This policy explains what personal data we collect when you use stayhumane.film, why we collect it and what your rights are. We have kept it deliberately simple, because the site itself is simple: it collects very little, uses no advertising, counts visits only in an anonymous, cookie-free way, and only loads a third-party video player with your consent.
1. Who we are
The data controller for this website is Dr Imad Karam, a private individual operating as Stay Humane.
Cambridge, United Kingdom
Email: info@stayhumane.film
We are not required to appoint a data protection officer; please use the email address above for any question or request about your data.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). If you are in the European Economic Area, the EU GDPR gives you equivalent rights.
2. What we collect and why
Visiting the site
Our hosting provider automatically records technical access data for every request: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. These server logs are used only to keep the site secure and running — for example to detect attacks — and are kept for a limited period before being deleted. They are not combined with any other data and we do not use them to identify visitors.
Lawful basis: our legitimate interest in operating the website securely (Article 6(1)(f) UK GDPR).
Contact form
When you use the contact form we receive your name, email address and message. They are emailed to us so that we can reply, and a copy is kept on the website for 90 days and then deleted automatically. Our email correspondence with you is kept for as long as needed to deal with your enquiry and normally deleted within 12 months of our last exchange. The form is protected against spam by a hidden "honeypot" field and a submission limit; no CAPTCHA or third-party service is involved.
Lawful basis: our legitimate interest in answering your enquiry (Article 6(1)(f)).
Newsletter and screening alerts
If you enter your email address in the newsletter form, we first send you an email with a confirmation link. Only when you open that link are you subscribed (double opt-in); addresses that are not confirmed are deleted after seven days. Subscribers receive occasional news about the films and an alert when a new screening is announced. Every email contains a link that unsubscribes you with one click, and you can also write to info@stayhumane.film. We keep your address until you unsubscribe. Emails are sent from our own mail server — no third-party mailing service is used.
Lawful basis: your consent (Article 6(1)(a) UK GDPR and regulation 22 PECR), which you can withdraw at any time.
Donations
Donations are processed by PayPal under PayPal's own privacy statement (PayPal (Europe) S.à r.l. et Cie, S.C.A.). The payment buttons on our Support page are loaded from PayPal only after you press "Continue to PayPal"; from that moment PayPal may set its own cookies. If you choose a monthly donation, PayPal collects it each month until you cancel, which you can do at any time in your PayPal account. We never see your card or bank details. PayPal tells us your name, email address and the amount so that we can thank you and keep the records the law requires; we keep those records for as long as accounting rules require, normally six years. See the PayPal privacy statement.
Lawful basis: our legitimate interest in receiving and acknowledging donations, and our legal obligations (Article 6(1)(f) and (c)).
Visitor statistics
To understand which films and pages people find useful, we count visits with Matomo, an open-source statistics tool that runs on our own server. No data goes to Matomo's makers or to any other company. It works without cookies and stores nothing on your device. For each visit it records the pages viewed, whether a film was played or a form was sent, the referring website, the type of device and browser, the approximate country and a shortened IP address (the last two parts are removed before storage), so the figures cannot be traced back to you and you are not recognised from one day to the next. Detailed visit records are deleted after 180 days; only totals are kept. If your browser sends a "Do Not Track" signal, your visits are not counted, and you can switch the counting off for this browser here: do not count my visits.
Lawful basis: our legitimate interest in improving this website (Article 6(1)(f) UK GDPR); under regulation 6 PECR, as amended by the Data (Use and Access) Act 2025, statistics of this kind do not require consent.
Screening requests
If you use the Request a screening form, we receive your name, organisation, email address, optional phone number and the details of your plans, and use them only to answer your request and arrange the screening. A copy is kept on the website for 90 days and then deleted automatically.
Lawful basis: steps taken at your request before entering into an agreement, and our legitimate interest in answering you (Article 6(1)(b) and (f)).
Screenings and tickets
We do not sell tickets on this site. Where a screening is ticketed, the link takes you to the venue or organiser or to a ticketing platform (for example Humanitix or Eventbrite); their own privacy policy applies to your booking.
3. Watching the films
The short clip on our home page is stored on our own server: playing it sends no data to anyone else.
The films themselves are streamed from Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). Because Vimeo's player would receive your IP address and could set cookies, we do not load it until you agree. On each film page you will see a notice asking for your consent; only when you accept does the player load. You can withdraw your consent at any time via "Privacy settings" in the footer.
When the player loads, Vimeo receives your IP address, information about your device and browser, the page you are on and how you interact with the video, and may set cookies (see section 4). This means your data is transferred to the United States; Vimeo relies on safeguards such as standard contractual clauses for such transfers. We load the player in Vimeo's "do not track" mode, which switches off Vimeo's session tracking and its tracking cookie. Further information: Vimeo privacy policy and Vimeo cookie policy.
Lawful basis: your consent (Article 6(1)(a) UK GDPR and regulation 6 PECR).
People in our films
Our documentaries feature real people who chose to tell their stories on camera and took part with their informed consent. Their images and words appear on this site — in the films, in stills and in press material — for the purpose of presenting the films. If you appear in one of our films or in a photograph on this site and have a concern about how you are shown, please contact us and we will discuss it with you. We only publish photographs of identifiable people taken at our screenings and events with their permission.
4. Cookies
This site uses no advertising or tracking cookies, and our visitor statistics work without cookies. The only cookies are:
- klaro (set by this site, 180 days) — remembers your consent choice for the video player so that we do not ask you again on every visit. Strictly necessary; no consent is required for it.
- Session cookie (SESS…) (set by this site, only when an editor logs in to manage the site) — never set for ordinary visitors.
- player and vuid (set by vimeo.com, up to one and two years) — only after you have accepted the video player. "player" stores your playback preferences; "vuid" is Vimeo's tracking identifier, which our do-not-track setting asks Vimeo not to set.
You can delete cookies at any time in your browser settings and change your video consent under "Privacy settings" in the footer.
5. Who we share data with
We do not sell or rent personal data and do not share it with anyone for marketing. Our website and email are hosted by Namecheap, Inc. (Phoenix, Arizona, USA), which processes data on our behalf under its data processing addendum and standard contractual clauses; data is stored on Namecheap's servers in the United States. Vimeo and PayPal receive data only in the situations described above. We will disclose data where the law requires it.
6. How long we keep data
- Server logs: a limited period, deleted by the hosting provider.
- Visitor statistics: detailed records 180 days, anonymous totals after that.
- Contact form messages: 90 days on the website; related emails normally no longer than 12 months.
- Newsletter addresses: until you unsubscribe.
- Donation records: as long as accounting rules require (normally six years).
7. Security
The site is served over an encrypted connection (HTTPS) only. Access to its administration area is limited to named editors with strong passwords, the software is kept up to date and regular backups are made. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your data.
8. Your rights
Under the UK GDPR you have the right to ask us for access to the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. Write to info@stayhumane.film; we will respond within one month and there is no fee. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, telephone 0303 123 1113 — though we would welcome the chance to resolve your concern first.
9. Children
This website is not directed at children under 13 and we do not knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we will delete it.
10. Changes to this policy
This policy was last updated in September 2026. We will update it whenever the way this site processes data changes.