PRIVACY & DATA POLICY

This Privacy and Data Policy describes how Scarface VFX (operating under the registered sole proprietorship ASIF KHAN VFX, Org. nr. 938 015 627, registered in the Norwegian Central Coordinating Register for Legal Entities / Foretaksregisteret, Oslo, Norway; hereinafter “we”, “us”, or “our”) processes, protects, and respects personal data collected through our website (scarface.no) and during client production engagements.

We process all personal data strictly in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Norwegian Personal Data Act (Personopplysningsloven).

We only collect personal information that is reasonably necessary to fulfill project bids, communicate with directors and producers, and deliver production services:

• Inquiry & Bid Information: Full name, production company, business email address, phone or WhatsApp number, project title, and sequence notes submitted via our production intake desk.
• Production Review Links: Secure digital links (e.g., Frame.io, Google Drive, MASV, Aspera) provided to us for plate review and technical bidding.
• Billing & Contracting Data: Corporate address, company registration number, VAT/MVA details, and authorized signatory information.
• Technical Server Telemetry: Standard non-identifying server logs (IP address, browser type, referring URL, time of visit) captured strictly for server security and denial-of-service mitigation.

We process personal data on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide bids, execute master service agreements, and deliver visual effects sequences.
• Legitimate Interests (Art. 6(1)(f)): Studio communications, protecting intellectual property, maintaining server integrity, and showcasing public portfolio works.
• Legal Obligations (Art. 6(1)(c)): Compliance with Norwegian statutory financial bookkeeping obligations (Bokføringsloven).

We retain personal information only for as long as necessary to achieve the specific purposes for which it was acquired:

• Inquiry Communications: Retained during the active evaluation of the project bid, and archived or deleted within twenty-four (24) months if an engagement is not commissioned.
• Production Deliverables & Invoices: Retained for five (5) years in compliance with Norwegian statutory accounting and tax retention regulations.
• Client Plate Materials: Stored securely on encrypted drives during active shot production and archived or purged in accordance with the specific production turnover agreement.

Our website does not sell, rent, or trade your personal information to third parties, data aggregators, or marketing brokers.

We utilize essential external services to render our cinematic visual experience:

• Google Fonts & Google Cloud Storage: Deliver high-performance typography (Syne, Space Grotesk, JetBrains Mono) and optimized image delivery.
• Tailwind CDN: Serves responsive layout style sheets.
• Embedded Review Portals: When accessing external streaming portals (e.g., Frame.io, Google Drive, LinkedIn, Instagram), those services operate under their respective privacy policies.

As a data subject within the European Economic Area (EEA), you possess specific rights regarding your personal information:

• Right of Access (Art. 15): Request confirmation and copies of your personal data held by the Studio.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal records.
• Right to Erasure (Art. 17): Request deletion of your personal data where retention is no longer legally mandated.
• Right to Restrict or Object (Arts. 18 & 21): Limit or object to specific processing activities.
• Right to File a Complaint: You have the legal right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway — www.datatilsynet.no).