This privacy notice relates to the provision of the “Madex” service by Vista Group (NZ) Limited (“Movio”"we""us" or “our”) located at Shed 12, City Works Depot, 90 Wellesley Street West, Auckland Central, Auckland 1010, New Zealand.
Madex is a digital advertising platform used by cinema companies (referred to as “Exhibitors”) and movie producers, studios, and distributors (referred to collectively as “Distributors”) which allows Distributors to advertise their movies to people based on data provided by the Exhibitors (the “Madex Service”) This notice provides details of the personal information that is used by Movio as a controller as part of the Madex Service, how that personal information is used, and who it is used by.
Movio processes personal data in providing the Madex Service to Distributors and Exhibitors, each of which are controllers of the relevant personal information provided to Movio in connection with the Madex Service. In providing the Madex Service, we act as a processor processing personal information for the purposes of providing the Madex Service, save where we process personal information for the purpose described below (please refer to the section “How is personal information used by Movio as a controller as part of the Madex service?” in this Privacy Notice for an explanation of how we process personal data as an independent data controller (the “Digital Audience Service”).
This Privacy Notice relates only to the processing of personal information by Movio as a controller in connection with the Madex Service. For information on our other processing of personal information such as when we collect, use and share personal information if you register with or use our website or services, work with us as a business partner, register or attend an event organised or hosted by us, apply for a job with us, or subscribe to our newsletters or other forms of marketing communications, please see our privacy policy at https://movio.co/privacy-policy for details regarding how we process personal information in those cases.
The Madex service processes the following personal information about moviegoers: (a) a unique ID (this is a pseudonymized identifier used to identify you without using obviously identifiable information such as your name and may be a hashed email address or phone number); (b) gender, (c) age; and (c) information regarding movies watched at the relevant Exhibitor’s cinema.
The above information is collected by Exhibitors, each acting as a data controller, as part of your membership to the Exhibitor’s loyalty programme or as part of your online or mobile ticketing account with the Exhibitor and/or newsletter subscriptions. Exhibitors provide this information to Movio to enable Movio to provide the Madex Service as further described below. The Exhibitors are responsible for ensuring that this information is collected and made available to us in compliance with all applicable data protection laws, including in respect of relying on an appropriate lawful basis, and their own privacy policies which are made available to you by them.
Movio acts as an independent data controller in respect of the Digital Audience Service i.e., when it applies its algorithms to the personal information described in the section above to create digital audience “segments” (referred to as “Audiences”), which create groups of moviegoers who it predicts share similar characteristics (such as being “likely” to see a particular movie). This is a form of profiling under the GDPR, but this process will not lead to any automated decision-making which will produce legal effects concerning you, or that similarly significantly affects you. This is the only processing activity that forms part of the Madex Service for which Movio acts as a data controller.
Where we process your personal information as an independent controller as described above, Movio relies on the legal basis of legitimate interests i.e., where the processing is necessary for the purposes of Movio’s, as well as the Exhibitors’ and Distributors’ legitimate interests in ensuring that advertising relating to movies is relevant and most likely to be of interest to moviegoers who are members of the relevant Exhibitor’s loyalty programme or who have a ticketing account with the Exhibitor and/or have subscribed to the Exhibitor’s newsletter.
The Madex Service then enables Distributors and Exhibitors to run targeted digital advertising campaigns in relation to their movies directed at particular Audiences on particular online channels (such as Facebook, Snap and Twitter) using the advertising products made available by these online channels (such as Facebook’s “Custom Audience” tool). Please note that Movio ensures that no moviegoer’s personal information is visible to, nor directly accessible by any of the Distributors or Exhibitors through their use of the Madex Service.
The below table provides an overview of the information we are required to provide you by law:
In addition to the above, we may also share your personal information within our group of companies and with our suppliers, business partners and service providers, where they are helping us to provide the Madex Service including the Digital Audience Service. This includes parties such as Amazon Web Services, Inc., Tableau Software, LLC, Urban Airship, ClickSend, Zendesk, Inc. and Pendo, Inc.
In the event that we sell any business or assets, we may disclose your personal information to the prospective buyer of such business or assets or if substantially all of our assets are acquired by a third party, we may transfer your personal information to the buyer. We may also disclose your personal information if we are required to do so to comply with any legal or regulatory obligation or request.
We take steps to ensure that the personal information we process is retained for only as long as it is necessary for the purpose for which it was collected. We will only retain your data for the period of time as authorised in accordance with our agreements with the relevant Exhibitors. After that period, it will be deleted (usually within 30 days) or in some cases anonymised.
The personal information that we collect may be transferred to, and stored at, a destination outside of your country of residence, including countries, which have less strict, or no data protection laws, when compared to your country of residence.
Whenever we transfer your personal information abroad, we will take steps which are reasonably necessary to ensure that adequate safeguards are in place to protect your personal information and to make sure it is treated securely. If you are located in the UK or EEA, we transfer your personal data outside of these regions in accordance with EDPB Adequacy Decisions, or using standard contractual clauses to provide the appropriate level of protection for your personal information in the recipient country. You may contact us using the contact details below for a copy of the safeguards which we have put in place to protect your personal information and privacy rights in these circumstances.
You have certain rights in relation to your personal information. These rights may be subject to limitations and restrictions applicable law. The rights include the right to object to the processing of your information where your information is processed on the lawful basis of legitimate interests, the right to access a copy of your personal information, and to erase, restrict processing of, restrict or receive a machine-readable copy of your personal information (data portability), the right to withdraw your consent from processing you previously consented to, and your right to lodge a complaint with your local supervisory authority. You should contact the relevant controller of your personal information in order to exercise your rights – in most cases, in relation to Madex, this will be the Exhibitor.
You also have the right to complain to a data protection authority if you think we have processed your personal information in a manner which is unlawful or breaches your rights. If you are in the UK, the data protection authority is the Information Commissioner’s Office (https://ico.org.uk/). If you are in Italy, the data protection authority is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it/). In Ireland, this is the Data Protection Commission www.dataprotection.ie We ask that you contact us in the first instance to give us an opportunity to address any concerns.
We may amend this notice from time to time to keep it up to date with legal requirements and the way we operate our business, and we will place any updates on this webpage. This service privacy notice was last updated on [Marketing to please insert date of upload]. Please regularly check this page for the latest version of this notice.
If you have any questions about the Digital Audience Service, you can contact our privacy team at privacy@movio.co. However, please note that if you have any concerns regarding the processing of your personal information as part of the Madex Service generally, you should contact the relevant controller (which in most cases will be the Exhibitor). (Where Movio acts as processor, we are generally required to pass any such concerns we receive from individuals to the relevant controller and not deal with them ourselves directly.) You can also contact our Data Protection Officer (DPO) at dpo@vista.co.
We have appointed a representative in the EU: Vista Entertainment Solutions (NL) B.V., who can be contacted by email at EUprivacy@vista.co or in person / by post at TSH Collab Amsterdam City, Wibautstraat 131D, 1091 GL Amsterdam, Netherlands.
We have appointed a representative in the UK: Vista Group International (UK) Limited, who can be contacted by email at UKprivacy@vista.co or in person / by post at FORA, Thomas House, 84 Eccleston Square, London SW1V 1PX.
You may also contact our Data Protection Officer with queries regarding your privacy and/or personal data here: DPO.Vista@twobirds.com