Introduction
Edinburgh International Film Festival (“EIFF”, “we”, “us”, “our”) is committed to protecting your privacy. We process personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Notice explains how and why we process personal data at the time we collect it from you, including when you:
- *buy tickets or attend events,
- *submit a film,
- *sign up to our communications, or
- *otherwise engage with us online or in person.
We will be clear when we collect personal data and will not use it in ways you would not reasonably expect.
Who We Are
EIFF is an annual film festival held in Edinburgh each August. We work with partner venues and specialist suppliers to deliver screenings, events, guest services, ticketing and film submissions.
EIFF website:
https://www.edfilmfest.org
EIFF social media channels:
- Facebook: https://www.facebook.com/edfilmfest/
- X (Twitter): https://twitter.com/edfilmfest
- Instagram: https://www.instagram.com/edfilmfest/
- YouTube: https://www.youtube.com/user/EIFFtv
Data Controller and Contact Details
Data Controller:
Edinburgh International Film Festival Limited
ICO Registration: ZC181892
Contact email:
info@edfilmfest.org
This contact point can be used to ask questions about this notice or to exercise your data protection rights.
Scope of This Privacy Notice
This notice applies where personal data is collected directly from you when you act as a:
- *website visitor,
- *ticket purchaser or event attendee,
- *filmmaker submitting a film,
- *industry guest or delegate,
- *press contact,
- *subscriber to EIFF communications, or
- *individual contacting us directly.
Where third-party platforms are used (for example ticketing or film-submission platforms), their own privacy notices apply in parallel.
How We Collect Personal Data
We collect personal data:
- *directly from you, via forms, bookings, email or submissions;
- *via third-party platforms, such as ticketing and submission systems; and
- *automatically, through our website and digital services (for example via cookies and analytics).
Categories of Personal Data We Process
Depending on how you interact with us, we may process:
- *Identity and contact data (name, email address, telephone number, postal address where required)
- *Ticketing and transaction data (tickets purchased, booking references, attendance validation)
- *Film submission data (filmmaker details, film metadata, submission materials)
- *Guest, industry and press data (contact details, invitations, RSVPs and related coordination details)
- *Communications data (newsletter subscriptions, preferences, correspondence)
- *Event media (photographs, video or audio recordings, where applicable)
- *Technical data (IP address, browser/device information, usage data)
- *Special category data, such as accessibility or dietary requirements, where this is necessary and you choose to provide it
Purposes of Processing and Lawful Bases
We process personal data for the purposes below, using the corresponding lawful basis:
| Purpose | Lawful Basis |
|---|---|
| Selling and administering tickets; providing access to events | Contract |
| Managing film submissions and festival programme selection | Contract / Legitimate interests |
| Delivering festival operations and coordinating venues and events | Legitimate interests |
| Communicating essential information about bookings or events | Contract / Legitimate interests |
| Managing guest, industry and press relationships | Legitimate interests |
| Sending newsletters and marketing communications | Consent or Legitimate interests (as applicable) |
| Accounting, tax and compliance records | Legal obligation |
| Handling complaints and legal claims | Legal obligation / Legitimate interests |
Legitimate Interests
Where we rely on legitimate interests, these include:
- *operating the Festival efficiently and safely,
- *delivering screenings and events as expected by attendees,
- *managing relationships with filmmakers, guests, industry participants and press,
- promoting the Festival and its programme in ways individuals would reasonably expect.
We have considered the impact of this processing on your rights and freedoms and do not rely on legitimate interests where those interests are overridden. You have the right to object to processing based on legitimate interests.
Events, Photography, Filming and Recordings
EIFF delivers live screenings and events, primarily in person and in some cases online or in hybrid format.
*Entry is managed using paperless tickets and QR code scanning.
*We may photograph or film events for promotional, communications and archival purposes.
*Where photography or filming takes place, we will seek to provide appropriate notice (for example via signage or event information).
*Some events may be recorded. Where this occurs, participants will be informed in advance or at the start of the session.
*If you choose to speak, appear on camera, or submit questions or comments, this may be captured and retained as part of the event record.
Third-Party Services and Partners
Ticketing – 180 Box Office
EIFF uses third-party ticketing providers, including 180 Box Office.
When you purchase tickets through their platform:
- EIFF processes the ticketing data it receives to manage attendance, customer support and reconciliation.
- 180 Box Office processes personal data collected via its systems as a separate data controller, under its own privacy notice.
Payment card details are processed securely by ticketing/payment providers. EIFF does not store full card details.
Film Submissions
FilmFreeway
FilmFreeway is the online submission platform used to submit films to EIFF.
FilmFreeway operates as an independent data controller and processes submission data under its own privacy notice and terms.
FilmChief
FilmChief is used by EIFF to manage submissions and festival operations.
FilmChief acts solely as a data processor, processing personal data on EIFF’s instructions under a data processing agreement and does not use the data for its own purposes.
Other providers
We also work with providers supporting email, mailing lists, invitations, venues, IT, finance and professional services.
Social Media Buttons
Our website uses plugins and links to social media networks such as Facebook, Instagram and X (Twitter).
These plugins do not collect personal data unless you click on them. If you do so, data may be transmitted directly to the relevant social media provider. EIFF has no control over how those providers process your data.
Cookies and Analytics
We use cookies and similar technologies to:
- *enable website functionality,
- *analyse website performance,
- *understand visitor engagement.
Third-party platforms linked from our website apply their own cookie policies.
International Data Transfers
We primarily store personal data within the United Kingdom. Some third-party service providers may process data outside the UK.
Where international transfers occur, we ensure appropriate safeguards are in place, including:
- *UK adequacy decisions, or
- *UK-approved Standard Contractual Clauses, supplemented by additional security measures.
You may contact us for further information about these safeguards.
Data Security
We implement appropriate technical and organisational measures to protect personal data, including access controls, supplier assurance and staff confidentiality obligations.
Data Retention
We keep personal data only for as long as necessary for the purposes described above.
In broad terms:
*Ticketing and financial records are retained for seven years to meet accounting and legal requirements.
*Film submission records are retained for the relevant festival cycle and a limited archive period.
*Marketing and subscription data is retained until you unsubscribe or object.
- Event operational records are retained for a short period after the event unless required longer for legal reasons.
Where third parties act as independent controllers (such as ticketing and submission platforms), they apply their own retention periods.
Your Rights
You have rights under data protection law to:
- *access your personal data,
- *request correction or deletion,
- *restrict or object to processing,
- *request data portability (where applicable),
- withdraw consent at any time.
To exercise these rights in relation to data processed by EIFF, contact info@edfilmfest.org.
Automated Decision-Making
EIFF does not use automated decision-making or profiling that produces legal or similarly significant effects for individuals.
Complaints
If you have concerns about how we process your personal data, please contact us first at info@edfilmfest.org.
You also have the right to complain to the Information Commissioner’s Office (ICO):
https://www.ico.org.uk/concerns
Links to Other Websites
This Privacy Notice does not apply to third-party websites linked from our site. Please review their privacy notices separately.
Changes to This Privacy Notice
We may update this notice from time to time.
Policy Last Amended: 24 June 2026