Privacy Policy

1. Introduction & Identity of the Data Controller

Falhen Media ("we," "us," or "our") is the data controller responsible for the personal data collected through this website and in connection with our services. We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and all other applicable US federal and state privacy laws.

Data Controller: Falhen Media. Email: privacy@falhen.com. For all data protection enquiries, please contact our Privacy Team at privacy@falhen.com. We aim to respond to all requests within 30 days.

This Privacy Policy applies to all personal data we collect through our website (falhen.com), our client portal, and in the course of providing our professional media production services. It does not apply to third-party websites linked from our site.

2. Personal Data We Collect

We collect personal data you voluntarily provide when you: (a) submit a contact or enquiry form; (b) request a quote or book a discovery call; (c) subscribe to our newsletter or marketing communications; (d) engage us for services and sign a project agreement; (e) access a client gallery or portal. This data includes your full name, email address, phone number, company name, job title, billing address, and any project briefs or creative materials you share.

When you visit our website, we automatically collect technical data including: IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, time on page, and click-stream data. This is collected via cookies and similar tracking technologies. Please see our Cookie Policy for full details.

We retain records of all correspondence when you contact us by email, phone, or through our website forms, including message content and metadata such as timestamps and delivery status.

We do not intentionally collect special categories of personal data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Please do not submit such data through our website or forms.

3. Lawful Basis for Processing (GDPR Article 6)

We process your data where it is necessary to perform a contract with you or to take pre-contractual steps at your request — for example, when you request a quote, sign a project agreement, or access a client gallery.

We process data where it is in our legitimate business interests, provided those interests are not overridden by your fundamental rights. This includes: improving our website and services, preventing fraud, maintaining IT security, and conducting direct marketing to existing clients. We have conducted Legitimate Interests Assessments (LIAs) for each such processing activity.

Where we rely on your consent — such as for newsletter subscriptions, non-essential cookies, or marketing to new prospects — you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. Withdrawal can be made via the unsubscribe link in any email or by contacting privacy@falhen.com.

We process data where necessary to comply with applicable laws, including tax and accounting obligations, anti-money laundering requirements, and responses to lawful requests from regulatory authorities or courts.

4. Purposes of Processing

To respond to enquiries, provide quotes, deliver contracted video production and media services, manage client relationships, and communicate project updates and deliverables.

To process payments, maintain accounts, comply with legal obligations, prevent fraud, and enforce our Terms of Service.

To send newsletter updates, portfolio showcases, and promotional offers (with your explicit consent where required by law).

To analyse usage patterns, identify technical issues, and improve the user experience. Analytics data is pseudonymised where possible.

To monitor for and prevent unauthorised access, fraud, and other malicious activity on our systems.

5. Data Sharing & Third-Party Processors

We share data with trusted third-party processors who assist us in operating our business. All processors are bound by Data Processing Agreements (DPAs) under GDPR Article 28 and are contractually required to process data only on our documented instructions. Processors include: cloud hosting and infrastructure providers (e.g., Supabase/AWS), email delivery services (e.g., Resend), analytics platforms (e.g., Google Analytics), and payment processors.

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity. We will provide at least 30 days' notice before your data is transferred and becomes subject to a different privacy policy.

We may disclose your information where required by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of Falhen Media, our clients, or others.

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. Under the CCPA/CPRA, we confirm we do not "sell" or "share" personal information as defined by California law.

6. International Data Transfers

Where we transfer personal data to countries outside the European Economic Area (EEA) or the United Kingdom that do not benefit from an adequacy decision, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V. These safeguards include: Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Agreement (IDTA), or binding corporate rules where applicable.

Some of our service providers are based in the United States. Where data is transferred to the US, we rely on SCCs and, where applicable, the EU-US Data Privacy Framework. You may request a copy of the relevant transfer mechanism by contacting privacy@falhen.com.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Our standard retention periods are: Client project data — 7 years from project completion (financial record-keeping); Marketing data — until you withdraw consent or opt out; Website analytics — 26 months (Google Analytics default); Enquiry/contact data — 2 years from last contact.

When data is no longer required, we securely delete or irreversibly anonymise it in accordance with our data retention schedule. You may request deletion of your personal data at any time, subject to our legal obligations to retain certain records.

8. Your Rights Under GDPR & US Privacy Laws

You have the right to request a copy of the personal data we hold about you, information about how we process it, and to receive it in a structured, commonly used, machine-readable format (data portability, Art. 20).

You have the right to request correction of inaccurate or incomplete personal data we hold about you without undue delay.

You have the right to request deletion of your personal data where: it is no longer necessary for the purpose it was collected; you withdraw consent and there is no other lawful basis; you object and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required by law.

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

You have the right to object at any time to processing of your personal data based on legitimate interests (Art. 6(1)(f)) or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this policy and provide appropriate safeguards.

California residents have additional rights including: the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to opt-out of the sale or sharing of personal information; the right to non-discrimination for exercising privacy rights; and the right to correct inaccurate personal information.

To exercise any of these rights, please submit a written request to privacy@falhen.com. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice). We may need to verify your identity before processing your request. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

If you are located in the EEA or UK and believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the US, you may contact the Federal Trade Commission (FTC) or your state Attorney General.

9. Security

We implement appropriate technical and organisational measures (TOMs) to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with GDPR Article 32. These include: TLS/SSL encryption in transit; encryption at rest for sensitive data; role-based access controls and least-privilege principles; regular security assessments and penetration testing; staff training on data protection; and incident response procedures.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Art. 34).

10. Children's Privacy

Our website and services are not directed to individuals under the age of 16 (or 13 in the United States under COPPA). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@falhen.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website with a revised "Last updated" date and, where required by law, by sending you direct notification. Your continued use of our services after the effective date of material changes constitutes acceptance of the updated policy.

12. Contact & Data Protection Officer

For all privacy-related enquiries, data subject requests, or concerns about this Privacy Policy, please contact: Privacy Team — privacy@falhen.com | General Enquiries — hello@falhen.com. We aim to respond to all requests within 30 days.