Privacy Policy

1. Introduction

Celebration House Entertainment CC (Registration No. 2010/149237/23), trading as Film Resource Africa ("FRA", "we", "us", or "our"), is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use the Platform at film-resource-africa.com.

This policy is published in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) of the Republic of South Africa. By using the Platform, you consent to the processing of your personal information as described here.

2. Information Officer

FRA's Information Officer, as required under POPIA, is:

You may contact our Information Officer for any queries, complaints, or requests relating to your personal information.

3. What Information We Collect

3.1 Information you provide directly

• Name, surname, and professional title.
• Email address and phone number.
• Country of residence or registration.
• Company or organisation name (Business Members).
• Company registration number (Business Members).
• Profile information: biography, skills, portfolio links, filmography, showreel URLs.
• Project information: title, synopsis, genre, budget range, PRS submission data.
• Payment information (processed by PayFast; FRA does not store card details).
• Communications you send to FRA (email, contact form, support requests).

3.2 Information collected automatically

• IP address and approximate geographic location.
• Browser type, device type, and operating system.
• Pages visited, links clicked, and time spent on the Platform (via Vercel Analytics).
• Referral source (how you arrived at the Platform).

3.3 Information from third parties

We may receive information about you from payment providers (PayFast) confirming successful or failed transactions. We do not purchase or acquire personal information from data brokers.

4. How We Use Your Information

We process your personal information for the following lawful purposes:

• Service delivery: to create and manage your membership account, process payments, and provide access to the Platform.
• Representation and matching: to represent Individual Members in applications, match Members to relevant opportunities and counterparties, and facilitate introductions.
• Communication: to send transactional emails (receipts, placement notifications, account updates) and, with your consent, newsletters and editorial content.
• PRS scoring: to calculate and display Project Readiness Scores based on your project submissions.
• Directory: to display your profile in the members-only directory visible to other verified Members.
• Commission tracking: to record and invoice placements for Individual Members under clause 6 of the Terms.
• Legal compliance: to comply with applicable laws, including tax, financial record-keeping, and POPIA obligations.
• Platform improvement: to analyse aggregate usage patterns and improve the Platform.

5. Legal Basis for Processing

Under POPIA, we process your personal information on the following grounds:

• Contractual necessity: to fulfil our obligations under your membership agreement.
• Consent: for marketing communications (which you may withdraw at any time).
• Legal obligation: where required by South African law.
• Legitimate interest: for Platform analytics, fraud prevention, and security.

6. Sharing Your Information

We do not sell your personal information. We may share it with:

6.1 Service operators (operators under POPIA)

• Supabase Inc. — database hosting (USA; EU Standard Contractual Clauses apply).
• Resend Inc. — transactional email delivery.
• PayFast (Pty) Ltd — payment processing (South Africa, PCI-DSS compliant).
• Vercel Inc. — web hosting and analytics (USA; adequacy safeguards apply).

Each operator is bound by data processing agreements and may only process your information on our instructions for the purposes described in this policy.

6.2 Other Members and counterparties

Your profile information (as configured by you) is visible to other verified Members in the members-only directory. Project information with PRS scores may be shared with financiers and other counterparties as part of the marketplace matching function, subject to your visibility settings.

6.3 Legal and regulatory disclosures

We may disclose your information where required by law, a court order, or a competent regulatory authority.

7. Cross-Border Transfers

Some of our service operators are based outside South Africa. Where personal information is transferred across borders, FRA ensures that the recipient country or operator provides an adequate level of protection as required by POPIA section 72, through standard contractual clauses or other approved mechanisms.

8. Data Retention

• Active members: we retain your personal information for as long as your membership is active and for seven years thereafter for financial record-keeping purposes (as required by SARS).
• Newsletter subscribers: retained until you unsubscribe.
• Usage logs: anonymised after 90 days.
• Placement records: retained for seven years from the date of placement for commission and tax purposes.

9. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to our legal retention obligations.
• Objection: object to the processing of your information on grounds of legitimate interest.
• Withdraw consent: withdraw marketing consent at any time without affecting the lawfulness of prior processing.
• Complain: lodge a complaint with the Information Regulator of South Africa if you believe we have violated POPIA.

To exercise any of these rights, contact our Information Officer at hello@film-resource-africa.com. We will respond within 30 days as required by POPIA.

10. Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa:

11. Security

FRA implements appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure, including encrypted data transmission (TLS), access controls, and regular security reviews.

In the event of a security compromise that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA.

12. Cookies and Analytics

We use Vercel Analytics, a privacy-friendly analytics tool, which does not use cookies and does not track users across websites. Aggregate usage data is used solely to improve the Platform. No third-party advertising cookies are placed on the Platform.

13. Children

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you by email and publish the updated policy on the Platform. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Platform after the effective date of changes constitutes acceptance of the updated policy.

15. Contact