Privacy Policy
- Who we are
- What this policy covers
- Information we collect
- The watermark shown during playback
- Why we use your information, and our lawful basis
- Cookies and similar technologies
- Who we share your information with
- Sending information outside Nigeria and the UK
- How long we keep your information
- How we protect your information
- Your rights
- Marketing
- Children
- If something goes wrong
- Changes to this policy
- How to complain
1. Who we are
Lantern Film House (“we”, “us”) is a film studio based in Lagos, Nigeria. We operate lanternfilmhouse.com and the virtual cinema on it.
For the purposes of Nigeria’s Data Protection Act 2023 (NDPA) and the UK General Data Protection Regulation, we are the data controller for the personal information described in this policy.
Contact: privacy@lanternfilmhouse.com
Registered address: [to be completed]
Data Protection Officer: [to be completed, if appointed]
If Lantern is designated a data controller of major importance under the NDPA, appointing a Data Protection Officer and registering with the Nigeria Data Protection Commission become mandatory. This should be assessed before launch.
2. What this policy covers
This policy covers the information we handle when you browse our site, buy a ticket, create an account, watch a film, or write a review. It does not cover other companies’ websites that we link to, including YouTube where our trailers are hosted.
3. Information we collect
Information you give us
- Your name and email address when you buy a ticket or create an account
- Your phone number, if you provide one at checkout
- Billing details required by our payment provider
- Anything you write in a review, a reaction or a message to us
Information we collect automatically
- Your IP address, browser type and device type
- Pages you visit and how you reached us
- Cookie identifiers (see section 6)
Information generated when you watch a film
- When you started and stopped watching, and how much you watched
- Your playback position, so you can resume where you left off
- A hashed device identifier, used only to count how many devices are playing at once
- The IP address of each playback session
Payment information
We do not collect or store your card number, expiry date or security code. Payments are handled entirely by our payment provider. We receive only a confirmation, the amount, and the last four digits of the card where the provider supplies them.
4. The watermark shown during playback
We want to be explicit about this, because it is unusual and it involves your personal data.
When you watch a film, your email address is displayed over the picture. It moves position periodically and remains visible for the whole film. This is sometimes called a forensic watermark.
We do this for one reason: to deter unauthorised copying and to allow us to trace the source of any copy that is shared without permission. Our lawful basis is our legitimate interests in protecting our films and the livelihoods of the people who make them.
Two consequences you should know about:
- Anyone who can see your screen while you watch can see your email address. Consider this if you are watching in a public place or casting to a shared screen.
- If a recording of one of our films carrying your watermark is distributed, we will be able to identify the account it came from, and may act on it under our Terms of Service.
You can object to this processing under section 11, but we cannot provide access to the film without it.
5. Why we use your information, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Create and manage your account | So you can sign in and reach your tickets | Performance of a contract |
| Process your ticket purchase | To take payment and issue your ticket | Performance of a contract |
| Send ticket confirmations, unlock notices and expiry reminders | So you can actually use what you paid for | Performance of a contract |
| Enforce viewing windows and device limits | To deliver the access you bought, and no more | Performance of a contract |
| Display a watermark during playback | To deter and trace unauthorised copying | Legitimate interests |
| Record playback analytics | To understand how our films are watched and improve delivery | Legitimate interests |
| Publish your review | Because you chose to submit it | Consent |
| Send marketing emails about new films | To tell you about new releases | Consent |
| Keep sales and tax records | Because the law requires it | Legal obligation |
| Prevent fraud and misuse | To protect our business and other viewers | Legitimate interests |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You can ask us for our assessment at any time.
6. Cookies and similar technologies
We use cookies for three purposes:
- Essential. Keeping you signed in, remembering your basket, and identifying your playback device. The site does not work without these.
- Preferences. Remembering choices such as your watchlist before you sign in.
- Analytics. Understanding how people use the site, only if you agree.
We ask for your consent to non-essential cookies when you first visit, and you can change your mind at any time through the cookie settings link in our footer. Declining non-essential cookies does not limit your access to any film you have paid for.
7. Who we share your information with
We do not sell your personal information. We share it only with the service providers we need to run the cinema, and only as far as necessary:
| Provider | What for | Where |
|---|---|---|
| Our hosting provider | Running the website and its database | [to be completed] |
| VdoCipher | Secure video delivery, DRM and watermarking | India |
| Flutterwave and Paystack | Taking payment | Nigeria |
| Mailchimp | Marketing emails, if you have subscribed | United States |
| Mailchimp Transactional (Mandrill) | Ticket confirmations and account emails | United States |
Each of these acts as our processor under a written agreement and may use your information only on our instructions.
We may also disclose information where the law requires it, or to establish or defend legal claims.
8. Sending information outside Nigeria and the UK
Some of our providers are based outside Nigeria and outside the United Kingdom, as shown above. When your information is transferred internationally we rely on one of the following:
- a determination that the destination provides an adequate level of protection; or
- contractual safeguards — Standard Contractual Clauses with the UK International Data Transfer Addendum for UK transfers, and equivalent contractual protections for transfers from Nigeria under sections 41 to 43 of the NDPA; or
- your explicit consent, where neither of the above applies.
You can ask us for a copy of the safeguards we use by writing to privacy@lanternfilmhouse.com.
9. How long we keep your information
| Information | Kept for |
|---|---|
| Account details | While your account is open, then 12 months |
| Orders, tickets and payment records | 6 years, to meet tax and accounting obligations |
| Playback sessions and device records | 90 days |
| Playback analytics | 24 months, aggregated after 12 |
| Published reviews | Until you ask us to remove them |
| Marketing consent records | While subscribed, then 24 months as proof of consent |
| Support correspondence | 24 months |
10. How we protect your information
The site runs over an encrypted connection. Passwords are stored hashed, never in plain text. Access to the admin area is restricted and logged. Films are delivered encrypted and are never stored on our own servers. Payment card details never reach us at all.
No system is perfectly secure, but we take the measures described above and review them.
11. Your rights
Under both the NDPA and the UK GDPR you have the right to:
- Access the personal information we hold about you
- Correct information that is wrong or incomplete
- Delete your information, where we have no overriding reason to keep it
- Restrict how we use it while a concern is resolved
- Receive a copy in a portable format, or have it sent to another provider
- Object to processing based on legitimate interests, including the watermark and playback analytics
- Withdraw consent at any time, where we rely on consent
To exercise any of these, email privacy@lanternfilmhouse.com. We will respond within one month. We may ask you to confirm your identity first.
Two limits worth stating plainly: we cannot delete records we are legally required to keep, such as sales records; and we cannot provide access to a film without applying the watermark, so an objection to that processing means we cannot deliver playback.
12. Marketing
We will only email you about new films if you have asked us to. Every marketing email carries an unsubscribe link, and you can also email us. Unsubscribing does not affect ticket confirmations, unlock notices or other messages about something you have bought.
13. Children
Our films carry age ratings and our current release is rated 16+. Our accounts are not intended for children under 16, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.
14. If something goes wrong
If a personal data breach occurs and it is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours, notify the Information Commissioner’s Office where the UK GDPR applies, and tell you directly where the risk is high.
15. Changes to this policy
We may update this policy. If we make a significant change, we will tell account holders by email. The date at the top shows when it was last revised.
16. How to complain
Please come to us first at hello@lanternfilmhouse.com. If you are not satisfied, you may complain to a regulator:
Nigeria — Nigeria Data Protection Commission (NDPC), ndpc.gov.ng
United Kingdom — Information Commissioner’s Office (ICO), ico.org.uk