Privacy policy

Draft, to be checked by Resitax before launch.

Who is responsible

Sun & Salt Films, S.L. (brand: Sunday Club), NIF B93855377, Passeig Mallorca, 14A, entresuelos C-D, 07012 Palma de Mallorca (Illes Balears), Spain. Data protection contact: hello@sundayclub.film.

What we collect and why

Contact form. If you send us an enquiry we receive your name, email address, and whatever you choose to write (shoot dates, message). We also receive the page you were on, any campaign tags in its address (utm_source, utm_medium, utm_campaign) and your IP address. We use this only to answer your enquiry and, if you want one, prepare an offer.

Legal basis. Taking steps at your request before a contract (Art. 6(1)(b) GDPR). For the technical protection of the form (spam check, rate limit) our legitimate interest (Art. 6(1)(f) GDPR). The backup copy in the Google Sheet, the Plausible statistics and the font and CDN requests below rest on our legitimate interest (Art. 6(1)(f) GDPR) in running and securing the site (to be confirmed by Resitax).

Visits. We measure visits with Plausible. It sets no cookies and stores no personal data about you.

Who processes data for us

• Resend sends the enquiry as an email from forms@sundayclub.film to us.
• Google (Workspace) runs our mailboxes and a private Google Sheet where each enquiry is also saved as a backup.
• Cloudflare hosts the website (Cloudflare Pages), runs the form handler, keeps a short-lived counter per IP address to limit abuse (Cloudflare KV), and provides Turnstile, the spam check on the contact form. Turnstile receives your IP address and browser signals to tell people from bots. Cloudflare processes data under its data processing agreement (DPA).
• Plausible provides cookieless visitor statistics.
• Bunny.net delivers our videos (Bunny Stream). The opening film on the homepage streams from Bunny’s servers as soon as the page loads (unless your device is set to reduced motion), so your IP address is sent to Bunny on a homepage visit. On the spot pages the video player loads only after you press play; then your IP address is sent to Bunny.

Some of these providers are based outside the EU. Where that is the case, transfers rely on the providers’ standard contractual clauses or the EU-US Data Privacy Framework (to be confirmed by Resitax).

Third-party requests when you load a page

• Google Fonts. The typefaces are currently loaded from Google’s servers (fonts.googleapis.com, fonts.gstatic.com), which means your IP address is sent to Google. To be checked by Resitax; we may host the fonts ourselves before launch.
• Bunny.net. The opening film on the homepage streams from Bunny’s CDN as soon as the page loads (not if your device is set to reduced motion), which sends your IP address to Bunny. On the spot pages nothing is loaded from Bunny’s player until you press play.
• jsDelivr. The opening film uses the hls.js player library, loaded from the jsDelivr CDN, which also sees your IP address.

How long we keep data

Enquiries (email and sheet row) are kept for 24 months, then deleted. The rate-limit counter expires within an hour. We do not keep analytics data about individuals because Plausible does not collect any.

Your rights

You can ask us for access, correction, deletion, restriction, portability, and you can object to processing. Write to hello@sundayclub.film. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es.