Legal name: Production Lifecycle Management, S.L.
Tax ID: B65356727
Registered office: Barcelona, Spain
Activity: B2B procurement platform for audiovisual production services and international directory of suppliers
Privacy contact: privacidad@visualnet.com
Visualnet has assessed the criteria of Article 37 of the GDPR and Article 34 of the LOPDGDD and has concluded that the cases of mandatory designation of a Data Protection Officer do not apply: the processing does not include special categories of data under Article 9 of the GDPR, does not involve regular and systematic large-scale monitoring of natural persons within the meaning of Article 37.1.b, and the core activity of the controller does not consist of processing that would require such a designation. Privacy enquiries are channelled through the email address indicated in the preceding section, attended by personnel with specific responsibility in this area.
The competent Spanish supervisory authority is the Spanish Data Protection Agency (AEPD) — www.aepd.es. Data subjects whose habitual residence is in another Member State of the European Union may, alternatively, lodge a complaint with the supervisory authority of their State of residence, in accordance with Article 77 of the GDPR.
Within the Framework Agreement programme with Studios, Broadcasters and Audit Firms, Visualnet may process personal data of the client's employees, contractors and suppliers that appear in the documentation of Projects and Requests for Offer. In this context, Visualnet acts as Data Processor and the client as Data Controller. The specific conditions are formalised in the corresponding Data Processing Agreement signed between the parties.
Visualnet operates an international professional Directory of companies providing audiovisual production services. The Directory constitutes internal infrastructure of the Platform — it is not accessible to the public and does not allow external consultation.
Data processed. Company identifier (legal name, tax identifier, website), professional contact data (name and function of the person designated as company contact, professional email address, professional telephone) and classification by the Platform's own taxonomy of audiovisual production activities.
Purpose of processing. Directory data is used exclusively to: (a) invite the company to participate in Requests for Offer issued by Production Companies using the Platform; (b) send service communications relating to the operation of the Platform itself. Directory data is not used for Visualnet's own commercial purposes, is not transferred to third parties and is not enriched with additional data obtained from external sources.
Legal basis — Article 19 LOPDGDD. The processing is grounded in Article 19 of Spanish Organic Law 3/2018, which establishes the legal presumption of lawfulness, under Article 6.1.f of the GDPR, of the processing of contact data and of the function or position held by natural persons providing services in a legal entity, provided that (a) the processing relates only to the data necessary for their professional localisation, and (b) the purpose is solely to maintain relations with the legal entity in which the data subject provides services. The Directory operation described in this section meets both requirements.
Source of the data. Part of the Directory's records have been obtained directly from the data subject through voluntary registration on the Platform. The remaining part comes from publicly accessible sources, in particular: professional directories maintained by official audiovisual promotion bodies (Film Commissions and equivalents), commercial registries and public databases of economic activity, audiovisual professional associations and published sectoral catalogues. The specific source from which each particular record originates is identified, in accordance with Article 14 of the GDPR, in the first communication that the Platform addresses to its data subject.
Data subject rights. Persons whose data appear in the Directory may exercise the rights of objection and erasure at any time by writing to privacidad@visualnet.com. Every communication issued by the Platform also incorporates a specific one-click link to unsubscribe from the operational Directory.
Visualnet does not sell or transfer personal data to third parties for commercial purposes. Data may be communicated to the following categories of recipients:
Data is stored on Amazon Web Services servers located in the eu-west-1 region (Ireland), within the European Economic Area. Any international transfer outside the EEA associated with the provision of the service is carried out with the adequate safeguards provided for in Chapter V of the GDPR, in particular the European Commission's Standard Contractual Clauses (Article 46.2.c of the GDPR) and, in the case of Stripe, Inc., the EU-U.S. Data Privacy Framework and UK Extension adequacy frameworks where applicable.
Once the applicable periods have elapsed, the data is irreversibly deleted or anonymised, without prejudice to its possible retention in the immutable Audit Trail where sectoral regulations require it.
As a data subject, you are entitled to the following rights with regard to the processing of your personal data:
Obtain confirmation as to whether Visualnet processes your data and, where applicable, access it.
Request the correction of inaccurate or incomplete data.
Request the deletion of data when it is no longer necessary for the purpose for which it was collected.
Object to processing based on legitimate interest or on direct marketing.
Request the suspension of processing in the cases provided for in Article 18 of the GDPR.
Receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.
Not to be subject to automated decisions producing legal effects or significantly similar effects (Article 22 of the GDPR).
Withdraw consent at any time, where processing is based on it, without affecting the lawfulness of prior processing.
To exercise any of these rights, send a written request to privacidad@visualnet.com indicating the right you wish to exercise and attaching a copy of your identification document. Visualnet will respond within a maximum period of one (1) month from receipt, extendable by two (2) additional months in cases of complexity.
If you consider that the processing of your data infringes applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of the Member State of the European Union in which you have your habitual residence.
Visualnet applies appropriate technical and organisational measures to ensure the security of processing in accordance with Article 32 of the GDPR, in particular:
Visualnet uses exclusively technical cookies strictly necessary for the operation of the Platform. No analytical, advertising or tracking cookies are used. For further information, please consult our Cookie Policy.
The Platform incorporates an artificial-intelligence-based assistant aimed at the Production Manager that suggests improvements to the technical drafting of Requests for Offer and provides guidance on the selection of invited Suppliers.
The assistant's suggestions do not constitute automated decisions producing legal effects or significantly similar effects within the meaning of Article 22 of the GDPR: the assistant offers proposals that the human user reviews, modifies, accepts or discards freely before any action with effects on Suppliers. The final decision on the drafting of the Request for Offer and the selection of the universe of invited Suppliers rests, in any event, with the Production Manager of the Production Company.
Visualnet does not carry out profiling activities with legal consequences for data subjects.
In the event of a personal data breach that may pose a risk to the rights and freedoms of data subjects, Visualnet will notify the incident to the Spanish Data Protection Agency within a maximum period of seventy-two (72) hours of becoming effectively aware of it, in accordance with Article 33 of the GDPR.
Where the breach entails a high risk to the rights and freedoms of data subjects, Visualnet will communicate the incident to those affected without undue delay, in accordance with Article 34 of the GDPR, on the terms and with the minimum content provided for in that provision.
Visualnet may update this Policy periodically. Substantive modifications will be notified to registered users at least thirty (30) days in advance of their entry into force, by email to the registered address and by notice on the Platform itself. The current version, together with its date of last update, will always be accessible at visualnet.com/privacidad.
For any query concerning the processing of your personal data or the exercise of your rights:
Production Lifecycle Management, S.L.
Email: privacidad@visualnet.com