Effective Date:
Last updated:
This Privacy Policy for the Provincetown Film Society, a Massachusetts nonprofit organization (“PFS”, “We,” “Us,” or “Our”), describes how we collect, use, and share your information when you visit our website at www.provincetownfilm.org, purchase tickets to the Provincetown International Film Festival and Waters Edge Cinema screenings or other events, or buy merchandise from us online or in person at our cinema, festival box office or merchandise tables.
We appreciate your trust in sharing your personal information with us. Please read this Privacy Policy (“Policy”) carefully before using our website or making a purchase. If you do not agree with any terms in this policy, please discontinue use of our website and services. By using our website or making a purchase, you are accepting and consenting to the practices described in this Policy.
1. Who We Are
PFS is a 501(c)(3) nonprofit organization dedicated to celebrating the art of cinema and supporting the Provincetown International Film Festival and year-round Waters Edge Cinema. Our principal place of business is located at 237 Commercial Street, 5th Floor, Provincetown, MA 02657.
2. Information We Collect
We collect information to fulfill orders, process ticket purchases, operate our festival and cinema, and improve your experience with us. The categories of information we collect include:
a. Information You Give Us Directly
Account and contact information:
- Full name
- Mailing address (for merchandise shipping)
- Email address
- Phone number
Ticket and event purchases:
- Cinema tickets and Festival pass and individual ticket selections
- Screening preferences and attendance history
- Accessibility or accommodation requests
- Guest names for group or gift ticket orders
Merchandise purchases (online and in-person):
- Billing and shipping address
- Order details (item, size, quantity, color)
- Gift recipient information if applicable
Payment information:
- Credit or debit card number, expiration date, and security code
- Billing address associated with your payment method
- PayPal or other digital wallet identifiers (where applicable)
Note: We do not store full payment card details on our servers. All payment transactions are processed through PCI DSS-compliant third-party payment processors. See Section 7 below for details.
Donations and membership:
- Donation amounts and designations
- Membership tier selections
- Donor acknowledgment preferences (e.g., anonymous giving)
Communications:
- Messages or inquiries submitted through our contact form, email, or social media
- Volunteer applications and filmmaker submission materials
b. Information We Collect Automatically
When you visit our website, we may automatically collect:
- Device and browser information: IP address, browser type and version, operating system, device identifiers
- Usage data: Pages visited, time spent on pages, links clicked, referring URLs, and search terms used on our site
- Location data: General geographic location inferred from your IP address (city/region level only; we do not collect precise GPS location)
- Transaction data: Items viewed, added to cart, or purchased
- Cookies and tracking technologies: See Section 5 below for full details
c. Information We Collect from Third Parties
We may receive information about you from:
- Payment processors (e.g., Stripe, Square, PayPal) confirming transaction status
- Ticketing platforms (e.g., Eventive, Eventbrite) if you purchase through an integrated platform
- Email marketing services (e.g., Mailchimp, Constant Contact) regarding your subscription preferences and engagement
- Social media platforms if you interact with our pages or use social login features
- Analytics providers (e.g., Google Analytics) that report aggregated information about how visitors use our site
We do not purchase or obtain data from data brokers or third-party data marketplaces.
3. How We Use Your Information
We use the information we collect for the following purposes:
To process transactions and fulfill orders:
- Process ticket purchases and deliver electronic or physical tickets
- Fulfill merchandise orders, including shipping physical goods (t-shirts, hats, and other items) to your address
- Process in-person purchases at our cinema, festival box office and merchandise tables
- Send order confirmation and shipping notifications
- Handle returns, exchanges, and refunds in accordance with our Refund and Exchange Policy
To operate the Provincetown International Film Festival and Waters Edge Cinema:
- Manage festival pass and badge access
- Manage cinema tickets and access
- Communicate screening schedules, venue changes, and event updates
- Coordinate volunteer and filmmaker participation
- Facilitate accessibility accommodations
To manage your account:
- Create and maintain your online account
- Enable order history and repeat purchases
- Manage membership and donor records
To communicate with you:
- Respond to inquiries, support requests, and feedback
- Send transactional emails (receipts, shipping confirmations, ticket delivery)
- Send festival newsletters, program announcements, and event invitations (with your consent or as permitted by law)
- Notify you of changes to our policies or services
To process PFS donations and memberships:
- Record and acknowledge charitable contributions
- Issue donation receipts for tax purposes (as required for 501(c)(3) organizations)
- Manage membership benefits and renewals
For legal and compliance purposes:
- Comply with applicable federal, state, and local laws
- Maintain financial records as required by nonprofit accounting standards and IRS regulations
- Respond to lawful requests from government authorities
To improve our services:
- Analyze website usage patterns and sales trends
- Evaluate and improve our festival programming, merchandise offerings, and website functionality
- Conduct internal research and reporting
4. Legal Basis for Processing (EU GDPR/ UK GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases as required by the European Union General Data Protection Regulation (EU GDPR) and United Kingdom General Data Protection Regulations:
- Performance of a contract: Processing necessary to fulfill your ticket or merchandise purchase, deliver your order, or provide festival access you have paid for.
- Legitimate interests: Processing necessary for our legitimate interests as a nonprofit organization, such as fraud prevention, website security, and improving our services, where these interests are not overridden by your rights.
- Legal obligation: Processing required to comply with applicable laws, including tax and accounting requirements, IRS nonprofit reporting obligations, and responses to lawful legal processes.
- Consent: Where we rely on your consent — such as for marketing emails or non-essential cookies — you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
5. Cookies and Tracking Technologies
What Are Cookies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function efficiently and to provide reporting information to site operators.
Types of Cookies We Use
A full list of all cookie types available in use can be found on our cookie policy page.
Your Cookie Choices
You may control cookie settings through:
- Our website utilizes CookieYes to facilitate consent management; you are free to adjust these choices at any point by accessing the “Cookie Settings” link located in our footer.
- Your browser settings (most browsers allow you to refuse or delete cookies)
- Third-party opt-out tools such as the Google Analytics Opt-Out Browser Add-on
Please note that disabling certain cookies may affect the functionality of our website, including the ability to complete purchases.
Do Not Track
We honor “Do Not Track” (DNT) signals sent by your browser. When a DNT signal is detected, we will not deploy non-essential tracking cookies during your session.
6. Ecommerce and Ticket Sales — Specific Disclosures
Online Merchandise Store
When you purchase merchandise (t-shirts, hats, and similar items) through our online store, we collect the information necessary to process your payment, fulfill your order, and arrange shipping or local pickup. We retain order records for accounting, customer service, and legal compliance purposes.
Shipping: We share your name and shipping address with our shipping carrier(s) solely for the purpose of delivering your order. Carriers may retain shipment records in accordance with their own privacy policies.
Returns and exchanges: Our Refund and Exchange Policy governs the return and exchange of merchandise. To process a return or exchange, we may need to verify your original order details.
In-Person Purchases at Our Cinema
When you purchase tickets or merchandise in person at our cinema box office or merchandise tables, we may collect your name and payment information at the point of sale. If you use a credit or debit card, that transaction is processed through a PCI DSS-compliant point-of-sale system. We do not retain full card numbers from in-person transactions.
If you request a receipt by email, we will collect your email address for that purpose.
Festival and Cinema Tickets and Passes
When you purchase tickets or passes for festival or cinema screenings and events, we collect the information necessary to process your order, issue your tickets or credentials, and communicate event information to you. Your attendance information may be used in aggregate, anonymized form for internal reporting and grant applications.
If you purchase tickets as gifts for others, we will use the recipient’s name and email only to deliver their tickets and will not add them to our marketing lists without their independent consent.
Box Office and Walk-Up Sales
Ticket purchases made directly at our festival box office may be recorded with name and contact information for will-call purposes, accessibility accommodations, or at your request for receipt delivery.
7. Payment Processing and Security
We do not store, process, or transmit full payment card numbers on our own servers. All payment card transactions are handled by PCI DSS-compliant third-party processors. Depending on the transaction channel, processors may include:
- Stripe — online store and website checkout
- Square — in-person point-of-sale at cinema and festival venues
- PayPal — alternative online checkout option
- Eventive — festival ticket purchases through our ticketing platform
Each of these processors has its own privacy policy governing the data they collect during payment processing. We encourage you to review their policies.
We use SSL/TLS encryption for all data transmitted between your browser and our website. Sensitive data at rest is encrypted where technically feasible.
8. How Long We Retain Your Information
We retain your personal information only as long as necessary for the purposes described in this Policy, or as required by law.
| Data Type | Retention Period |
| Order and transaction records | 7 years (IRS/accounting requirements) |
| Donation and gift records | 7 years (nonprofit compliance) |
| Customer accounts | Duration of account, plus 2 years after last activity |
| Email marketing records | Until you unsubscribe or request deletion |
| Festival attendance records | 3 years for operational purposes |
| Cookie and analytics data | As configured per tool (typically 13–26 months) |
| In-person transaction logs | As required by point-of-sale system and accounting needs |
When we have no ongoing legitimate business or legal need to retain your information, we will delete or anonymize it. If deletion is not immediately possible (e.g., data stored in backup archives), we will securely isolate the data until deletion is possible.
9. How We Share Your Information
We do not sell your personal information. We share your information only in the following limited circumstances:
Service providers: We share information with vendors who help us operate our website and services, including payment processors, shipping carriers, email marketing platforms, ticketing systems, and website hosting providers. These vendors are contractually required to use your data only to provide services to us and to maintain appropriate security standards.
Ticketing platform partners: If you purchase tickets through an integrated platform such as Eventive, that platform processes your transaction and shares fulfillment data with us. Their use of your data is also governed by their own privacy policy.
Legal obligations: We may disclose your information when required by law, court order, subpoena, or lawful request from government authorities, including requests related to national security or law enforcement.
Nonprofit reporting: Aggregate, anonymized attendance and sales data may be included in grant reports, impact statements, and annual reports. Individual personal information is never included in public-facing reports.
Organizational succession: In the unlikely event of a merger, acquisition, or transfer of organizational assets, your information may be transferred as part of that transaction. We will notify you via email or prominent website notice before your information becomes subject to a materially different Policy.
With your consent: We may share your information with third parties for purposes not described here when we have obtained your explicit consent to do so.
10. Your Privacy Rights
For All Users
Regardless of your location, you have the right to:
- Know what personal information we hold about you
- Request correction of inaccurate information
- Opt out of marketing communications at any time by clicking “unsubscribe” in any email we send, or by contacting us directly
- Request deletion of your account
California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know: The categories and specific pieces of personal information we have collected about you, the categories of sources, and the purposes for collection
- Right to delete: Request deletion of personal information we have collected, subject to certain exceptions
- Right to correct: Request correction of inaccurate personal information
- Right to opt out of sale or sharing: We do not sell or share personal information for cross-context behavioral advertising
- Right to not be discriminated or retaliated against: We will not discriminate or retaliate against you for exercising your privacy rights
To submit a CCPA request, contact us at [email protected] or at our mailing address. We will respond within 45 days.
EEA and UK Residents (EU GDPR/UK GDPR)
In accordance with Articles 12–23 of the GDPR, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you in a portable, accessible format
- Right to rectification: Request correction of inaccurate or incomplete personal data
- Right to erasure (“right to be forgotten”): Request deletion of your personal data where we no longer have a lawful basis to retain it
- Right to restrict processing: Request that we limit how we use your data in certain circumstances
- Right to data portability: Receive your data in a structured, machine-readable format to transfer to another controller
- Right to object: Object to processing based on legitimate interests or for direct marketing purposes
- Right to opt out of automated decision-making: We do not use your data to make solely automated decisions that significantly affect you
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact us using the details in Section 14 below. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.
11. Children’s Privacy
Our website and services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. Cinema and Festival events and programming may be attended by minors accompanied by a parent or legal guardian, but ticket purchases for minors must be completed by an adult.
If you are a parent or legal guardian and believe your child has provided us with personal information without your consent, please contact us at [email protected]. We will promptly investigate and, where confirmed, delete that information from our systems.
For users in the EEA and the UK, we comply with applicable age verification requirements under the GDPR and UK GDPR as they relate to children under 16 and 13, respectively.
12. Security of Your Information
We implement reasonable and appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. Our security practices include:
- SSL/TLS encryption for all data transmitted through our website
- PCI DSS-compliant payment processing (we do not store full card numbers)
- Access controls limiting PFS staff access to personal data on a need-to-know basis
- Regular review of our data collection, storage, and processing practices
- Secure deletion of personal data when no longer needed
No method of internet transmission or electronic storage is completely secure. While we strive to use commercially reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you and relevant authorities as required by applicable law.
13. Links to Third-Party Websites
Our website may contain links to external websites, social media platforms, or third-party services — including our ticketing partners, streaming platforms, and social channels — that are not operated by us. This Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit before submitting personal information.
14. Changes to This Privacy Policy
We may update this Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by updating the “Effective Date” at the top of this Policy and, where appropriate, by sending an email notification or posting a notice on our website.
We encourage you to review this Policy periodically. Your continued use of our website or services after changes are posted constitutes your acceptance of the updated policy.
15. Contact Us
For questions or concerns about this Privacy Policy, to exercise your privacy rights, or to make a data request, please contact us:
Provincetown Film Society
237 Commercial Street, 5th Floor
Provincetown, MA 02657
Email: [email protected]
Contact Form: https://www.provincetownfilm.org/about/contact/
We aim to respond to all privacy-related inquiries within 30 days.
This Privacy Policy was last updated on:
Provincetown Film Society is a registered 501(c)(3) nonprofit organization.