Privacy policy

Newsletters and preferences

For newsletter requests we store email, language, edition, edition country where relevant, consent date and wording, and status. We retain confirmation, unsubscribe and sending records. HMAC fingerprints of IP and browser prevent abuse; original values are not stored in that history.

Sending requires consent and email confirmation. The unsubscribe link opens a page asking you to stop all emails to your address, across languages and editions. We retain the encrypted address, an HMAC fingerprint and unsubscribe or renewed confirmation dates to respect that choice. A voluntarily requested new signup is the only exception, and requires confirmation before sending resumes.

Unsubscribing does not automatically erase accounts, consent evidence or preference records; you can request erasure and exercise the rights in this policy. Newsletters use no opening pixels or advertising profiles.

Controller

The publisher and operator is Merito Media LLC, located at 407 Lincoln Rd, Suite 6H, Miami Beach, FL 33139, United States.

Given the present scale and nature of the service, no data protection officer has been appointed. This does not limit any right or direct access to the controller.

Scope and principles

This policy covers the public website, contact form and internal administration. We apply lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality.

Reading does not require registration. We do not sell personal data, build advertising profiles of visitors or use special-category data for film recommendations.

Data you provide

Do not send identity documents, banking, health or other sensitive information unless strictly necessary and specifically requested through an appropriate channel.

• Contact: name, email, subject, message, language, consent and submission time.
• Requested preferences: country chosen for local titles and availability, and the visual theme stored on the device.
• Follow-up communications: information you choose to provide for an enquiry, correction, complaint or rights request.

Technical and security data

Server logs may record IP address, time, requested URL, response, browser or user agent and security events. The contact table stores a non-reversible HMAC of the IP to detect abuse, not the original IP.

ALTCHA creates a cryptographic anti-abuse proof processed by our application. The technical session uses a random identifier and does not contain the form message or create an advertising history.

People documented in the catalogue

Professional records may include names, aliases, occupations, filmography, identifiers, licensed images and relevant biographical facts from public, authorised or rights-holder sources. Processing relies on legitimate interests and freedom of information and expression concerning publicly relevant film activity.

We avoid private addresses and contacts, unnecessary family data, sensitive categories and unsupported inferences. The person concerned may request correction, context, objection or removal; accuracy, public interest, third-party rights and legal duties will be balanced.

Purposes and legal bases

• Answering enquiries: consent and, where relevant, pre-contractual steps or the legitimate interest in managing communications.
• Corrections, rights and complaints: legal obligation and legitimate interests in accuracy and legal defence.
• Professional and editorial publication: legitimate interests, freedom of information and expression, and an appropriate licence or legal basis for each asset.
• Preventing spam, fraud, unauthorised access and faults: legitimate interests in security and legal compliance.
• Sessions and requested preferences: delivery of the requested service and legitimate interests; consent if a technology is not strictly necessary.
• Internal administration: contract, legal duty and legitimate interests in operating and auditing the service.

AI and automated decisions

Contact-form and visitor browsing data are not deliberately fed into editorial generation. AI tools operate on film topics and sources with traceability controls.

We make no solely automated decision producing legal or similarly significant effects on visitors. Anti-abuse filters may temporarily block a request; contact us by email if you believe this was an error.

Recipients, processors and transfers

Access is limited to authorised personnel and necessary EU hosting, infrastructure, security, maintenance and, where relevant, email providers. Processors act under contract, instructions and confidentiality safeguards.

Disclosure may occur to courts, authorities or advisers where legally required or necessary for claims. We do not transfer contact lists to studios, advertisers or platforms. Transfers outside the EEA use an adequacy decision, standard contractual clauses or another lawful safeguard, with supplementary measures where appropriate.

Embedded content

YouTube trailers use privacy-enhanced mode and connect only after you choose to load them. Google may then receive technical data and act under its own policies.

Following an external link also places you under the third party’s own processing terms. Essential information on a MovieResort record does not depend on loading the video.

Retention and security

Enquiries are retained while answered and as needed for follow-up, audit and defence, then deleted or anonymised when no longer necessary. A legal duty, claim or investigation may require restricted retention.

We use encryption in transit, HttpOnly and SameSite cookies, access control, least privilege, security headers, anti-abuse checks, backups and change records. No measure can remove every risk.

Your rights

Where applicable, you may request access, correction, erasure, objection, restriction and portability, withdraw consent without affecting earlier processing, and challenge an automated decision. Write to Legal or privacy enquiry or use the form with “Privacy” and enough detail to locate the data.

We normally respond within one month; the lawful extension applies to complex requests. Proportionate identity evidence may be requested to prevent disclosure to another person.

Complaints, children and changes

Where the GDPR applies, you may complain to the data protection authority where you habitually live, work or believe an infringement occurred. We welcome the opportunity to resolve a good-faith concern first.

The service is not designed to collect children’s personal data. Material processing changes will be reflected in this policy and its revision date.

Browser storage and external services

The cookie policy details sessions, XSRF, persistent Admads access and local preferences. The newsletter invitation marker contains no email or subscription consent; the push management key serves that feature only. There is no general cookie consent manager.

Contact automatically connects to Google Maps without prior MovieResort authorisation controls. Not all storage or integration-specific transfer safeguards have been verified. Automatic loading is not presented as consent, and other permissions and rights remain unaffected.

Google Maps on the contact page

The contact page includes a Google Maps map that loads automatically when you open it. This connection allows Google to receive technical data, such as your IP address and browser information, and apply its own privacy and storage policies. The map displays the publisher’s postal address: it does not request or use your geolocation. You can read the address and use the form without interacting with the map.