FILM FESTIVAL NORD AB/NORDISK PANORAMA ( hereinafter, NP) respects and protects your right to privacy in relation to your interactions with this website (the “Site”). We have adopted the following policies to safeguard your personal information and to protect its confidentiality. Any information which is provided by you to Nordisk Panorama via this Site or otherwise will be treated in accordance with the terms of the Data Protection Act 2018 (GDPR) and/or such amending or replacement legislation as may be adopted in Europe from time to time. We encourage you to read this Privacy Policy before using this Site. If you do not read or if you disagree with any aspect of the Privacy Policy, you should not use this Site. By visiting this Site, you are accepting and consenting to the practices described in this Privacy Policy. Please review our Terms & Conditions at https://online.nordiskpanorama.com/page/terms-and-conditions/ which also govern your visit to the Site.

1. The Video Privacy Protection Act of 1988

NP adheres to The Video Privacy Protection Act of 1988.

2. What personal information does Nordisk Panorama collect?

When registering online with NP you will be asked to provide certain personal information, such as your name, email address, password, date of birth, gender, and other information required to provide you with the requested Services. Personal information that we collect from you will only be used for the purposes of providing the requested Services and will not be shared with any third parties except to the extent as set out below. NP retains the right to contact you in relation to the Services provided on this Site.

3. How is my personal information used by Nordisk Panorama?

NP will use your personal information to identify you as a user, to set up and administer your account, to take, process and deliver your orders for Services provided on this Site, to provide you with effective customer service and/or technical support, to provide you with information about other products, services, offers, competitions and promotions (assuming you have consented to receive such information as described in the “Opt-In” section of this Privacy Statement), and for other purposes that NP notifies you about. We do not collect or keep your personal information unless it is necessary for the above purposes(s) or required by law. NP will not retain your information for any longer than is necessary for these purposes or as required by law.

4. What about cookies?

Cookies are small text files that are sent to or accessed from your web browser or your device’s memory. A cookie typically contains the name of the domain (internet location) from which the cookie originated, the “lifetime” of the cookie (i.e., when it expires) and a randomly generated unique number or similar identifier. A cookie also may contain information about your device, such as user settings, browsing history and activities conducted while using our services. We use functional cookies to make our website work properly and give you the best experience. We also use statistical cookies to gather data for our website. As a non-profit organisation, these statistics may be helpful in our funding process.

5. Does Nordisk Panorama share the information it receives?

NP will not rent, sell or share your personal information with any third party except as described below or as otherwise agreed by you. NP employs other companies and individuals to perform functions on our behalf. Examples include fulfilling orders, sending postal mail and e-mail, removing repetitive information from customer lists, providing marketing assistance, providing search results and links, and providing customer service. They have access to personal information needed to perform their functions, but may not use it for other purposes. NP uses New Zealand based Shift72 to manage and maintain the platform technological infrastructure. Under Articles 44-50 of the GDPR, personal data cannot be transferred to third countries unless the country ensures an adequate level of protection. New Zealand is on the ‘approved list’. If a country is on this approved list, then Danish data controllers may transfer personal data to such countries, in the same way as if the transfer were being made within Denmark, or within the EEA. For more information on Shift72’s privacy policy please see https://www.shift72.com/privacy-policy/.

6. Protection of Nordisk Panorama and Others

NP releases accounts and other personal information when we believe release is appropriate to comply with the law; enforce or apply our Terms of Use and other agreements; or protect the rights, property, or safety of NP, our users, or others. This includes exchanging information with other companies and organisations for fraud protection. However, this does not include selling, renting, sharing, or otherwise disclosing personally identifiable information from customers for commercial purposes in violation of the commitments set forth in this Privacy Statement. With your consent other than as set out above, you will receive notice when information about you might go to third parties, and you will have an opportunity to choose not to share the information.

7. Can I access my personal information?

In compliance with the GDPR, every data subject has a number of rights in relation to the information we hold about you:

• Your right of access: If you ask us, we’ll confirm whether we’re processing your personal information and, subject to any applicable exemptions, provide you with a copy of that personal information (along with certain other details) within the timescales or extended timescales provided for by the law for complex requests, or where applicable, provide you with an explanation as to why we will not be complying with your request. If you require additional copies, we may need to charge a reasonable fee.

• Your right to rectification: If the personal information we hold about you is inaccurate or incomplete, you’re entitled to have it rectified. If you are entitled to rectification and if we’ve shared your personal information with others, we’ll let them know about the rectification where possible and where this would not involve a disproportionate effort. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal information with so that you can contact them directly.

• Your right to erasure: You can ask us to delete or remove your personal information in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable because that was the legal basis on which we were processing your personal information). If you are entitled to erasure and if we’ve shared your personal information with others, we’ll take reasonable steps to inform those others where possible and where this would not involve a disproportionate effort. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal information with so that you can contact them directly.

• Your right to restrict processing: You can ask us to ‘block’ or suppress the processing of your personal information in certain circumstances such as where you contest the accuracy of that personal information or you object to us. If you are entitled to restriction and if we’ve shared your personal information with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal information with so that you can contact them directly.

• Your right to data portability: You have the right, in certain circumstances, to obtain personal information you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

• Your right to object: You can ask us to stop processing your personal information, and we will do so if we are:

• relying on our own or someone else’s legitimate interests to process your personal information except if we can demonstrate compelling legal grounds for the processing; or

• processing your personal information for direct marketing.

• Your rights in relation to automated decision-making and profiling: You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

• Your right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time.

• Your right to lodge a complaint with the supervisory authority: If you wish to contact us on any matter in relation to the processing of your personal information, please submit requests to post@nordiskpanorama.com.

8. How is my personal information secured?

NP works to protect the security of your information during transmission by using Secure Sockets Layer (SSL) software, which encrypts information you input. NP complies with appropriate measures to industry standards to protect users’ personal data. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure and therefore NP cannot guarantee its absolute security. Our technology partner Shift72 also follows a number of strict measures to protect the security of your information. Here are some of their key security policies:

• User’s passwords are salted and hashed, following best practice from OWASP

• Users have access to their own data. Their data is not visible publicly or to other users.

• Admins have access to user data, including name, email, birthdate, gender, order history and viewing activity.

9. How can you access and modify your information?

You can access all your personally identifiable information that we collect online and maintain by visiting your Account Settings page. We use this procedure to better safeguard your information. You can correct factual errors in your personally identifiable information by sending us a request that credibly shows error. To protect your privacy and security, we will also take reasonable steps to verify your identity before granting access or making corrections.

10. How to cancel your account?

Contact us at ticket@nordiskpanorama.com if you wish to have your account permanently deleted.

11. Link to Third Party Sites

You should also be aware that when you link to another website from the Site, NP has no control over that other Site. Accordingly, NP cannot guarantee that the controller of that Site will respect your privacy in the same manner as NP.

12. Use of Third Party Services

Google Analytics

NP uses Google Analytics to help us to understand how you use our site and tools, which allows us to know how to improve our products for your benefit. It follows your progress through the website, collecting anonymous data on where you have come from, which pages you visit, and how long you spend on the site. Google then stores this data in order to create reports. However, Google does not store your personal data. Google will track your IP address, and it may be transmitted to and stored by Google on servers in the United States. Google may use this information for the purpose of evaluating your use of the website, compiling reports on website activity for us, and providing other services relating to website activity and Internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. For more information on Google’s privacy policies, please visit https://policies.google.com/privacy. Google Analytics services are governed by the Google Analytics Terms of Service which can be found at https://marketingplatform.google.com/about/analytics/terms/us/.

Intercom

We use third-party analytics services to help understand your usage of our services. In particular, we provide a limited amount of your information (such as the sign-up date and some personal information like your email address) to Intercom, Inc. (“Intercom”) and utilise Intercom to collect data for analytics purposes when you visit our website or use our product. As a data processor acting on our behalf, Intercom analyses your use of our website and/or product and tracks our relationship by way of cookies and similar technologies so that we can improve our service to you. For more information on Intercom’s use of cookies, please visit https://www.intercom.com/terms-and-policies#cookie-policy. We may also use Intercom as a medium for communications, either through email or through messages within our product(s). For more information on the privacy practices of Intercom, please visit https://www.intercom.com/terms-and-policies#privacy. Intercom’s services are governed by Intercom’s terms of use which can be found at https://www.intercom.com/terms-and-policies#terms.

Mandrill

We use Mandrill to send transactional emails, such as a welcome email, purchase receipt, or forgot password email. We provide a limited amount of your information, such as your email address, to The Rocket Science Group LLC, who operate Mailchimp and Mandrill. We utilise Mandrill to collect data for analytics purposes when you view the email. For more information on the privacy practices of Mandrill, please visit https://mailchimp.com/legal/privacy/. Mandrill’s services are governed by Mailchimp’s terms of use which can be found at https://mailchimp.com/legal/terms/.

Amazon Web Services

We use Amazon Web Services (AWS) who provide us with a cloud storage solution. AWS has demonstrated compliance with a range of internationally recognised standards for content, data and infrastructure security, such as information security management system- ISO-27001, System and Organization Controls Report- SOC1/2; in addition, AWS has demonstrated alignment with the MPAA Content Security Best Practices and the AWS infrastructure is compliant with all applicable MPAA controls. For more information on AWS’ privacy policy please see: https://aws.amazon.com/privacy/

AdButler

AdButler has incorporated “Privacy by Design” as a core principle. AdButler believes in processing the absolute minimum amount of data needed to provide their services. Because of their approach to privacy, they were able to achieve GDPR compliance with minimal changes. For advertisements placed on web pages, the only private data that they process is your user’s IP address. They process this to provide their ad serving, reporting and anti-fraud services. They anonymize the IP address by removing the last portion, for example, “192.168.0.123” would become “192.168.0.xxx”, removing any possibility of associating the IP address with an individual. For more information on AdButler’s privacy policy please see: https://www.sparklit.com/agreements.spark?agreement=privacy

13. Access by children

If you are aged 18 or younger, you must have your parent’s/guardian’s permission before submitting your personal information to this Site. If you don’t have your parent’s/guardian’s consent, you should not submit any personal information to this Site.

14. Notices and Revisions

Our Privacy Policy and the Terms & Conditions may change. We may email periodic reminders of any changes to our notices and conditions unless you have instructed us not to. However, you should check our Site frequently to see if there have been any changes. Unless stated otherwise, our current Privacy Policy applies to all information that we have about you and your account. We stand behind the promises we make, and will never materially change our policies and practices to make them less protective of customer information collected in the past without the consent of the persons affected. If you have any concern about privacy on this Site please contact us at post@nordiskpanorama.com