Privacy notice

1. Data controller

Kreamatic is a Norwegian technology platform for the film, TV and advertising industry. Kreamatic AS is the data controller for the personal data we collect about you as a user of the website and the platform.

Privacy contact: [email protected]

When you or your company upload data about other people, such as crew, performers or contacts, you or your company is the controller and Kreamatic is the processor under the data processing agreement in the terms.

2. What we store and why

The list below shows what we store, what we use it for and the legal basis under the General Data Protection Regulation (GDPR) Article 6.

• Account and profile (name, e-mail address, phone number, role, company, profile picture): to create the account, sign you in and deliver the service. Legal basis: contract, Article 6(1)(b).
• Content you upload or enter (images, video, documents, text and project data): to deliver the service you asked for. Legal basis: contract, Article 6(1)(b).
• Messages you send us and important messages we send about your account: to reply to you and run the account. Legal basis: contract, Article 6(1)(b).
• Billing details and payment history: to invoice and to comply with accounting law. Legal basis: legal obligation, Article 6(1)(c). Card details are processed by Stripe and not stored by us.
• Security log (IP address, browser type, operating system and the time of sign-ins and important actions): to detect misuse and secure the service. Legal basis: legitimate interest, Article 6(1)(f).
• Your cookie consent and what you consented to: to document your choices. Legal basis: legal obligation, Article 6(1)(c).
• Usage statistics (page views, features used and performance measurements): to improve the platform. Processed only if you consent. Legal basis: consent, Article 6(1)(a).

We never sell personal data.

Some data comes from others: a colleague who invites you gives us your name and e-mail address; Google gives us your name and e-mail address if you sign in with Google; Stripe tells us whether a payment succeeded.

You must give us your name and e-mail address to have an account, and billing details to buy a subscription. Everything else is optional.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects for you.

Allergies and dietary needs

You can record food allergies and dietary needs so that catering on the productions you work on can keep you safe. This is health data, and religious dietary needs can reveal religious belief. It is always voluntary. Legal basis: your explicit consent, Article 6(1)(a) and Article 9(2)(a).

On a project you take part in, the information is shown with your name only to you, to the people responsible for safety and for catering on the project, and to anyone given safety or catering responsibility for a particular day. The project owner, the project managers and all other members see only totals. A life-threatening allergy gives everyone on set a warning that does not name you.

The project's access ends automatically when the project is completed, archived, cancelled or deleted. You can change or remove the information at any time. Removing it withdraws your consent.

3. Sub-processors and transfers outside the EEA

We share personal data only with our sub-processors. The full list, with the purpose, location and transfer basis for each provider, is on the Sub-processors page. It is the same list the data processing agreement in the terms refers to.

See the list of sub-processors

Others who can see your data: members of your company with access to the module, agencies you connect your performer profile to, and anyone with a public link that you or your company shares. Authorities when the law requires it.

The AI services use the providers' default endpoints and we have not selected an EU region. Images in Location Catalog and Casting Catalog that are tagged with AI are sent to the AI provider selected for image tagging. This happens when a user starts tagging, or when the company administrator has turned on automatic tagging for the catalog (without a company, you turn it on yourself). Automatic tagging is off by default and applies only to images uploaded after it is turned on. In Casting, the agency or company does the tagging, not the performer. Receipts and scanned forms that are read with text recognition are sent to Google Cloud Vision through the EU endpoint. AI is used only when a user starts an AI feature or automatic tagging is turned on, and AI is on by default. A company administrator can turn AI off for the whole company, and the tasks can then be done by hand. The providers do not use customer data to train models through our integration.

You can ask for a copy of the safeguards for transfers outside the EEA by writing to [email protected].

4. How long we keep data

• Security logs (sign-in, two-step verification, changes to access and ownership, and lookups of sensitive data): 12 months.
• Operational logs (emails sent, payment events, notifications and background jobs): 90 days.
• User activity (which pages and features are used): 90 days.
• Server logs (errors and requests, with user ID, email and IP address): 30 days.
• Consent records and requests for access, correction and deletion: 12 months.
• Acceptance of the terms: for as long as the account exists, and 12 months after the account is deleted.
• Your own timesheets, expenses and receipts as a freelancer, without a company: deleted with the account. Download them before you delete the account.
• The company's accounting records, such as invoices, payments and approved timesheets and expenses: 5 years after the end of the financial year. The Norwegian Bookkeeping Act requires this.
• Project data: follows the project. When a project is deleted, its data is deleted.
• Backups: up to 12 months. Data you deleted stays in the backups until they rotate out, and is then gone. We use the backups only to restore the service after a failure.
• When you ask to delete your account you have 30 days to cancel. The period counts from the day after the request, and the data is deleted when day 30 is over. The date is shown on the privacy page once you confirm.

5. Your rights

Under the GDPR, Articles 15 to 21, you have the right to:

• access the data we hold about you (Article 15)
• have inaccurate data corrected (Article 16)
• have your data erased (Article 17)
• have processing restricted (Article 18)
• receive your data in a machine-readable format (Article 20)
• object to processing based on legitimate interest (Article 21)

Where we rely on your consent, you can withdraw it at any time. This does not affect processing that took place before you withdrew it.

You can export and delete your data yourself under Privacy in settings.

For other requests, write to [email protected]. We reply within 30 days.

You can complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe we process your data in breach of the rules: datatilsynet.no

6. Security

We protect your data with:

• encryption in transit and at rest
• access control in the database (Row Level Security), so you only see data you have access to
• authentication and access control in the application

7. Cookies

Necessary cookies provide sign-in and security and remember your consent choices. They are always active.

Analytics cookies (Google Analytics and performance measurements) are used only if you consent.

You can change your consent at any time through the cookie banner at the bottom of the page.

8. Changes

We may update this notice. The date at the top shows the last change. We notify you of significant changes by e-mail or in the platform.

9. Contact

• Privacy: [email protected]
• General enquiries and support: [email protected]