Privacy policy

How Astra Film collects and uses personal data.

This policy applies across the Astra Film platform: the website, accounts, personal schedule, ticket purchase and management, Astra Film Junior, group bookings, competitions, forms, newsletters and communication with our team.

Who processes your data

The data controller is Astra Film Foundation, based at 11 Piața Mică, Sibiu, Romania. For privacy questions or requests, email info@astrafilm.ro.

Data we collect

  • Account and sign-in: name, email address, cryptographically protected password, account verification status and, if you choose Google, the identifier and profile data supplied by Google;
  • Tickets and payments: contact details, selections, orders, tickets, payment and admission status, and invoice details requested by the buyer;
  • Astra Film Junior: school, locality, class, pupil totals by category, teachers or accompanying adults, and the responsible person's contact details. We do not request pupils' names for group bookings;
  • Competitions and participation: teacher, school, class and author details, uploaded work, guardian confirmations and information needed for judging and publication;
  • Forms and communication: data supplied through contact, volunteer, accreditation, newsletter and other registration forms;
  • Technical data: IP address, browser and device information, security logs and cookie preferences.

Why we use data

We use data to perform the service you request — account creation, booking, payment, ticket issue and management, programme and competition participation — and to meet legal duties, including financial records. We may also process data in our legitimate interests for platform security, abuse prevention, support and service improvement. Newsletters and optional cookies rely on consent, which may be withdrawn at any time.

Who receives data

We do not sell personal data. We send only the necessary data to providers helping us deliver the service: Eventbook for buyer records, booking, tickets, payment and invoicing; payment providers used within Eventbook's flow; Google when you choose Google sign-in; and hosting, email, security and analytics providers activated according to your choices. For partner programmes, data is shared only when participation requires it and the relevant form or rules explain this. Providers may process data outside the European Economic Area only under a lawful transfer mechanism and applicable safeguards.

How long we keep data

We retain data while an account or service is active and afterwards only as needed for requests, security, legal claims and statutory duties. Financial records are kept for the period required by law; competition entries and materials follow the rules for that edition; newsletter consent is kept until withdrawal. Data is deleted or anonymised when the applicable period ends.

Your rights

You may request access, correction, deletion, restriction, portability and objection to processing based on legitimate interests. You may withdraw consent without affecting earlier processing. Contact info@astrafilm.ro to exercise these rights. You may also complain to Romania's National Supervisory Authority for Personal Data Processing.

Children's data

For activities involving minors, data is submitted by a teacher or authorised representative who confirms that the required permissions are held. We request only the information needed for participation and avoid unnecessary collection of children's data.

Security and updates

We use technical and organisational measures to limit access and protect data. We may update this policy when services or legal requirements change; the current version and date remain available here.

Last updated: 24 September 2026.