Privacy Policy

1. Who is responsible for your data

The data controller is [registered entity name], a Beauld company, of [registered address].

For any privacy question, or to exercise your rights, contact our Data Protection Officer: privacy@edimulo.com, or write to the address above marked for the attention of the DPO.

Our representative for [EU / UK / other, if applicable] is [name and contact].

2. What this policy covers

This policy covers personal data we handle when you use the edimulo website, apps and related services. Studios and producers using the edimulo Studio partner portal are covered by the same policy, with the additions noted in section 13.

It does not cover third-party sites or services you reach from edimulo. Those have their own policies and we encourage you to read them.

3. The data we collect

3.1 Data you give us

• Account data — name, email address, password (stored only as a salted cryptographic hash, never in readable form), country, and the language you prefer.
• Profile data — the profile names you create, whether a profile is a Kids profile, and each profile's settings.
• Payment data — billing name, address and the details needed to take payment. Full card numbers are handled by our payment processor and are not stored on edimulo's systems.
• Support data — messages, attachments and correspondence when you contact us.
• Optional data — anything else you choose to tell us, such as survey responses or feedback.

3.2 Data created by your use of the Service

• Viewing activity — titles and episodes played, playback position, how long you watched, whether you finished, and interactions such as adding to My List or rating a title.
• Search and browse activity — search terms, filters used, and pages viewed.
• Playback and quality data — bitrate, buffering events, errors and similar diagnostics.

3.3 Data collected automatically

• Device and technical data — device type, operating system, browser, screen size, app version, and identifiers assigned to your device or installation.
• Network data — IP address, approximate location derived from it, and internet service provider. We use approximate location to apply territorial licensing and to detect fraud, not to track you street-by-street.
• Storage on your device — see our Cookie Policy for exactly what we store and why.

3.4 Data from other sources

We may receive data from payment processors (for example whether a payment succeeded), from fraud-prevention partners, and from partners who refer you to us. Where you sign in through a third party, we receive the identifiers that provider shares with us.

We do not buy personal data from data brokers.

4. Sensitive data

We do not seek to collect special-category data (such as data revealing health, religion, political opinions, ethnicity or sexual orientation). Note that what you choose to watch can imply such matters. We treat viewing history as sensitive in practice: we restrict access to it internally, and we do not use it to infer or target special-category characteristics.

5. Children

edimulo is not directed at children under [13], and we do not knowingly collect their personal data other than through a Kids profile created and controlled by an adult account holder. A Kids profile holds a profile name, viewing activity and settings; it does not have its own email address or payment method.

If you believe a child has provided us with personal data outside of this arrangement, contact privacy@edimulo.com and we will delete it.

6. Why we use your data, and our lawful basis

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object as described in section 11.

7. Recommendations and automated processing

edimulo ranks and arranges what you see using your profile's viewing, search and list activity. This is automated, but it only affects what is presented to you — it does not produce legal effects or similarly significant effects for you, and there is no automated decision-making that determines eligibility, pricing or access.

Automated checks are used in fraud and abuse detection. Where such a check leads to suspension, you may ask for human review by contacting help@edimulo.com.

8. Who we share data with

We do not sell your personal data. We share it only as follows:

• Service providers acting on our instructions — hosting and content delivery, payment processing, email delivery, customer support tooling, analytics, and fraud prevention. They may use your data only to provide their service to us, under a written contract.
• Content partners — we share aggregated, non-identifying viewing statistics (for example total views for a title in a country). We do not tell a studio who watched their film.
• Professional advisers — lawyers, auditors and insurers, where necessary.
• Authorities — where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the safety of any person.
• Corporate transactions — if edimulo or a Beauld group company is reorganised, acquired or merged, data may transfer as part of that transaction, subject to this policy continuing to apply.

Our current categories of processor are listed at [link to sub-processor list].

9. International transfers

edimulo operates across Africa and beyond, and our providers may be located in other countries. Where we transfer personal data out of your country, we put appropriate safeguards in place, which may include standard contractual clauses, an adequacy decision, or equivalent mechanisms recognised by your local law.

You can request a copy of the safeguards we use by writing to privacy@edimulo.com.

10. How long we keep data

When a retention period ends we delete the data or irreversibly anonymise it. Anonymised data, which can no longer identify you, may be kept indefinitely for statistics and service improvement.

11. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of data that is wrong or incomplete.
• Erasure — deletion, where we no longer need the data or where you withdraw consent and no other basis applies.
• Restriction — to have us pause processing while a dispute is resolved.
• Portability — a machine-readable copy of data you gave us, and to have it sent to another provider where technically feasible.
• Objection — to processing based on legitimate interests, and at any time to direct marketing.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complain — to your data protection authority.

To exercise any of these, email privacy@edimulo.com. We will respond within [30] days, or tell you if we need longer. We may need to verify your identity first. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive requests.

You may also complain to your supervisory authority — for example the [Nigeria Data Protection Commission / Office of the Privacy Commissioner of Canada / other].

12. How we protect your data

• Passwords are stored only as salted cryptographic hashes; nobody at edimulo can read your password.
• Data is encrypted in transit using HTTPS/TLS.
• Access to personal data is limited to staff who need it, and is logged.
• Uploaded content and account data are held on infrastructure with access controls, backups and monitoring.
• We review our security arrangements and test them periodically.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority and, where required, you — without undue delay.

13. edimulo Studio (content partners)

If you register a studio account, we additionally process: your studio name, contact name, business email, phone, country, website, the titles and files you submit, and the activity trail of your submissions. The lawful basis is performance of our contract with you and our legitimate interest in verifying that submitted content is properly licensed.

Submission records and the audit trail are retained for [7] years after the end of the partner relationship, because they evidence the rights under which content was distributed.

14. Changes to this policy

We will update this policy as the service develops. If a change materially affects how we use your data, we will tell you by email or in the Service before it takes effect. The version number and effective date at the top of this page always reflect the current version.

15. Contact

Data Protection Officer, [registered entity name]
privacy@edimulo.com
[registered address]