No account, no cookies, just to read the site.

Who is responsible

The site is run by volunteers of AFiG: Amsterdam Film Group, a film group in Amsterdam. Responsible for your data (the controller, in the GDPR's words) is its organizer, Juan Mauricio Torres Perez, in Amsterdam. Write to juanma71298@gmail.com about anything on this page.

When you read the site

• Cloudflare hosts the site. Like any web server, it receives your IP address and browser details to send you the pages and to keep the site safe, and keeps technical logs of requests for up to 7 days to find errors.
• Images from other sites: event pictures load from Meetup's servers and film images (posters and stills) from TMDB's, so your browser connects to them, and they see your IP address, as with any image on the web. Both are US companies.
• Your browser remembers the theme you pick (Light or Dark), and that you saw the logo's animation during this visit. Both stay in your browser; we never receive them.
• Counting visits: Cloudflare Web Analytics counts how the site is used without cookies and without keeping anything in your browser. It notes the page, the site you came from, your browser and device type, your country and how fast the page loaded, and shows us only totals, never who visited. No tracking across sites, no advertising cookies.
• Counting what's used: the site itself counts, day by day, how often a film's page is opened and from where (a search, an event's page), whether a search found anything, which filters are used, and how often an event's buttons are used (Add to calendar, Meetup, tickets) or its newsletter link followed. Only the numbers are kept: never your IP address, your account, your browser, what you typed or the time. The site's admins see the totals.
• The site never shows which members go to an event, only how many. Each event's page shows its description as the host wrote it on Meetup, which may give the host's first name or where they sit, so you can book nearby.

For hosts

The hosts' sign-in emails are kept in a list only the site's software reads, to open the host tools to them. An admin brings the events in from our Meetup page by copying it by hand: the page also names some members who are going, and the site discards those names at once and never keeps or shows them.

When you sign in

You sign in to keep a watchlist, recommend films and rate the evenings, in one of three ways; with the same email address, they all lead to the same account. There are no passwords.

• With Google. Google tells us your name, your email address, whether Google verified it, and an id for your Google account. We keep those, with when you signed in and last used the site, only to know it's you. We don't keep your Google picture, your password (we never see it) or any access to your Google account. Google knows that you signed in to this site; see Google's privacy policy.
• With a code by email. We keep your email address. To send the code, we give your address and the code to Brevo, an email service in the EU that sends it for us and keeps its own record of the email; the code itself is stored only in a scrambled form, and only until it is used or expires after 10 minutes. Before sending, Cloudflare Turnstile checks in your browser that you're not a robot, usually without a puzzle; see Cloudflare's Turnstile privacy notice.
• With a passkey, once you've added one on your account. Your phone or computer keeps its secret part and never sends it; we keep only the public part, which checks it, with the kind of device and when you added it. You can remove a passkey there at any time.

Two cookies keep you signed in: one for up to 90 days, renewed while you use the site, and one that remembers your session for 5 minutes so the site stays fast. A third lives a few minutes while you sign in. All are needed for signing in, so the site doesn't ask for consent. We don't keep your IP address with your account.

When you recommend

What you send in Recommend (a film, and a note if you add one) is kept with your account. The group's hosts, a few volunteers, see it with your name and email, so they can reply. Other members never see who recommended what. You can withdraw a recommendation yourself at any time.

When you rate an evening

When you rate a film the group saw, we keep your stars, and your line on it if you write one, with your account. Everyone who visits the event's page sees the group's average, once three have rated, and your line with your first name, never your stars on their own. The page is public, so search engines such as Google can show your line and first name too, and a line you remove can stay in their results until they read the page again. If your account has no name, we ask for a first name when you write a line, and keep it with your account. The hosts see your name and email with your line, and can hide it from the page. You can change or remove your rating yourself at any time.

Your watchlist

The films on your watchlist are kept with your account, with when you added each one, so the site can show you when they play. Only you see it; the hosts don't. If you import your IMDb watchlist, we read from the file you pick each film's IMDb id, title and year, and the date you added it; your list keeps the films and those dates, and the rest of the file is discarded. We never connect to your IMDb account. You can remove films yourself at any time.

The newsletter

If you subscribe to the newsletter, with or without an account, we keep your email address, when you asked and when you confirmed it, and which issue you last got. Nothing goes out until you confirm by the link we email you; an address not confirmed within 48 hours is deleted. Every issue has a link to leave, and leaving deletes your address at once. The emails go through Brevo, an email service in the EU. Brevo counts how many people open each email and which links are clicked, without knowing who; we don't look at either, and Brevo keeps these counts under its own retention rules. Your address is never sold or shared.

Why we may keep it

Signing in is your request to use the parts of the site for members, and we keep only what that needs (GDPR Art. 6(1)(b)). The newsletter goes only to those who asked for it and confirmed: your consent, which you withdraw by leaving (Art. 6(1)(a)). The technical logs, and the pictures loaded from Meetup and TMDB, serve our legitimate interest in a site that works, stays safe and shows the films and events (Art. 6(1)(f)).

Where it is, and for how long

• Your account and what you send are stored in a Cloudflare database in the EU. Cloudflare handles them only for us, under its data processing agreement, and so does Brevo for the codes and the newsletter by email. Cloudflare, Google, Meetup and TMDB are US companies; where data reaches the US, it is covered by the EU-US Data Privacy Framework and the EU's standard contractual clauses.
• Your account stays until you delete it on your account page or ask us to, or until it hasn't been used for 24 months; then it is deleted with everything you sent. You can withdraw a recommendation, remove a rating, or take a film off your watchlist, yourself at any time.
• Something deleted stays up to 30 days in the database's own history, which lets us repair it after a mistake, and then it is gone. If something goes wrong while you send a form, the error noted in the technical logs may include what you sent; those logs are deleted after 7 days.

Your rights

You can ask to see what we keep about you, to correct it, to have it deleted, to receive it in a file, to limit how we use it, or to object to how we use it. To make sure it's you, we answer at the address of your account. Write to juanma71298@gmail.com, or message the organizers on Meetup; we answer within a month. If you think we handle your data wrongly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Signing in is for people aged 16 or over.