PRIVACY POLICY

POLICY GOVERNING PERSONAL DATA PROCESSING (UK GDPR COMPLIANT)
Effective Date: 01/01/2026

This Privacy Policy describes how Mafa Short Film Ltd ("we", "us", or "our") collects, uses, and discloses your personal information when you use our services.

1.1. Data Controller Identification

Mafa Short Film Ltd, a company incorporated and registered in the United Kingdom, acts as the Data Controller. We are responsible for deciding how we hold and use personal information about you.

1.2. Regulatory Compliance

This Policy is strictly governed by and compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We ensure that your data is processed lawfully, fairly, and in a transparent manner.

To provide our high-quality cinematic services, we process the following categories of data under specific Lawful Bases:

• • Identity & Contact Data: Includes your full name, email address, and account credentials. (Lawful Basis: Performance of Contract)
• • Transactional & Financial Data: Includes details about payments to and from you and other details of products and services you have purchased from us. (Lawful Basis: Performance of Contract & Legal Obligation)
• • Technical & Usage Data: Includes IP address, login data, browser type, time zone setting, viewing history, and how you use our website or app. (Lawful Basis: Legitimate Interests)
• • Marketing & Communications Data: Includes your preferences in receiving marketing from us and your communication preferences.

3.1. Third-Party Recipients

We do not sell your personal data. We only share data with trusted third-party service providers (Processors) who perform services on our behalf, such as payment processing (Stripe/Apple/Google), cloud storage, and analytics.

3.2. International Transfer Safeguards

As Mafa operates globally, your data may be transferred to and stored at a destination outside the UK or the European Economic Area (EEA). We ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: Standard Contractual Clauses (SCCs) approved by the European Commission/ICO or reliance on Adequacy Decisions.

Under the UK GDPR, you have significant rights regarding your data. You may exercise these at any time by contacting our support team:

• Right of Access: Obtain a copy of the personal data we hold about you.
• Right to Rectification: Correct any incomplete or inaccurate data.
• Right to Erasure: Also known as the 'Right to be Forgotten', allowing you to ask us to delete personal data.
• Right to Restrict Processing: Suspend the processing of your personal data in specific scenarios.
• Right to Data Portability: Request the transfer of your data to you or a third party in a structured format.
• Right to Object: Object to processing where we are relying on a legitimate interest.

5.1. Retention Periods

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. By law, we must keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six (6) years after they cease being customers for tax purposes.

5.2. Security Measures

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way.

For users utilizing our premium services via mobile platforms, payments are processed through Apple In-App Purchase or Google Play Billing.

Crucial Note: Mafa Short Film Ltd does NOT store, process, or have access to your credit card numbers or raw financial credentials on our internal servers. All such data is handled by the platform providers under their respective privacy policies. We only receive a secure "token" and transaction confirmation to unlock your content.