PRIVACY POLICY

MyCinema.ie - operated by access CINEMA ('the Provider') - respects users’ right to privacy and aims to be as open as possible about how data is used and stored.

Our policy is to respect and protect your privacy and we will never intentionally disclose individually identifiable information about our users to any third party without first receiving your permission.

All data is gathered and processed in accordance with Data Protection Legislation. “Data Protection Legislation” means the Data Protection (Ireland) Acts 1988 to 2018, the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and any other applicable law or regulation relating to the processing of Personal Data and to privacy, including the E-Privacy Directive 2002/58/EC and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (“E-Privacy Regulations”), as such legislation shall be supplemented, amended, revised or replaced from time to time.

Name and address of the controller

The organisation responsible for managing the privacy policy and for implementing GDPR and other data protection laws for MyCinema.ie is access CINEMA with registered office at:

Unit 3 Merchant's House

27-30 Merchant's Quay

Dublin 8

The Person appointed as contact person is:

Stephen McNeice

Telephone +353 1 679 4420

Email: support@mycinema.ie

  1. General information on data processing

MyCinema's policy is to only process your personal data to the extent that is necessary to provide a functional website and the content/services on offer.

Our server is hosted on a secure site provided by Rushlake Media, which is based in Germany. Visitors to our site should be aware that each time they visit a website there are two general levels of information about their visit that can be retained.

The first level comprises statistical and other analytical information collected on an aggregate and non-individual specific basis of all browsers who visit the site; the second is personal or particular information to a specific visitor who knowingly chooses to provide that information.

Throughout this website, you may have an opportunity to send us personal data, such as through the "Contact" pages or by setting up a user account. By choosing to participate in these, you will be providing us with some level of personal information relating to you.

This information will only be used by the Provider for:

(a) the purposes for which it was provided by the user

(b) verification purposes and statistical analysis

1.1 Legal basis for the processing of personal data

Insofar as the Provider obtains the consent of the data subject for processing of personal data, Article 6 (1a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is required to fulfil a contract to which the data subject is a party, Article 6 (1b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Article 6 (1c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Article 6 (1d) GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Article 6 (1f) GDPR serves as the legal basis for the processing.

1.2 Data erasure and storage duration

Your personal data will be erased or blocked as soon as the purpose of storage no longer applies. Storage can also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the Provider is subject. The data will also be blocked or erased if a storage period prescribed by the aforementioned regulations expires, unless there is a need to store the data for the conclusion or fulfilment of a contract.

  1. Uses of cookies

2.1 Description and scope of data processing

Statistical and analytical information and data can be collected through the standard operation of our Internet servers and logs, as well as through "cookies".

MyCinema uses cookies.

A “cookie” is a small text file containing a unique identification number that is transferred from a website to the hard drive of your computer so that the website may identify you and track your movements on the website, remember preferences you may have selected or where an area of a website requires login access. Cookies are also used to anonymously collect marketing data, mostly through Google Analytics.

Users should be aware that the Provider is unable to control the use of cookies or the resulting information by other third parties such as advertisers or parties hosting data for MyCinema.

Some elements of our website require that the calling browser can be identified even after changing pages. The following data are transmitted in the cookies:

Log-in information

Location of the user

2.2 Legal basis for data processing

The legal basis for the processing of personal data using cookies is Article 6 (1f) GDPR.

2.3 Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of our website for users. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser is recognised even after changing pages.

We require cookies for the following applications:

Access to your profile and rental library

Definition of a cinema you have selected or the one closest to your current location

The user data collected by technically necessary cookies are not used to create user profiles.

The legitimate interest in the processing of personal data according to Article 6f) GDPR also lies in this purpose.

2.4 Duration of storage

Cookies are stored on your computer and transmitted from there to our systems. Therefore, you have complete control over the duration of the storage. By changing the settings in the internet browser, you can deactivate the storage of cookies and erase stored cookies.

2.5 Objection option

One simple way to prevent the use of cookies is to activate the facility that is available in most web browsers that enables you to deny or accept cookies. Please be aware that certain cookies may be necessary in order to provide you with features such as the customised delivery of information – it may not be possible to use all of the functions of the VOD platform if cookies are disabled.

  1. Data use for provision of the VOD platform:

Every time MyCinema is accessed, some data and information are automatically collected from your computer system or device. That data is:

  • date and time of access
  • browser type/version
  • operating system
  • URL of previously visited website in the case of referral links
  • IP address of the user

The data is also stored in the system log files. This system log data is not stored with any other personal data of the user.

3.1 Legal basis for data processing

The legal basis for the temporary storage of the data and the log files is Article 6 (1f) GDPR.

3.2 Purpose of data processing

The temporary storage of your IP address system is necessary to enable delivery of the website to the user's device. For this reason, the IP address of the user must remain stored for the duration of the session.

The storage in log files takes place in order to ensure the functionality of the website. In addition, the data is used to optimise the website and to ensure the security of our IT systems. An evaluation of the data for marketing purposes does not take place in this context.

The legitimate interest in data processing according to Article 6 (1f) GDPR also lies in these purposes.

3.3 Duration of storage

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

When data is collected for the provision of the website’s service, that data is deleted when the session has ended.

If the data is stored in log files, it is typically deleted after seven days at the latest. Storage beyond this is possible. In any such cases, IP addresses of users are deleted or isolated so that it is no longer possible to assign to individual users.

  1. User accounts / registration

4.1 Description and scope of data processing

Many areas of the MyCinema website are accessible without a user account. However, an account is required to rent films. If you do choose to set up an account, the information collected will include:

  • Name (first name and surname)
  • Email address
  • Password

The password chosen and submitted by users cannot be viewed by access CINEMA or Rushlake Media.

You should ensure to keep your password confidential. If you become aware of anyone accessing your account without your permission, please immediately change the password on the website's ‘My Profile’ page.

The data is entered in an input mask and transmitted to our service provider and saved. Account data is not transferred to third parties.

The following data is also stored when a user registers for the first time:

  • Date and time of registration

4.2 Legal basis for data processing

Registration serves to fulfil a contract to which the user is a party or to carry out pre-contractual measures. The legal basis for processing the data is Article 6 (1b) GDPR.

4.3 Purpose of data processing

Registration required to fulfil a contract between the Provider and the user or to carry out pre-contractual measures.

Your registration on the VOD platform makes it possible to conclude a framework agreement for the use of the VOD platform and then to take advantage of individual video-on-demand offers. Further information on the concluded contracts can be found in our General Terms and Conditions.

4.4 Duration of storage

The data will be erased as soon as they are no longer required to achieve the purpose for which they were collected. This is the case for the data collected during registration to fulfil a contract or to carry out pre-contractual measures when the data are no longer required for the execution of the contract. Even after the contract has been concluded, it may be necessary to store the personal data of the contractual partner in order to meet contractual or legal obligations. Continuing obligations require the storage of personal data during the term of the contract.

4.5 Objection and removal option

You can cancel your account and/or change the stored data at any time. To do this, you can log into your account and make the desired changes or erase their account.

If the data is required to fulfil a contract or to carry out pre-contractual measures, the data can only be erased if there are no contractual or legal obligations to prevent erasure.

5. Contact form and email

5.1 Description and scope of data processing

Users of the VOD platform can use a contact form for electronic contact. If you make use of this option, the data entered in the contact form will be transmitted to and stored by access CINEMA. This data includes:

  • Name
  • E-mail address
  • Message text

By submitting the contact form, the following data is also saved:

  • Time of contact

When you send a message via the contact form or by email, your personal data transmitted with the e-mail will be saved.

The data will not be passed on to third parties. The data will only be used to process communication between the Provider and the user.

5.2 Legal basis for data processing

The legal basis for processing the data transmitted in the course of sending an e-mail is Article 6 (1f) GDPR. If the aim of the e-mail contact is to conclude a contract, the additional legal basis for processing is Article 6 (1b) GDPR.

5.3 Purpose of data processing

Processing the personal data from the contact form is only used to process the contact. If you contact MyCinema by e-mail, this is also the legitimate interest in processing the data.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of access CINEMA and Rushlake Media’s IT systems.

5.4 Duration of storage

The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and the data that are transmitted by e-mail, this is the case when the respective communication with the user has ended. The communication is ended when it can be inferred from the circumstances that the matter in question has been finally clarified or resolved.

The additional personal data collected during the sending process will be erased after a period of seven days at the latest.

5.5 Objection and removal option

You can request the erasure of your personal data at any time. You can request this by contacting support@mycinema.ie. In this case, all personal data that was stored in the course of making contact will be erased. Communication can then not be continued.

6. Formation of customer segments

6.1 Description and scope of data processing

The Provider can use the data stored in the customer profiles to classify users of the VOD platform into certain customer segments. The assignment is based solely on the following data:

• Data that the user provided when registering

• Data generated through the use of the VOD platform

• Data collected through the redemption of coupons / vouchers

6.2 Legal basis of data processing

The legal basis for processing the data with the consent of the user is Article 6a GDPR.

6.3 Purpose of data processing

The processing of personal data enables the Provider to continuously adapt and improve its services in line with these interests and thus to offer you a better user experience. In addition, the processing of personal data enables users to be sent a newsletter tailored to their interests.

6.4 Duration of storage

The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for the data collected during registration to fulfil a contract or to carry out pre-contractual measures when the data are no longer required for the execution of the contract. Even after the contract has been concluded, it may be necessary to store personal data of the contractual partner in order to meet contractual or legal obligations. Continuing obligations require the storage of personal data during the term of the contract.

6.5 Objection and removal option

You can cancel your account at any time. To do this, you can log into your account and erase your account.

If the data is required to fulfil a contract or to carry out pre-contractual measures, the data can only be erased if there are no contractual or legal obligations to prevent erasure.

7. Third parties

The following section details the third-party apps and organisations

7.1 Partner cinemas

access CINEMA works with a number of partner cinemas to offer MyCinema. You can choose which cinema you’d like to support when setting up an account and at any time via the ‘cinemas’ tab on the main MyCinema website.

Partner cinemas may offer tailored, venue-specific versions of the website to their users. These are administered by access CINEMA with the permission of the partner cinemas.

Managers at partner cinemas will have access to limited data, such as the number of MyCinema users who have chosen to support them. However, they will have no access to the personal data of users. They are also unable to offer technical support to users.

7.2 PayPal

Payment by the user is required to access content on the VOD platform. Payment data, e.g. account information, is entered into an input form and sent to a payment service provider by clicking on a button. The transaction is completed on the payment service provider’s website.

MyCinema uses PayPal to process payments.

PayPal is a payment service offered by PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg. The following data is collected during payment processing via PayPal and transmitted to PayPal:

  • Name
  • Email address
  • Address
  • Credit / debit card or bank details

PayPal's data protection declaration can be accessed at the following link: https://www.paypal.com/ie/webapps/mpp/ua/privacy-full  

access CINEMA does not retain any financial information such as credit card numbers.

7.3 Mailchimp

We may occasionally send promotional emails or newsletters. These will only be sent to users who have chosen to ‘opt in’ when setting up an account.

You may opt-out of these emails at any time on their ‘My Profile’ page or by clicking the ‘unsubscribe’ link included at the bottom or any MyCinema promotional emails.

MyCinema uses Mailchimp to manage and send email newsletters.

Mailchimp is a marketing platform managed in the EU by Intuit Data Protection Administration, 7 rue de la Paix 75002 Paris, France.

The following information is stored by Mailchimp when users ‘opt in’ to newsletters or promotional emails:

  • Name
  • Email address

Mailchimp’s data protection policy can be accessed at the following link: https://www.intuit.com/privacy/statement/

7.4 Google Analytics

This website uses Google Analytics, a web analysis service from Google Inc. (“Google”). It is used in the “Universal Analytics” operating mode. This makes it possible to assign data and user behaviour to a pseudonymous user ID across multiple devices and analyse them.

Google Analytics uses so-called “cookies,” text files that are stored on the user’s computer and enable an analysis of the user’s website use. The information generated by the cookie about the use of this website is usually transmitted to a Google server in the USA and stored there. If IP anonymisation is activated on this website, the IP address of the user will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The full IP address will only be sent to a Google server in the USA and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate the use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by a browser as part of Google Analytics will not be merged with other Google data.

This website uses Google Analytics with the code extension “anonymizeIP” in order to ensure an anonymous collection of IP addresses (IP masking).

The data collected via Google Analytics is automatically erased after 14 months. Data whose retention period has expired are automatically erased once a month.

More information about the terms of use and data protection at Google Analytics is available at https://policies.google.com/technologies/partner-sites

You can prevent the storage of cookies by setting your browser software accordingly. However, we note that in this case not all functions of this website can be used to their full extent.

You can also prevent Google from collecting the data generated by the cookie and relating to the user’s use of the website (including their IP address) and from processing this data by downloading and installing a browser add-on to deactivate Google Analytics. The browser add-on can be downloaded free of charge from https://tools.google.com/dlpage/gaoptout?hl=en-GB

Furthermore, using an opt-out cookie, you can prevent their data from being recorded when visiting this website. This cookie must be set on all devices used in order to prevent collection by Universal Analytics. The opt-out cookie for Google Chrome can be found here, and will be installed on the device currently being used: https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh?hl=en   

8.  Rights of the data subject

If users’ personal data is processed, they are “data subjects” within the meaning of the GDPR. The data subject has the following rights towards the controller:

8.1 Right of access

Data subjects can request confirmation from the controller as to whether personal data relating to them will be processed. If this is the case, data subjects can request information about the following:

• Purposes for which personal data are processed;

• Categories of the processed personal data;

• Recipients or categories of recipients to whom the personal data have been or will be disclosed;

• The planned duration of the storage of personal data or the criteria for determining the duration of storage;

• The existence of a right to rectification or erasure of personal data, a right to restrict processing by the controller or a right to object to processing;

• The existence of a right to lodge a complaint with a supervisory authority;

• All information about the origin of the data if the personal data were not collected from the person concerned;

• A transfer of personal data to a third country or an international organisation and the appropriate guarantees according to Article 46 GDPR

8.2 Right to rectification

Data subjects have the right to rectification and/or completion of the processed personal data concerning them if they are incorrect or incomplete. The controller will carry out the rectification immediately.

8.3 Right to restriction

Under the following conditions, data subjects can request the controller to restrict the processing of their personal data:

• If the data subject denies the accuracy of the personal data concerning them for a period that enables the controller to check the accuracy of the personal data;

• If the processing of personal data is unlawful and the data subject refuses to erase the personal data and instead requests that the use of the personal data be restricted;

• If the controller no longer needs the personal data for the purposes of data processing, but the data subject needs them to assert, exercise or defend legal claims;

• If the data subject has lodged an objection to the processing in accordance with Article 21 (1 GDPR) and it has not yet been determined whether the controller's legitimate reasons outweigh the data subject's reasons

In the event of a restriction on the processing of personal data, these – apart from storage – may only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a member state. If the restriction has been lifted according to the above conditions, the data subject is informed by the controller before the restriction is lifted.

8.4 Right to erasure

8.4.1 Erasure obligation

Data subjects can request the controller to erase their personal data immediately. The controller is obliged to erase the data immediately if one of the following cases applies:

• The personal data of the data subject are no longer necessary for the purposes for which they were collected or processed;

• The data subject revokes their consent on which the processing is based in accordance with Article 6 (1a) or Article 9 (2a) GDPR and there is no other legal basis for the processing;

• The data subject objects to the processing in accordance with Article 21 (1) GDPR and there are no overriding legitimate reasons for the processing;

• The data subject objects to the processing in accordance with Article 21 (2) GDPR;

• The personal data of the data subject were processed unlawfully;

• The erasure of personal data is necessary to fulfil a legal obligation under Union law or the law of the member states to which the controller is subject;

• The data subject's personal data were collected in relation to information society services offered in accordance with Article 8 (1) GDPR.

8.4.2 Information to third parties

If the controller has made the personal data of the data subject public and is obliged to erase them in accordance with Article 17 (1) GDPR, the controller shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, in order inform those responsible for the data processing who process the personal data that the data subject has asked them to erase all links to this personal data or copies or replications of this personal data.

8.4.3 Exceptions

The right to erasure does not exist if the processing is necessary:

• To exercise the right to freedom of expression and information;

• To fulfil a legal obligation that requires processing under the law of the Union or of the member states to which the controller is subject, or to perform a task that is in the public interest or in the exercise of official authority that has been transferred to the controller

• For reasons of public interest in the area of public health according to Article 9 (2h and i) and Art 9 (3) GDPR;

• To assert, exercise or defend legal claims.

8.5 Right to be informed

If the data subject has asserted the right to rectify, restrict or erase the processing of the personal data against the controller, the controller is obliged to notify all recipients to whom the personal data in question has been disclosed of this rectification or erasure of the data or the restriction of processing. This does not apply if the notification proves impossible or involves a disproportionate effort. The data subject has the right to be informed about the recipients of the notification.

8.6 Right to data portability

The data subject has the right to receive the personal data relating to them, which they have provided to the controller, in a structured, common and machine-readable form. The data subject also has the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, if the processing is based on consent in accordance with Article 6 (1a) GDPR or Article 9 (2a) GDPR or on a contract in accordance with Article 6 (1b) GDPR and the processing is carried out using automated procedures.

In exercising this right, the data subject also has the right to have the personal data transmitted directly from one controller to another controller, as far as this is technically feasible. This must not impair the freedoms and rights of other people.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task that is in the public interest or takes place in the exercise of public authority that has been transferred to the controller.

8.7 Right to object

The data subject has the right, for reasons that arise from their particular situation, to object at any time to the processing of personal data relating to them based on Article 6 (1e or f) GDPR. This also applies to profiling based on this provision.

In the event of an objection, the controller will no longer process the personal data unless it can demonstrate compelling legitimate reasons for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

The data subject has the option, in connection with the use of information society services, regardless of Directive 2000/58/EC, to exercise their right of objection by means of automated procedures.

8.8 Right to withdraw consent under data protection law

The data subject has the right to revoke their declaration of consent under data protection law at any time. The revocation does not affect the legality of the data processing carried out based on the consent before the revocation.

8.9 Right to lodge a complaint with a supervisory authority

Without prejudice to other legal remedies, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their place of residence, their place of work or the place of the alleged infringement, if they are of the opinion that the processing of their personal data violates the GDPR. The supervisory authority to which the complaint was lodged informs the complainant about the status and the results of the complaint, including the possibility of a judicial remedy in accordance with Article 78 GDPR.

9. Changes to this privacy policy

access CINEMA reserves the right to change this privacy policy. The current version of the privacy policy is always available on the VOD platform at www.mycinema.ie/privacy.

10. Contact

If you have any questions about your personal data or our privacy policy, you can use the contact form here: https://mycinema.ie/contact_forms/new

We will respond as quickly as possible. Our office operating hours are 9:30 am to 5:30 pm, Monday - Friday.

You can change or update the information associated with your account at any time on the ‘My Account’ section of the MyCinema website.

You can permanently delete your account and associated data on your ‘My Account’ page. This process cannot be undone.

If you need assistance updating or deleting your account, please contact: support@mycinema.ie