1. Who we are

Scotflix is operated by Firewalker Pictures Limited, a company registered in Scotland under company number SC763880, whose registered office is at 25 Valleybank, Kilsyth, Glasgow, Scotland, G65 0RH.

We are the data controller for the personal information described in this policy. That means we decide how and why it is used.

For anything about your personal information, email maureen@firewalkerpictures.co.uk or write to us at the address above.

2. What this policy covers

This policy explains what personal information we collect when you use the Scotflix website, what we do with it, who we share it with, how long we keep it and what rights you have.

Our use of cookies is covered separately in our Cookie Policy.

The Scotflix platform runs on technology provided by Hiway (UFLIX Ltd). Hiway processes personal information on our instructions as our processor. Your relationship, and your rights under this policy, are with Firewalker Pictures Limited.

3. The information we collect

Information you give us:

What	When
Name and email address	When you create an account
Billing details, including billing address and country	When you rent or buy a title
Marketing preferences	When you subscribe or update your settings
Anything you send us	When you contact support or make a complaint

We do not receive or store your full card number. Card details are entered directly with our payment provider.

Information we collect automatically:

What	Why
IP address and approximate location (country or region)	To apply territory licensing restrictions and detect fraud
Device, browser, operating system and screen type	To deliver the right video quality and troubleshoot playback
Viewing activity: titles rented or bought, when playback started, how much you watched, playback errors	To run your rentals and viewing windows, report to rights holders, and improve the service
Log data: pages visited, referring site, timestamps	Security, fraud prevention and diagnostics
Cookie identifiers	See our Cookie Policy

We also measure overall site usage with Plausible, a privacy-focused analytics tool that does not use cookies, does not store IP addresses and does not build a profile of you. Our Cookie Policy explains this in more detail.

Information from others:

Source	What
Our payment provider (Stripe)	Confirmation of payment, partial card details such as the last four digits and card type, and the outcome of fraud checks
Hiway	Technical and account data generated by the platform on our behalf

We do not intentionally collect special category data (such as information about health, beliefs or ethnicity), and we ask you not to send it to us.

4. How we use your information, and our legal basis

What we do	Legal basis
Create and manage your account	Performance of our contract with you
Take payment and deliver the title you rented or bought	Performance of our contract with you
Enforce rental periods and viewing windows	Performance of our contract with you
Apply territory restrictions so we only show titles we are licensed to show you	Our legitimate interests, and those of rights holders, in complying with content licences
Detect, prevent and investigate fraud, unauthorised account access and payment abuse	Our legitimate interests in protecting our business and customers, and legal obligation
Detect and investigate content piracy, including forensic watermarking of streams	Our legitimate interests, and those of rights holders, in protecting copyright
Provide customer support and handle complaints	Performance of our contract with you, and our legitimate interests in running the service well
Report viewing and revenue figures to the filmmakers and rights holders whose titles you watched	Our legitimate interests, and theirs, in accounting for licensed content. See section 6
Send you service messages such as order confirmations, receipts, expiry reminders and account notices	Performance of our contract with you
Send you marketing emails about new releases and Scotflix news	Your consent, or our legitimate interests where you are an existing customer and we are telling you about similar content. You can opt out at any time
Measure how the site is used, using analytics that do not identify individual visitors	Our legitimate interests in understanding and improving the service
Improve the service, understand what is popular and fix problems	Our legitimate interests in improving what we offer
Keep accounting and tax records	Legal obligation
Establish, exercise or defend legal claims	Our legitimate interests, and legal obligation

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and we have concluded they are not. You can ask us for more detail on that assessment, and you can object at any time. See section 11.

5. Marketing

If you opt in, we will email you about new releases, upcoming titles and Scotflix news.

If you have rented or bought a title from us, we may email you about similar content unless you tell us not to. We give you the chance to opt out when you buy and in every message.

Every marketing email has an unsubscribe link, and you can change your preferences in your account settings at any time. Opting out of marketing does not stop service messages such as receipts and expiry reminders, which we have to send to run your account.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

6. Filmmakers and rights holders

Scotflix carries films licensed from filmmakers, producers, studios and distributors.

We report to them on how their titles perform, including numbers of rentals and purchases, revenue, viewing volumes and the countries viewers watched from. These reports are aggregated and do not identify you individually.

Where you have opted in, we may share your name and email address with the filmmaker whose title you watched, so they can contact you directly about their work. That filmmaker becomes a separate data controller and their own privacy policy will apply. We will always ask before we do this, and you can withdraw your consent at any time.

7. Who we share your information with

Who	What they do	Where
Hiway (UFLIX Ltd)	Provides and hosts the Scotflix platform, acting on our instructions	[UK / EU / INSERT]
Stripe	Processes card payments and runs fraud checks. Stripe is also a controller in its own right for those purposes and has its own privacy policy	US and EU
Resend	Sends our service and marketing emails on our behalf. Receives your email address and the content of those messages	US
Plausible Analytics	Provides cookieless site analytics that do not identify you	EU
Our hosting and content delivery providers	Store and stream video and site files	EU
Filmmakers and rights holders	Receive performance reporting. See section 6	Various
Professional advisers such as accountants, lawyers and auditors	Advise us where they need the information to do so	UK
Law enforcement, regulators and courts	Where we are legally required to disclose, or where we need to establish or defend legal claims	UK

If our business is sold or transferred, personal information may transfer with it. We will tell you if that happens and this policy will continue to apply until you are told otherwise.

8. Sending information outside the UK

Some of our providers process personal information outside the UK, including Stripe and Resend in the United States. Our analytics provider, Plausible, keeps data within the European Union.

Where that happens, we make sure appropriate safeguards are in place, normally the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or the provider’s certification under a scheme the UK Government has approved as offering adequate protection. You can ask us for a copy of the safeguards we rely on by emailing maureen@firewalkerpictures.co.uk.

9. How long we keep it

Information	How long
Account details	While your account is open, then 12 months after you close it, in case you come back or a dispute arises
Order and payment records	Six years after the end of the financial year they relate to, to meet tax and accounting obligations
Viewing history	While your account is open, then anonymised
Marketing preferences and consent records	Until you unsubscribe, then a further two years so we have a record of your choice
Support and complaint correspondence	Three years after the matter is closed
Security, fraud and piracy investigation logs	Up to two years, or longer where an investigation or legal claim is live

Where we no longer need information, we delete it or anonymise it so it can no longer identify you.

10. Keeping it secure

We use encryption in transit, encrypted storage of passwords, access controls that limit who can see personal information, and logging of access to systems. Our platform provider is contractually required to maintain appropriate security measures.

No system is completely secure. If a breach affects your rights and freedoms, we will tell you and the Information Commissioner’s Office as the law requires.

11. Your rights

Under UK data protection law you have the right to:

be told how your information is used, which is what this policy is for;
access a copy of the personal information we hold about you;
have inaccurate information corrected;
have information deleted where we no longer need it, or where you withdraw consent we relied on;
restrict how we use it while a concern is being resolved;
object to us using it on the basis of legitimate interests, and to object to direct marketing at any time, which we will always honour;
portability, meaning a copy of information you gave us in a machine-readable format;
withdraw consent at any time, where consent is what we relied on. This does not affect anything we did before you withdrew it.

To exercise any of these, email maureen@firewalkerpictures.co.uk. We will respond within one month. We may ask you to confirm your identity first. There is normally no charge.

Automated decisions. We do not make decisions about you by purely automated means that have legal or similarly significant effects, except that our payment provider’s automated fraud checks may decline a transaction. If that happens you can contact us and ask a person to look at it.

12. Children

Scotflix is not intended for children. You must be 18 or over to hold an account. We do not knowingly collect personal information from children. If you believe a child has given us their information, email maureen@firewalkerpictures.co.uk and we will delete it.

13. Complaints

If you are unhappy with how we have handled your personal information, please tell us first at maureen@firewalkerpictures.co.uk so we have the chance to put it right.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk

14. Changes to this policy

We may update this policy. If we make a significant change to how we use your information, we will tell you by email or through a notice on the site before it takes effect. The date at the top shows when it was last updated.

15. Contact

Firewalker Pictures Limited 25 Valleybank, Kilsyth, Glasgow, Scotland, G65 0RH Registered in Scotland, company number SC763880 Email: maureen@firewalkerpictures.co.uk