Privacy Policy

Last updated 15 October 2026

This policy explains what personal data we collect through chubbyfilms.com, why, and what you can do about it. It follows the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Italian Privacy Code (Legislative Decree 196/2003).

Who is responsible

The data controller is Chubby Films S.r.l., registered office Via Giacomo Chilesotti 30, 36075 Montecchio Maggiore (VI), Italy, VAT no. IT04302890241 — [email protected]. Write to that address for anything about your data.

What we collect

When you send an enquiry

The Enquire form asks for your name, your email address and a description of your project. You may also tell us your company, what you need, a budget range or your timing. We also record the page the form was sent from, the date and time, and a one-way, salted hash of your IP address. The hash cannot be turned back into the address; we use it only to block repeated automated submissions, and we delete it after 24 hours.

Name, email and message are needed to answer you: without them we cannot reply. Everything else is optional.

When you apply to work with us

The Work with us form asks for your name, your email address and a few words about yourself. You may also tell us the role you are interested in, the city you are based in, a link to your portfolio or showreel, and attach your CV as a PDF. We record the same technical details as for an enquiry (page, date and time, and the hashed IP address, deleted after 24 hours). Please do not include in your CV information we do not need, such as health data, religious or political beliefs, or ID numbers.

When you browse

Like any website, the servers that deliver the site receive technical data such as your IP address, browser type and the pages requested. Our hosting provider processes it to deliver the pages and protect them from abuse; we do not use it to identify you.

Analytics, only if you allow it

If you accept analytics cookies in the cookie banner, the site loads Google Analytics, which tells us how many people visit, which pages they see, roughly where they come from (country and city, from an IP address Google does not store), which device and browser they use and whether they sent an enquiry. We see these figures only in aggregate, and we have switched off Google's advertising features (Google signals and ad personalisation). With the same consent the site also loads Microsoft Clarity, which records how pages are used (scrolling, clicks, mouse movements) as anonymous session replays and heatmaps, so we can see where the site is hard to use. Clarity hides the text on the page that could be personal, and the two forms are excluded entirely. Nothing you type in the forms is sent to Google or Microsoft. See the Cookie Policy.

Advertising measurement, only if you allow it

If you accept it in the cookie banner, the site loads the Meta Pixel, which tells Meta that you visited the site, which pages you saw and whether you sent an enquiry. We use it to measure and improve our advertising on Facebook and Instagram. We never send Meta the contents of either form (your name, email, message or CV). See the Cookie Policy.

When you write to us directly

If you email one of the addresses on the site, we receive your address and whatever you include in the message.

Why we use it, and on what legal basis

• To answer your enquiry and discuss a possible project: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• To consider your application for a role or a collaboration, now or in the following months: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR, and Art. 111-bis of the Italian Privacy Code for CVs sent on your own initiative).
• To keep the site and the form secure and free of spam: our legitimate interest (Art. 6(1)(f) GDPR).
• To understand how the site is used with Google Analytics and Microsoft Clarity: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can withdraw it at any time from Cookie settings at the foot of every page.
• To measure our advertising with the Meta Pixel: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can withdraw it at any time from Cookie settings at the foot of every page.

We do not sell your data, and we do not make decisions about you by automated means.

Who else handles it

We use a small number of providers who process data on our behalf, under contracts that bind them to our instructions:

• Cloudflare, Inc. — hosting, content delivery, security, and the database that keeps a copy of each enquiry and application, and the private storage that keeps the CVs.
• Resend (Plus Five Five, Inc.) — delivers enquiries to our inbox by email.
• Google (Google Workspace) — our email service, where enquiries and messages are received.
• Vimeo, Inc. — plays some of the films on the site. The player is loaded with Vimeo's do not track setting, so Vimeo does not set cookies or collect viewing statistics about you.
• Google Ireland Ltd. (Google Analytics) — only if you accept analytics cookies. Google processes the data on our behalf, under Google's data processing terms.
• Microsoft Ireland Operations Ltd. (Microsoft Clarity) — only if you accept analytics cookies. Microsoft processes the data on our behalf, under its data protection terms.
• Meta Platforms Ireland Ltd. — only if you accept advertising cookies. For collecting and transmitting the Pixel data, Meta and Chubby Films are joint controllers; what Meta does with the data afterwards is covered by Meta's Privacy Policy.

Inside Chubby Films, only the people who handle new projects read enquiries, and only the people who handle hiring read applications.

Transfers outside the European Economic Area

Some of these providers are based in the United States or may process data there. Transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

How long we keep it

• Enquiries and email exchanges: 24 months from our last contact, unless they lead to a working relationship, in which case we keep what the law requires for that relationship (for example, invoices for 10 years).
• Applications and CVs: 12 months from when you send them, then deleted, unless you are hired or you ask us to keep them longer. You can ask us to delete them sooner at any time.
• The hashed IP address: 24 hours.
• Google Analytics data: up to 14 months, then deleted by Google automatically.
• Microsoft Clarity data: session recordings 30 days, aggregated statistics and heatmaps up to 13 months.
• Meta Pixel data: see the Cookie Policy.

Your rights

You can ask us at any time to access, correct or delete your data, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what was done before. Write to [email protected] and we will answer within one month.

You also have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali, in the United Kingdom the Information Commissioner's Office.

Changes

We will update this page if the way we handle data changes. The date at the top shows the latest version.