Place

Request Demo

Privacy Policy

Effective date: August 26th, 2026

1. General information

Place SRL ("Place," "we," "us," or "our") operates a marketplace that brings independent films to cinemas worldwide. Our mission is that every film deserves a theatrical release, made possible by connecting Filmmakers, Exhibitors, and Cinephiles directly, while prioritizing the privacy and security of your data. We are committed to fostering a vibrant film community and to complying with applicable privacy laws in the European Economic Area, the United Kingdom, Switzerland, the United States (including applicable state privacy statutes), and Canada.

This Privacy Policy ("Policy") outlines what Personal Data Place collects, why we collect it, how we collect it, protect, and retain it, whether we share it with third parties and which ones, and the rights you have under applicable privacy laws and how to exercise them. It applies to our website, our mobile application, and our platform (collectively, our "Services"), and to their users, including Filmmakers, Exhibitors, and Cinephiles who create an account to use our Services ("Customers"), and individuals who access our Services without creating an account ("Visitors") (collectively, "Users," "you," or "your"). By using our Services, you acknowledge and agree to this Policy.

This Policy incorporates our Terms of Service. If you do not agree with the terms of this Policy, please discontinue your use of our Services.

2. Definitions

When we use the following words in this Policy, this is what we mean:

  • “Data Protection Laws”: Collectively, (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR"), UK GDPR and any implementing or supplementary legislation, and (ii) all U.S. federal or state privacy statutes in force during the Term together with other national laws governing the Processing of Personal Data. If the User is a UK entity, any reference to the "GDPR" shall be interpreted to include a reference to the UK GDPR.

  • “Personal Data": For purposes of this Policy, Personal Data (also called personal information under the California Consumer Privacy Act/Privacy Rights Act and similar U.S. state laws) means any information that relates to an identified or identifiable natural person or is reasonably capable of being linked to a particular consumer or household, as set out in the EU GDPR, UK GDPR, Canada's PIPEDA, the revised Swiss Federal Act on Data Protection, and all applicable U.S. federal or state privacy statutes. Personal Data may include, for example, your name, email address, username, IP address, authentication tokens, payment and payout details, or content you upload to your profile. A full description of the Personal Data we collect is set out in Section 3.

  • "Service Data": Any data relating to the use, support, and/or operation of the Services, which is collected directly by Place from the User's use of the Services. Service Data is used for Place's security, billing, analytics, or product-improvement purposes. Service Data is not Personal Data.

3. Personal Data We Collect

We collect the following categories of Personal Data, depending on the type of User you are.

Visitors

We collect the following Personal Data from Visitors:

  • Technical and device data: IP address, approximate location derived from your IP address (such as country and region), device type, operating system, browser type and version, language settings, time zone, referrer URL, pages viewed, and interactions with our Services.

  • Cookie and similar-technology data: session, analytics, and preference cookies and similar technologies that we place on your device when you access our Services, subject to your consent where required by law. You can manage or withdraw your consent at any time through the cookie settings available on our Services. 

  • Contact data you provide voluntarily: the email address and any other information you submit when you request a demo, join a waitlist, or otherwise contact us through our Services.

Cinephiles

We collect the following Personal Data from Cinephiles, in addition to the data listed above under Visitors:

  • Account data: email address, password (stored in hashed form), username, age or age confirmation, and, where applicable, the name of the organization associated with your account.

  • Profile and social content: the profile information, posts, uploaded creative work, messages, connections, and follows you create or share through our Services.

  • Transaction data: ticket purchase records, billing address, tax status, and the identifier of your wallet with our payment processor, Mangopay.

Filmmakers

We collect the following Personal Data from Filmmakers, in addition to the data listed above under Visitors:

  • Account data: email address, password (stored in hashed form), username, age or age confirmation, and, where applicable, the name of the organization associated with your account.

  • Business and payout data: legal or business name, contact details, tax or VAT registration number, payout details required by Mangopay, and any identity documents required for Mangopay's know-your-customer checks.

  • Profile and social content: the profile information, posts, uploaded marketing and brand content, messages, connections, and follows you create or share through our Services.

  • Transaction data: film submission payment records, payout records, billing address, tax status, and the identifier of your wallet with Mangopay.

Exhibitors

We collect the following Personal Data from Exhibitors, in addition to the data listed above under Visitors:

  • Account data: email address, password (stored in hashed form), username, age or age confirmation, and, where applicable, the name of the organization associated with your account.

  • Business and payout data: venue name, venue address, tax or VAT registration number, subscription payment method, payout details required by Mangopay, and any identity documents required for Mangopay's know-your-customer checks.

  • Transaction data: subscription payment records, payout records, billing address, tax status, and the identifier of your wallet with Mangopay.

4. Why We Collect Your Personal Data

Place processes Personal Data for the following purposes.

To operate our Services

We process Personal Data to run the marketplace, including matching Filmmakers' films with Exhibitors based on Exhibitor criteria, processing Bookings, delivering DCP Files and KDMs, operating your profile and social interactions with other Users, and providing customer support. We also process Personal Data to operate and secure our website, mobile application, and platform, including for analytics, performance monitoring, and abuse prevention.

To process payments and transactions

We process Personal Data, together with our payment processor Mangopay, to process ticket purchases, film submission fees, Exhibitor subscriptions, revenue splits, and payouts, and to carry out the identity checks required for payout accounts.

To communicate with you

We process Personal Data to send you information about your account and the Services, including booking confirmations, payout notifications, DCP transfer status, subscription renewals, security alerts, and responses to your inquiries. Where you have consented, we also send you marketing communications, product updates, and responses to your demo requests, waitlist signups, or other voluntary contact.

To secure our Services and prevent abuse

We process Personal Data to detect, prevent, and investigate fraud, abuse, and security incidents, to protect the integrity of DCP Files, DKDMs, and KDMs, and to enforce our Terms of Service.

To improve our Services

We process Personal Data to analyze how Users and Visitors interact with our Services, to measure their performance and reliability, and to develop new features.

To comply with legal obligations and protect our rights

We process Personal Data to comply with applicable law, including bookkeeping, tax, export control, and sanctions requirements, to respond to lawful requests from public authorities, and to establish, exercise, or defend legal claims.

Legal Bases

Place processes Personal Data only where a valid legal ground applies under each privacy regime that governs our Services. The legal bases we rely on are:

  • Performance of a Contract: We process your Personal Data to provide, maintain, and support the Services you have requested under our Terms of Service.

  • Legitimate Interests: We process Personal Data to secure our Services, prevent fraud, generate aggregate analytics, and improve our Services, where these interests are not outweighed by your privacy rights.

  • Consent: We rely on your opt-in consent for non-essential cookies, marketing communications, and any other processing that requires consent under Data Protection Laws. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

  • Legal Obligations: We retain and disclose Personal Data as necessary to comply with bookkeeping, tax, export control, and sanctions rules, court orders, and other legal duties.

  • Protection of Vital Interests: In rare cases, we may process Personal Data to protect an individual's vital interests, such as preventing serious harm or responding to an emergency.

5. How We Collect Your Personal Data

We collect your Personal Data in the following ways.

Provided by you

We collect Personal Data that you provide to us directly. This includes information you submit when you create an account, complete your profile, upload films or marketing content, submit a film for distribution, subscribe to our Services, purchase a ticket, complete identity verification for payout accounts, message another User, request a demo, contact our support team, or otherwise interact with our Services.

Through the use of our Services

We collect Personal Data automatically when you access or use our Services, including your IP address, approximate location derived from your IP address, device type, operating system, browser type and version, language settings, time zone, referrer URL, pages viewed, and interactions with our Services. Sometimes we process this Personal Data not on our own initiative but to comply with a legal obligation, for example when we retain it for a longer period to meet a legal retention requirement.

Obtained from third parties

We may receive Personal Data about you from third parties in the following cases:

  • Visitors: we may receive information about you from third parties in the context of the cookies and similar technologies we use on our Services.

  • Customers: we may receive Personal Data about you from our payment processor Mangopay, including the results of identity verification and anti-fraud checks required for payout accounts.

Derived

Some Personal Data we do not receive directly but derive from information already in our possession. For example, we may derive matching signals from the criteria you submit as a Filmmaker or Exhibitor, or inferences about your engagement with our Services based on Usage Data. For these purposes, "Usage Data" means information and metadata collected about how a User interacts with our Services, such as feature usage and platform performance.

Public sources

We may also receive Personal Data through public sources, such as information from a public LinkedIn profile or a website.

If you are a Filmmaker and you upload a film to our Services, that film and its accompanying materials may include Personal Data of third parties such as your cast, crew, and other rights holders. As set out in our Terms of Service, you are responsible for obtaining all necessary consents from those third parties before uploading.

In principle, you are under no obligation to provide any Personal Data to us. However, refusal to supply certain information could have a negative effect on your experience of, or the functionality available to you through, our Services. If the provision of certain Personal Data is a legal or contractual obligation or an essential requirement for entering into an agreement with us, we will inform you separately, including of the possible consequences of not providing it.

6. How We Protect Your Personal Data

Protecting your Personal Data is important to us. We implement reasonable technical and organizational measures to protect and secure the Personal Data we process, in order to prevent violations of its confidentiality, integrity, and availability. These include:

  • Data in transit: All traffic between your browser or device and our servers is protected with industry-standard TLS encryption.

  • Data at rest: Personal Data stored on our infrastructure is encrypted using the encryption features provided by Amazon Web Services.

  • Access controls: We apply role-based access controls and the principle of least privilege, so that only authorized personnel can access Personal Data, and we require multi-factor authentication on administrative accounts.

  • Certified hosting infrastructure: We host our Services on Amazon Web Services, whose data centers hold certifications including SOC 2 and ISO 27001.

  • Payment security: Payments are processed by Mangopay, which is certified to PCI DSS Level 1. We do not store full payment card details on our own systems.

  • Protection of film content: As set out in our Terms of Service, DCP Files uploaded by Filmmakers are encrypted and can only be played back on a Cinema Server that has been issued a valid KDM. We apply cryptographic controls to DCP Files, DKDMs, and KDMs to prevent unauthorized copying, extraction, or playback.

  • Breach notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Article 33 of the GDPR, and we will notify affected individuals without undue delay where required by Article 34 of the GDPR.

  • Your role: Please keep your account credentials confidential, enable multi-factor authentication where we offer it, and let us know if any of your Personal Data is incorrect so we can update it.

Our Services depend on Infrastructure Providers, including Amazon Web Services, Mangopay, and Iyuno. While we select these providers with care and require them to apply appropriate protections, we cannot guarantee uninterrupted availability, security, or performance of their systems, and interruptions, delays, or data incidents may occur that are caused by them or by events beyond our reasonable control.

7. How Long We Retain Your Personal Data

In general, Place does not keep Personal Data for longer than is necessary in relation to the purposes for which we process it. The specific retention periods we apply are the following:

  • Account and access data: for as long as your account is active, and up to 2 years after account closure.

  • Transaction data (payments, invoices, payouts, ticket purchases, and tax records): 10 years from the end of the financial year in which the transaction took place, as required by Romanian tax and accounting law.

  • Contact and communication data: up to 2 years after your last contact or interaction with us.

  • Marketing and prospect data: until you withdraw your consent, or up to 2 years after your last interaction with us.

  • Profile and social content (Cinephiles, Filmmakers, and Exhibitors): for as long as your account is active. On account deletion, this content is deleted within 30 days.

  • DCP Files and DKDMs: for as long as the Filmmaker keeps the film available on our Services. Once the film is removed, the DCP File and DKDM are deleted within 30 days.

  • KDMs and Booking records: for the duration of the Release Window and up to 2 years thereafter, for audit and dispute purposes.

  • Legal or dispute data: as long as necessary for legal proceedings or compliance.

There may be exceptions to these general retention terms. In some cases, shorter retention periods could apply, for example if you exercise certain privacy rights. In other cases, longer retention periods could apply, for example where we have to process Personal Data for a longer period:

  • Retention obligation: to comply with a minimum retention period or other legal obligation to which Place is subject under Romanian law, EU law, or the law of another jurisdiction that applies to us;

  • Procedure: where Personal Data is necessary in relation to a legal procedure; or

  • Consent: where you have given consent for a longer retention period.

8. How We Share Your Personal Data

We only share your Personal Data with third parties if:

  • This is necessary for the provision of a service or the involvement of the third party. Sub-contractors, for example, will in principle only get access to the Personal Data that they require for their part of the service.

  • The persons within the third party that have access to the Personal Data are under an obligation to treat the Personal Data confidentially. Where necessary, this is also contractually agreed upon.

  • The third party is obliged to comply with the Data Protection Laws applicable to us, including the GDPR, UK GDPR, PIPEDA, the revised Swiss Federal Act on Data Protection, and all applicable U.S. federal and state privacy statutes. This includes that the party is obliged to ensure appropriate technical and organizational security measures, and that any transfer of Personal Data to countries outside the European Economic Area ("EEA") is adequately legitimized, as further described in Section 9.

We may share your Personal Data on a need-to-know basis with the parties listed below. In this context, "need-to-know" means that a party only gets access to Personal Data if and insofar as this is required for the professional service provided by that party.

Authorized Place personnel

Members of our team who are involved with the processing activity concerned, such as the members of our customer support team you are in contact with.

Service providers and sub-contractors

Authorized personnel employed by our Infrastructure Providers and other sub-contractors that we engage to provide the Services, including:

  • Amazon Web Services, the provider of our hosting environment;

  • Mangopay, our payment processor, which processes payments and payouts and performs identity verification and anti-fraud checks;

  • Iyuno, our subtitles and dubbing partner, which processes Subtitle Generation and Dubbing Generation on request of Exhibitors; and

  • KDM generation partners, which carry out KDM Generation on behalf of Filmmakers.

Other Users of our Services

In connection with the core functions of the Services, we share your Personal Data with other Users, for example:

  • We share Booking and payout information between the relevant Filmmaker and Exhibitor;

  • We share your profile, posts, and other social content with the Users to whom you have chosen to display it in accordance with your privacy and sharing settings; and

  • We share ticketing information with the Exhibitor whose Screening you have purchased a ticket to.

Authorized government institutions

Such as courts, police, and law enforcement agencies. We may release information about you, including your IP address, when we are legally required to do so, at the request of governmental institutions conducting an investigation or to verify or enforce compliance with the policies governing our Services and applicable laws. We may also disclose such information whenever we believe disclosure is necessary to protect the rights, property, or safety of Place or any of our business partners, Users, or others.

Recipients of aggregated statistics

We may also disclose non-identifying, aggregated statistics to third parties for a variety of purposes, including describing our Services to prospective partners and other third parties. Examples of such non-personal data include the number of Users who visited our Services during a specific time period.

Buyer or successor in a business transfer

We may transfer or provide your Personal Data to a buyer or potential buyer in the event of a merger or acquisition (potential or prospective) of all or part of our business or assets. In the event of such a transfer, we will take all steps reasonably expected of us to ensure that the receiving party processes your Personal Data in accordance with this Policy.

9. International Data Transfers

Transfers outside the EEA and UK

Place is established in Romania and processes your Personal Data primarily within the European Economic Area ("EEA"). However, certain of our Infrastructure Providers, as described in Section 8, are located in or operate from countries outside the EEA and the United Kingdom (the "UK") ("Third Countries"), including the United States. As a result, we may transfer your Personal Data to Third Countries as part of the operation of our Services. Any such transfer takes place in compliance with Chapter V of the GDPR and any additional recommendation or decision issued in this regard by the European Data Protection Board ("EDPB"), the European Commission, or other competent authority or body under the applicable laws.

If you are a resident of a U.S. state with comprehensive privacy laws, including California, you may have additional rights. Please see Section 10 for further details.

Legitimization of transfers outside the EEA and UK

Transfers of your Personal Data to a country outside the EEA may in the first place be legitimized based on a so-called adequacy decision. This is a decision in which the European Commission states that a certain country offers a level of data protection similar to the GDPR. An overview of the current adequacy decisions of the European Commission is available on the European Commission's website. The transfer of your Personal Data from the UK to a third party outside the UK may primarily be legitimized based on an adequacy regulation of the UK government.

If we transfer Personal Data to Third Countries to which no adequacy decision or adequacy regulation applies, we will conclude the applicable version of the model clauses to safeguard data protection as published by the European Commission, so-called standard contractual clauses ("Transfer SCCs"). If deemed required under the applicable law, additional measures will be taken. This may concern technical, organizational, or contractual measures. Where the UK GDPR is applicable, a UK Addendum will be added to the Transfer SCCs, as required by UK laws and regulations.

Further information on our legitimization of data transfers to Third Countries will be provided upon your request. For further information on this, please contact us at evelynne@place.com.

10. Your Privacy Rights

In relation to the processing of your Personal Data by Place, you have the following privacy rights:

Right of access

This concerns the right to request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you. We will then also provide further specifics of our processing, for example the purposes for which we process the Personal Data, where we obtained it, and with whom we share it.

Right to rectification

This concerns the right to request rectification of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate Personal Data corrected.

Right to erasure

This concerns the right to request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where: (i) the Personal Data is no longer necessary; (ii) you have objected to the processing; (iii) the Personal Data has been unlawfully processed; (iv) the Personal Data has to be erased on the basis of a legal requirement; or (v) the Personal Data was collected in relation to the offering of information society services. We do not have to honour such a request in all cases, for example where we are required to retain the Personal Data under Section 7.

Right to object

This concerns the right to object to the processing of your Personal Data where we are relying on Legitimate Interests as our legal basis. Where the processing takes place for direct marketing purposes, we will always honour an objection. For processing for other purposes, we will also cease processing, unless we have compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or that are related to the establishment, exercise, or defence of a legal claim. Where this is the case, we will inform you of those grounds and of how we have balanced them.

Right to restriction

The right to restriction of processing means that Place will continue to store your Personal Data at your request but may in principle not do anything further with it. In short, this right can be exercised when Place does not have (or no longer has) any legal grounds for the processing, or if the legal grounds are under discussion.

Right to data portability

This concerns the right, where the processing is based on your consent or on a contract and is carried out by automated means, to receive the Personal Data you have provided to us in a structured, commonly used, and machine-readable format, and to have that Personal Data transmitted to another controller where technically feasible.

Right to withdraw consent

This concerns the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint

This concerns the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or where an alleged infringement took place. Since Place is established in Romania, the competent supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), whose contact details are available at www.dataprotection.ro. We would appreciate the chance to address any concerns before you approach a supervisory authority, so please contact us beforehand.

Additional rights under U.S. state privacy laws

If you are a resident of a U.S. state with comprehensive privacy laws, including California, Colorado, Virginia, or Connecticut, you may have additional rights, including the right to opt out of the "sale" or "sharing" of your Personal Data, the right not to be discriminated against for exercising your privacy rights, and, in some states, the right to appeal a denied privacy request. Place does not sell your Personal Data, and does not share it for cross-context behavioral advertising. Should our practices change, you will retain these rights, and you may request additional disclosures about our practices at any time.

How to exercise your rights

You can exercise the privacy rights above free of charge by contacting us at evelynne@place.com. If requests are manifestly unfounded or excessive, in particular because of their repetitive character, we have the right to either charge a reasonable fee or refuse to comply with the request. We may request specific information to help us confirm your identity before we further respond to a privacy request. We will provide information about the follow-up of your request without undue delay, and in principle within one month of receipt. Depending on the complexity of the request and the number of requests, this period can be extended by another two months.

11. Children's Data

Access to our Services is subject to minimum age requirements set out in our Terms of Service. Cinephiles must be at least 16 years old, or the age of majority in their jurisdiction. If you are under 16, you must have your parent or legal guardian's permission to use our Services as a Cinephile. Filmmakers and Exhibitors must be at least 18 years old, or the age of majority in their jurisdiction.

We do not knowingly collect or solicit Personal Data from anyone below these minimum ages. By using our Services, you represent that you meet the minimum age applicable to your use of the Services, as set out above. If we discover that we have collected Personal Data from a Cinephile under 16 without verifiable parental or guardian consent, or from a Filmmaker or Exhibitor under 18, we will promptly delete that information. If you believe we may have collected such data, please contact us at evelynne@place.com.

12. Changes to This Policy

Place reserves the right to update or revise this Policy to reflect changes in our practices, legal requirements, or the Services themselves. We will post any revised Policy at www.place.com/privacy and indicate the "Effective" date at the top of the document. For material changes that reduce your rights or expand our processing purposes, we will provide at least thirty (30) days' advance notice by email or through the Services. Your continued use of the Services after the new Policy takes effect constitutes acceptance of the revised Policy.

13. Entire Agreement

This Policy, together with the Terms of Service, constitutes the entire agreement between you and Place regarding privacy policy and data protection in connection with the Services.