Privacy Notice

The controller responsible for the processing described in this notice is SWLEF (Screen Works Licensing & Evidence Framework), Rue du Rhône 100, 1204 Geneva, Switzerland, as identified in the Impressum. For every question, request or complaint concerning personal data write to dmca@swlef.com (subject line “Data protection”) or to the postal address above. Every message to that address receives an automatic acknowledgment with a case reference; substantive answers to data-subject requests follow within 30 days.

SWLEF processes personal data of persons in the EEA and the United Kingdom in the course of offering its services to them; the GDPR therefore applies alongside the FADP under Art. 3(2) GDPR. SWLEF has not designated a representative in the EU under Art. 27 GDPR as the processing is occasional and does not involve large-scale processing of special categories of data; this will be reviewed if the scale changes.

SWLEF does not intentionally collect special categories of data (Art. 9 GDPR; “sensitive personal data” under the FADP). If such data is contained in documents you submit, it is processed only as part of those documents and only to the extent necessary for review.

Where processing is based on legitimate interests, SWLEF has balanced those interests against your rights: the registry’s purpose is to make reviewed evidence checkable by third parties, which requires that a limited, professional set of data about companies and works is public; private documents and identity data are never published.

A public Record shows: the Work’s title and catalogue metadata, the Company name and country, the registry ID, the status, the review summary (evidence submitted yes/no, chain of title reviewed, scope, validity dates, confidence, dispute state), the names of verified platform accounts, and the audit dates of status changes. A Certificate additionally shows the registry signature and fingerprint. Personal names appear on public Records only where they are part of the Work’s public credits (for example a director or recording artist) or where the Company has chosen to name its authorised representative on the Record.

Companies may set a Record to Gated (details visible to subscribers only) or PIN-locked (details visible only with a PIN issued by the company). Even for public Records, the underlying Evidence documents are never public.

SWLEF uses only cookies that are strictly necessary to operate the Service or that you have accepted. There are no advertising cookies and no cross-site tracking.

You can delete cookies at any time in your browser; the Service remains usable without the optional ones. The payment providers set their own cookies on their checkout pages under their own notices.

• Hosting. Dedicated servers located in the European Union (France), operated under SWLEF’s administrative control, with encrypted transport and daily backups.
• Payment processing. Stripe Payments Europe Ltd. and PayPal (Europe) S.à r.l. et Cie, S.C.A., as independent controllers for the payment transaction.
• Platforms. When you connect an account, the platform receives the OAuth request and learns that SWLEF requested verification of your account. SWLEF does not transmit your Evidence to platforms unless you ask it to or a dispute procedure requires it.
• Reviewers. SWLEF’s internal reviewers, bound by confidentiality, access Evidence on a need-to-know basis; every administrative action is logged.
• Counterparties in disputes. Where you file a notice, a counter-notice or an appeal, SWLEF may share your notice — including your name and contact details — with the party whose Record or material is concerned, as the procedure requires.
• Authorities and courts. Where a legal obligation, a court order or a substantiated request under applicable law requires disclosure.
• E-mail delivery. Transactional e-mail is sent from SWLEF’s own mail server with SPF, DKIM and DMARC.

SWLEF does not sell personal data, does not share it with data brokers and does not use it for third-party advertising.

Primary processing takes place in Switzerland and the European Union. Switzerland benefits from an EU adequacy decision, and the EU/EEA countries are recognised by the Swiss Federal Council as providing adequate protection. Where a processor transfers data to another country (notably payment providers and the platforms you choose to connect, some of which are established in the United States), the transfer relies on an adequacy decision (including the EU–US and Swiss–US Data Privacy Frameworks where the recipient is certified) or on the EU Standard Contractual Clauses supplemented for Swiss law.

Retention periods are set out in detail in the Data Retention Policy. In summary: account data for the life of the account and 90 days thereafter; Evidence for the life of the Record plus up to 10 years; registry Records for as long as they serve the verification function, with corrections recorded rather than deleted; accounting records 10 years (Swiss Code of Obligations Art. 958f); operational logs no longer than 30 days; correspondence with the rights and takedown desk for 5 years after the case is closed.

Subject to the conditions of the applicable law you have the right to:

• Access (Art. 15 GDPR; Art. 25 FADP): obtain confirmation of whether we process your data and a copy of it;
• Rectification (Art. 16 GDPR; Art. 32 FADP): have inaccurate data corrected;
• Erasure (Art. 17 GDPR): have data deleted where no legal ground for retention remains. Registry Records that third parties have relied upon may be retained in minimal form under Art. 17(3) GDPR as part of the registry’s verification function and for the establishment, exercise or defence of legal claims;
• Restriction (Art. 18 GDPR) and objection (Art. 21 GDPR) to processing based on legitimate interests;
• Portability (Art. 20 GDPR): receive the data you provided in a structured, machine-readable format;
• Withdrawal of consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal;
• Complaint to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern; in the EU/EEA the authority of your habitual residence or place of work; in the UK the Information Commissioner’s Office.

To exercise a right, write to dmca@swlef.com from the e-mail address of your account or provide information allowing us to identify you. We answer within 30 days; this may be extended by up to 60 further days for complex requests, in which case we tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.

• TLS encryption on every connection; HSTS; strict cookie attributes.
• Passwords stored only as bcrypt hashes; session tokens signed and expiring; administrative access restricted by role.
• Evidence documents stored outside the web root, access-controlled, fingerprinted with SHA-256 so that any alteration is detectable.
• Platform tokens encrypted at rest with AES-256-GCM using keys that are not stored in the database.
• Audit logging of every administrative action and every status change.
• Daily encrypted backups; separation of production and development environments; rate limiting and abuse detection on public endpoints.

No system is perfectly secure. If SWLEF becomes aware of a personal-data breach that is likely to result in a high risk to you, it will inform you and the competent authority as required by Art. 24 FADP and Art. 33–34 GDPR.

Status decisions on Records are taken by human reviewers. Some steps are system-assisted — duplicate detection, fingerprint matching, automatic checking of verification codes, sanctions-list screening — and the reviewer type shown on the Record (“internal”, “manual”, “system-assisted”) tells you which. No decision with legal or similarly significant effect is taken solely by automated means. SWLEF does not build marketing profiles.

The Service is intended for businesses and professionals. SWLEF does not knowingly collect personal data from persons under 16; if you believe a child has provided data, contact us and it will be deleted.

This notice is reviewed at least annually and whenever processing changes materially. The version number and effective date at the top identify the current text; account holders are notified by e-mail of material changes. Earlier versions are available on request.