Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is Signal Pictures, 19, Rue Guillaume Schneider, L-2522 Luxembourg (Limpertsberg), Luxembourg, a JEL Mini-Entreprise of the Lycée des Arts et Métiers. E-mail: contact@signalpictures.lu, telephone: +352 691 302 121. We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR; all data protection requests may be sent to the e-mail address above.

2. Categories of personal data

• Identification and contact data: name, e-mail address, telephone number, company or organisation.
• Project data: information and files you provide about your project (dates, location, budget, descriptions, scripts, briefs).
• Client account data: login credentials, billing and delivery addresses, offers, electronic signatures, invoices, payment status, documents and messages exchanged in the client area.
• Technical data: IP address, browser and device information, date and time of access, pages visited (server log files).

3. Purposes and legal bases

• Answering contact and project requests and preparing offers: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(a) GDPR (your consent given in our forms).
• Performing our contract: production, delivery, sharing of documents and deliverables, communication with your project manager and support: Art. 6(1)(b) GDPR.
• Invoicing, accounting and tax obligations: Art. 6(1)(c) GDPR.
• Operating and securing the website and client area (log files, essential cookies): Art. 6(1)(f) GDPR, based on our legitimate interest in a secure and functioning website.

We process your data exclusively for the purposes of your project as described above. We do not sell your data, use it for advertising or profiling, or make decisions based solely on automated processing (Art. 22 GDPR).

4. Obligation to provide data

Providing your data is neither a statutory nor a contractual obligation. However, without your name, e-mail address and project information we cannot answer your request or carry out your project.

5. Recipients and processors

• Members of the Signal Pictures team working on your project.
• Odoo S.A., Chaussée de Namur 40, 1367 Ramillies, Belgium, which hosts this website and our client area as a processor under Art. 28 GDPR.
• Payment service providers, where you pay online; they act as independent controllers for the payment.
• Public authorities, only where we are legally obliged to disclose data.

6. Transfers to third countries

This website loads fonts from Google Fonts and, on the Entertainment page, embeds a YouTube video (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). In doing so, your IP address may be transmitted to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR).

7. Storage period

We store personal data relating to requests and projects for two (2) years after our last contact with you or after the completion of your project, after which it is deleted or anonymised. By way of exception, invoices and accounting documents are retained for ten (10) years in accordance with Article 16 of the Luxembourg Commercial Code. Client accounts are deleted upon request or after two years of inactivity. Server log files are deleted automatically after a short period.

8. Cookies

We only use cookies that are strictly necessary for the operation of the website and the client area (session, language, form security). These do not require consent under Article 4(3) of the amended Luxembourg law of 30 May 2005 on privacy in electronic communications. Third-party services embedded on our pages (YouTube) may set their own cookies.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3)); this does not affect the lawfulness of processing carried out before the withdrawal. To exercise your rights, write to contact@signalpictures.lu. We will respond within one month (Art. 12(3)).

You also have the right to lodge a complaint with a supervisory authority (Art. 77), in Luxembourg the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.

10. Changes

We may amend this policy to reflect legal or technical changes. The current version is always available on this page.