PRIVACY POLICY

POLICY GOVERNING PERSONAL DATA PROCESSING (UK GDPR COMPLIANT)
Last Revised: 01/01/2026

Data Controller: Mafa Short Film Ltd (Contact: mafa@mafashortfilm.tv)

1.1. Data Controller Identification

Mafa Short Film Ltd, a UK-registered entity, acts as the Data Controller.

1.2. Compliance

This Policy is compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We process Personal Data under the following Lawful Bases for the purposes stated:

• Identity Data (Name, Email): Account management and contract fulfillment. (Lawful Basis: Performance of Contract)

• Transaction Data (Billing, Subscription Status): Processing recurring payments and financial compliance. (Lawful Basis: Performance of Contract & Legal Obligation)

• Usage Data (Viewing history, IP Address, Device Data): Service delivery, personalization, security, and executing geographical licensing restrictions. (Lawful Basis: Legitimate Interests)

3.1. Recipients of Data: We share data only with trusted third-party processors necessary for core business functions (e.g., payment gateways, cloud hosting providers).

3.2. International Transfer Safeguards: Given our global user base, data may be transferred outside the UK/EEA. Such transfers are protected by implementing Standard Contractual Clauses (SCCs) or reliance on Adequacy Decisions, ensuring data protection standards equivalent to those under UK GDPR.

As a Data Subject, you are entitled to the following rights, exercisable by written notice to mafa@mafashortfilm.tv:

• 1. Right of Access: To request confirmation and a copy of the data we hold about You.
• 2. Right to Rectification: To have incomplete or inaccurate data corrected.
• 3. Right to Erasure ('Right to be Forgotten'): To request the deletion of data where there is no overriding legal basis for retention.
• 4. Right to Object: To object to processing based on our legitimate interests (e.g., direct marketing).
• 5. Right to Data Portability: To receive your Personal Data in a machine-readable format.

5.1. Data Retention: We retain Personal Data only for the necessary duration to fulfill the purposes collected, and for a minimum of six (6) years for financial records as required by UK law.

5.2. Supervisory Authority: Should you have any unresolved privacy concerns, you retain the right to lodge a formal complaint with the Information Commissioner's Office (ICO), the UK supervisory authority.

We collect the necessary information to process your subscriptions through Apple's In-App Purchase system and Google Play Billing service.

Please note that we do not store or process your credit card or financial details on our servers. All financial transactions are securely handled by the respective platforms (Apple Inc. or Google LLC). We only receive confirmation of your subscription status and a unique transaction ID to enable access to premium content across your devices.