, the programming, playlists, content, KDMs, alerts and logs. The cinema is the controller of this data.

Some GiuLi features can communicate with the outside world, for example alerts on Telegram or reading the mailbox where KDMs arrive. The cinema turns them on and sets them up, towards its own services and accounts: we do not receive that data.

We only process the cinema's data in two cases.

• Licence. To issue the GiuLi licence we receive the name of the customer and of the cinema, the number of screens, the validity period and the PC's installation code. The installation code is calculated from the PC's technical characteristics and contains no personal data. We keep a register of the licences we issue.
• Support. When the cinema asks us to, one of our technicians connects to the GiuLi PC through a VPN (a private, encrypted connection). During the intervention they may see the data held in GiuLi. We only use it to solve the problem and do not keep a copy, except when the intervention needs one, for example an error log, which we then delete. For this data we act on behalf of the cinema, which remains its controller.

5What data we process

As controller, we process the following data of our cinema customers and of the people who work there:

• contact details: name, role, email, phone number;
• contract and invoicing data: company name, address, VAT number or tax code, SDI code or certified email (PEC);
• communications: emails, WhatsApp messages and phone calls requesting support or information, with their content;
• GiuLi licence data, described above.

We do not ask for special categories of data, such as health data or opinions: please do not send them to us.

6Why, and on what legal basis

We do not use data for advertising or newsletters, we do not build profiles and we do not take automated decisions about you. We do not sell data to anyone.

7Who we share it with

The data is seen by us at Sigra Film. We only share it with those who help us work, and only as far as needed:

• our email provider (MKLINK);
• WhatsApp Business, if you write to us on WhatsApp;
• our accountant and our e-invoicing software, and the Italian Revenue Agency's Exchange System (SdI) for sending invoices;
• banks, for payments;
• public authorities, when required by law.

Those who process data on our behalf do so as processors, with the safeguards required by the GDPR. Others, such as banks and authorities, process it as independent controllers.

8Transfers outside the European Union

As a rule, the data stays in Italy and in the European Union. The exceptions are GitHub, which hosts the website, and WhatsApp, which may process data in the United States. In these cases the transfer takes place with the safeguards required by the GDPR: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, or standard contractual clauses.

9How long we keep it

After these periods the data is deleted, unless we need it to defend our rights in a dispute that is already open.

10Security

We protect the data with appropriate measures: access limited to the people who need it, passwords, encrypted connections such as the VPN used for support, backups. No system is one hundred per cent secure: should a data breach occur, we will do what the law requires, including notifying the Italian Data Protection Authority and, where necessary, the people concerned.

11Your rights

At any time you can ask us to:

• tell you whether we process your data and give you a copy;
• correct or complete it;
• delete it, when we no longer have to keep it;
• restrict its use;
• stop processing based on our legitimate interest (right to object);
• give it to you in a machine-readable format, to pass on to others (portability).

Write to assistenza@sigrafilm.it or to our certified email sigrafilm@pec.it. We reply within one month; for complex requests we may take two more months, and we will let you know. Before replying we may ask you for something to make sure it is really you.

If you think we are not handling your data correctly, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, or with the authority of the country where you live or work.

12Do you have to give us the data?

No, but without the necessary data we cannot issue a GiuLi licence, provide support, or draw up a contract or an invoice.

13Children

The website and our services are aimed at cinema businesses and professionals, not at children. We do not knowingly collect children's data: should it happen, we delete it.

14Changes

If anything changes we update this page and the date at the top. We also tell the cinemas that use GiuLi about any important change.

15Contact

The Italian version of this policy is available here.