Privacy policy

1. Who does this Privacy Policy apply to?

This policy applies to people who interact with the FilmAndorra initiative through this website, to professionals who apply to join or are listed in the Professional Directory, to people who request information or agree to receive communications and, in general, to any natural person whose data is processed in the context of the services described in this policy.

2. Who is the controller of your personal data?

The controller is ANDORRA TURISME, SAU (Andorra Turisme), with NRT A-707655R and registered address at Edifici Ràdio Andorra, av. de la Bartra, s/n, AD200 Encamp (Principality of Andorra). Its data protection officer can be contacted at dpo@andorraturisme.ad.

This policy does not govern processing carried out by third parties on websites or services unrelated to the controllers indicated, even if they are accessed through links from the FilmAndorra website. We recommend that you read the privacy information of the relevant third party before providing it with any personal data.

3. How do we obtain your personal data?

In general, we obtain your data directly from you through the website forms, email or other channels made available by FilmAndorra. We may also obtain data:

• from the person or entity on whose behalf you act,
• from the documentation you provide to evidence your professional activity, limited to the information necessary to carry out the relevant verification,
• from other entities when, acting in your interest, they offer you the opportunity to take part in the initiative and you do not object or you authorise them, as appropriate, to send us the data necessary to become part of FilmAndorra,
• from publicly accessible sources or official registers when it is necessary to verify professional information and there is a legal basis that allows it,
• from the strictly necessary technical data generated while browsing the website,
• from cookies or similar technologies that have been accepted, where their use requires consent,
• from the professional contact details provided to us by suppliers, by the entities FilmAndorra deals with or by the people who represent them.

4. What do we use your data for and on what legal basis?

To handle enquiries and contact requests

Andorra Turisme will process the data you provide through the contact form or other channels in order to manage and respond to your enquiry, request or issue. Where the enquiry is linked to a request for a service or to a contractual relationship, the legal basis will be article 6.1.b of the LQPD. For general enquiries, Andorra Turisme will rely on its legitimate interest in managing the communications it receives, provided that this basis is applicable to the specific processing.

To manage registration in the Professional Directory

We will process the data provided through the registration form in order to process the application, verify the admission criteria, validate the professional information, contact the applicant and keep the profile up to date. The categories may include identification and contact data, professional and business activity data, commercial or professional registration data, experience, projects or clients, social media, a photograph and information relating to certifications. Only the data necessary for these purposes will be collected.

Processing the application and managing the accepted profile are based on their being necessary to take pre-contractual steps at the request of the data subject and to manage their participation in the Directory in accordance with the applicable conditions. Publication of contact details or images that are not necessary for internal management will be subject to the relevant specific consents.

To publish the profile in the Professional Directory

Only information previously identified as public will be published in the Professional Directory. The NRT, the full postal address of a natural person and supporting or certification documents will not be published. The email address, telephone number and photograph will only be published when the corresponding option has been expressly selected. Publication may mean that the profile can be viewed by any Internet user and indexed by search engines.

Publication is based on the performance of the contract arising from the application to join the Professional Directory, which entails the inclusion of the applicant entity in the public register. Refusal to publish the profile will prevent other relationships with FilmAndorra, because acceptance of the agreement specifically requires the data to be made public in order to interact with other entities.

To send you information of interest to you

Andorra Turisme will use the email address provided to send you information about activities, news, calls, fairs, events or initiatives related to FilmAndorra and the audiovisual sector that it considers may be of interest to you. No profiling will be carried out to personalise these communications unless you are specifically informed of it and there is an appropriate legal basis.

The legal basis for this processing is our legitimate interest in keeping you informed of the activities in which you have expressed an interest, taking into account the prior contractual relationship. You may object to this legitimate interest at any time using the unsubscribe link included in the communications or by contacting the point of contact indicated in this policy. Unsubscribing from communications will not affect any other services or processing that have their own legal basis.

To handle any future claims

We may retain, duly blocked where appropriate, the data strictly necessary to bring, exercise or defend claims or to respond to requests from competent authorities, on the legal basis applicable in each case.

To ensure the website works and to manage cookies and similar technologies

The website may use strictly necessary cookies or technologies to provide the requested features, maintain security, manage the session or remember options essential to the service.

Strictly necessary technologies are not subject to consent where the applicable legislation allows their use to provide the requested service. Where their use involves the processing of personal data, the corresponding legal basis will apply depending on the specific purpose.

You will find detailed and up-to-date information about these technologies in the Cookie Policy.

To obtain website usage statistics, if analytics tools are used

If analytics cookies or other technologies that are not strictly necessary are implemented, they will only be activated after consent has been obtained where it is required. The purpose, provider, duration and data processed will be set out in the Cookie Policy.

The fact that the final results are statistical or aggregated does not exclude the application of data protection legislation during the stages in which identifiers, IP addresses or other information that makes it possible to identify or single out a person are used.

Refusing non-necessary cookies will not prevent access to the essential features of the website, although certain optional third-party features may not be available.

You may change or withdraw your preferences at any time using the cookie settings tool available on the website.

Third-party content, features and technologies

If the website includes third-party content or features — for example, maps, videos, social media, anti-fraud services or analytics tools — these services may only process data under the conditions described in the Cookie Policy and, where necessary, after obtaining the corresponding consent.

Where a third party processes data for its own purposes, it will act as an independent controller in respect of that processing. Its identity and the purpose of the processing must be disclosed before the corresponding technology is activated.

No behavioural advertising technologies will be used and no data will be disclosed to advertising platforms unless these operations have previously been verified, disclosed and, where appropriate, consented to.

5. Who may we share your personal data with?

We do not sell personal data. Depending on the processing, the data may be disclosed or made accessible to the following categories of recipients:

• Suppliers that provide services on behalf of the controllers, for example email, newsletter delivery, hosting, IT support or security, where necessary to provide the service and subject to the corresponding data processing agreement safeguards.
• Public administrations, authorities, courts or other recipients where disclosure is required by a legal obligation or is necessary to bring, exercise or defend claims.
• Other recipients to whom you expressly ask us to disclose data, or where disclosure is necessary to provide a service you have requested, always with the corresponding information and legal basis.
• Processors may only process the data in accordance with documented instructions, subject to a duty of confidentiality, appropriate security measures and control over any sub-processors.
• No data will be disclosed to advertising companies and no third-party advertising processing will be enabled unless it is actually implemented, described in the Cookie Policy and, where appropriate, consented to.
• Where a recipient or processor involves an international transfer of data, the safeguards provided for in articles 42 et seq. of the LQPD will be applied and data subjects will be informed where required.

6. How long do we keep your personal data?

We will keep data only for as long as necessary for the relevant purpose. Where erasure is appropriate and it is necessary to retain certain data in order to deal with liabilities or claims, such data will be kept blocked under the terms of article 30 of the LQPD.

Personal data that we process because it is necessary for the performance of a contract (art. 6.1.b of the LQPD) will be kept for as long as there is a mutual interest in maintaining the purpose of the processing and for the maximum legal period permitted by data protection legislation, including the limitation periods for legal actions in order to deal with any liability that may arise from the contractual relationship. When it is no longer necessary for any purpose, it will be erased using appropriate security measures that ensure its destruction.

Personal data that we process to comply with a legal obligation (art. 6.1.c of the LQPD) will be kept for as long as we are subject to that obligation.

During the retention periods established for filing or responding to possible complaints and/or the retention periods provided for by law, personal data will remain blocked and will only be made available to auditors, the competent Public Administrations and the Batllia (Court of First Instance), upon official request.

When an item of personal data is no longer necessary for any purpose, it will be destroyed using security measures appropriate to its sensitivity¹.

We will destroy any unnecessary or disproportionate personal data that may appear in the emails and instant messages we receive, or that we receive through the forms on our website, as soon as we receive it.

We will destroy (and rectify) any personal data that we find to be inaccurate as soon as we verify its inaccuracy.

7. What are your rights?

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, if so, to exercise the rights recognised by the LQPD under the applicable terms.

You can exercise your rights before Andorra Turisme, SAU, using the contact details given in section 2 of this policy or as described in more detail below. If your data has been disclosed to a production company or another recipient acting as an independent controller, you must exercise the rights relating to the processing that recipient carries out on its own account before that recipient.

Below we set out the main rights and how to exercise them.

Your rights

You may ask us to give effect to the following rights:

• Access to your personal data.
• Rectification of inaccurate or incomplete personal data.
• Erasure of personal data when the legal requirements are met.
• Restriction of processing in the cases provided for by law.
• Objection to the processing of your personal data.
• Data portability where the processing is based on consent or on a contract and is carried out by automated means, under the terms provided for by the LQPD.
• The right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, in the cases provided for by law.

Where processing is based on consent, you may withdraw it at any time as easily as you gave it. Withdrawal will not have retroactive effect and will not affect the lawfulness of processing carried out before withdrawal.

Where and how you can exercise your rights

You can exercise your rights by sending a request to dpo@andorraturisme.ad, preferably with the subject line “Exercise of personal data protection rights”.

If we are unable to verify that you are who you say you are, we will ask you to kindly send us proof of your identity, so that we can make sure we respond only to the data subject or their legal representative.

If the person sending the email does so as the representative of the data subject, the representative’s authority must be evidenced by legal documents or instruments that correctly identify the data subject and the representative and specify the mandate or procedure for which representation is delegated, as well as its scope.

Finally, and especially if you consider that you have not obtained full satisfaction in the handling of the exercise of your rights, please note that you may lodge a complaint with the national supervisory authority of your country, or contact the Andorran Data Protection Agency (APDA) for this purpose.

Forms for exercising your rights

To make it easier to exercise your rights, you can use the corresponding forms. Do not provide additional identification documents unless they are necessary to reasonably verify your identity or the representation claimed.

• Form for exercising the right of access
• Form for exercising the right to rectification
• Form for exercising the right to object (model A and model B)
• Form for exercising the right to erasure
• Form for exercising the right to restriction of processing
• Form for exercising the right to data portability
• Form for exercising the right not to be subject to automated individual decision-making

8. What are your responsibilities?

When you provide us with personal data, you must make sure that it is accurate, complete and up to date. If you notice that any data is incorrect or has changed, please let us know so that we can rectify it.

Do not provide personal data of third parties unless it is justified by the purpose of the service and you have a legitimate basis for disclosing it. When we receive data that has not been obtained directly from the data subject, the controllers will comply with the applicable duty to inform in accordance with article 17 of the LQPD, without prejudice to any obligations that may also apply to the person providing the data.

The professional services described are not designed to collect data from minors. Do not provide data of minors or of people who require legal representation unless it is strictly necessary and the corresponding authorisation or legal basis is in place.

9. How do we protect your personal data?

The controller will apply technical and organisational measures appropriate to the risk in order to protect the confidentiality, integrity, availability and resilience of personal data. Access will be limited to the people who need it to perform their duties. Suppliers that process data on behalf of the controllers must be bound by a data processing agreement in accordance with article 31 of the LQPD and by appropriate security and confidentiality obligations.

Access to systems and to the back office must be assigned by profile and in accordance with the principle of least privilege, maintaining the control, traceability and training measures appropriate to the risk.

In the event of a personal data breach, the controllers will assess it and comply with the documentation and notification obligations provided for by the LQPD. Where the breach is likely to result in a high risk to the rights and freedoms of the data subjects affected, they will be informed without undue delay, unless a legal exception applies.

Where anonymised data is used, appropriate techniques will be applied so that the person cannot be identified by reasonably available means, and the risk of re-identification will be reviewed when the context or technological developments so warrant.

10. Changes to this Privacy Policy

This policy will be updated when necessary to reflect legislative, organisational or technological changes or changes in processing activities. No amendment to the policy will be used to retroactively extend a purpose based on consent without obtaining, where necessary, new valid consent.

Where changes are substantial, the people affected will be informed through appropriate means before the changes take effect, where required. The current version and the date of the last update will remain available on the website.

If you have any questions about this policy or about the processing of your personal data, you can contact dpo@andorraturisme.ad.

Last updated: 12 October 2026