PRIVACY POLICY
Last updated: 1 October 2026
1. Who we are
This Privacy Policy explains how personal data is collected, used, stored and otherwise processed by:
46NORTH SRL
trading as Annapurna Media
Via Rin 385
23041 Livigno (SO)
Italy
C.F. / P.IVA: 01106920144
PEC: 46north@pec.it
Privacy contact: admin@annapurnamedia.org
For the purposes of applicable data protection legislation, including Regulation (EU) 2016/679 ("GDPR"), 46NORTH SRL is generally the data controller for personal data that Annapurna Media processes for its own business purposes.
Annapurna Media also provides marketing, creative, photography, film, production, digital and related services to clients. In those circumstances, Annapurna Media may process personal data on behalf of a client and under the client's instructions. Where this applies, the client may be the data controller and Annapurna Media may act as a data processor. The respective responsibilities will be determined by the applicable service agreement and, where required, a separate Data Processing Agreement ("DPA").
The GDPR requires organisations to provide information about their processing in a concise, transparent and understandable manner. European Commission
2. What personal data we collect
Depending on how you interact with Annapurna Media, we may collect different categories of personal data.
Information submitted through questionnaires and forms
We may collect information that you provide through questionnaires, enquiry forms, onboarding forms and other forms used by Annapurna Media.
This may include:
name and surname;
company or organisation;
job title or professional role;
email address;
telephone number;
company website;
social media accounts;
business and marketing information;
information about your organisation, products and services;
information about your marketing objectives;
information about your target audiences;
information about your current marketing activities;
information about your content, advertising and communication requirements;
information about budgets, timelines and commercial requirements;
information required to prepare proposals or provide services;
information required for client onboarding and administration;
information concerning billing and invoicing;
technical information concerning digital platforms and accounts;
information relating to access and permissions for platforms such as Meta, Google and other services;
any other information that you voluntarily provide through the relevant form.
Some questionnaires may contain free-text fields. Please do not voluntarily provide special-category personal data or other sensitive information unless Annapurna Media specifically requests it and provides an appropriate legal basis and instructions.
3. Personal data relating to clients, employees, collaborators and production activities
In the course of providing our services, we may process personal data relating to:
clients and prospective clients;
client representatives and employees;
suppliers and contractors;
photographers, filmmakers and other creative professionals;
models and other participants in productions;
event participants;
individuals appearing in photographs or video;
other individuals whose personal data is provided to us by a client or production partner.
Depending on the circumstances, this may include names, contact details, professional information, photographs, video recordings, voice recordings, production information and other information necessary to carry out a project.
Where Annapurna Media processes such information solely on behalf of a client, the client may be the data controller and Annapurna Media will process the information according to the client's documented instructions and the applicable contractual arrangements.
4. Photography, video and other visual material
Photography and video production are an important part of Annapurna Media's services.
Photographs and video recordings may contain identifiable individuals. Where a person can be identified, such material may constitute personal data under applicable data protection legislation.
Depending on the circumstances, Annapurna Media may process such material:
on behalf of a client;
for the performance of a production contract;
where required for legitimate business purposes;
where consent or another appropriate legal basis applies;
for agreed portfolio, promotional and marketing purposes.
Where appropriate, model releases or other permissions are obtained before or during production.
Model releases
Where Annapurna Media is responsible for obtaining a model release, the signed release is generally collected and retained in physical form at the registered office of 46NORTH SRL.
Annapurna Media does not routinely maintain a digital copy of such physical model releases.
The physical documents are retained for as long as reasonably necessary to establish, exercise or defend legal rights and to demonstrate the permissions obtained in relation to the relevant production.
5. How we collect personal data
We may collect personal data:
directly from you;
through our website;
through enquiry and questionnaire forms;
through client onboarding forms;
through email;
through telephone or other direct communication;
through social media platforms;
through meetings and production activities;
from our clients;
from suppliers and production partners;
from publicly available professional or business sources;
through third-party digital services used to deliver our services.
Where personal data is obtained from a source other than the individual concerned, we will provide the applicable information required by the GDPR unless a lawful exception applies. European Commission
6. Why we use personal data
We process personal data for purposes including:
Enquiries and business development
To:
respond to enquiries;
understand a prospective client's requirements;
assess potential projects;
prepare proposals and quotations;
communicate with prospective clients;
arrange meetings;
negotiate and enter into contracts.
Providing our services
To:
plan and deliver photography, film and creative productions;
provide marketing and advertising services;
manage social media activities;
create and manage digital campaigns;
develop websites and digital products;
provide strategic and creative consultancy;
manage production logistics;
communicate with clients and suppliers;
manage approvals and project administration.
Client onboarding and administration
To:
establish client accounts;
obtain information necessary to deliver contracted services;
manage billing and invoicing;
administer payment arrangements;
establish access to third-party platforms;
manage authorised users and permissions;
maintain business records.
Marketing
Where permitted by law, we may use personal data to communicate with existing or prospective clients about Annapurna Media's services, news, projects and other relevant business information.
Where we send marketing newsletters or similar electronic communications on the basis of consent, we only send them to individuals who have previously opted in to receive them.
Recipients may withdraw their consent at any time, including through the unsubscribe mechanism contained in marketing communications.
Portfolio and promotional activities
Where permitted by our contractual arrangements with clients, we may use completed client work for Annapurna Media's own:
website;
portfolio;
social media;
presentations;
pitch decks;
awards submissions;
case studies;
marketing;
promotional materials.
The contractual arrangements with clients determine the circumstances in which Annapurna Media may use client work for these purposes.
Legal and administrative purposes
We may process personal data where necessary to:
comply with legal obligations;
maintain accounting and tax records;
establish, exercise or defend legal claims;
prevent fraud or misuse;
protect our rights and property;
respond to lawful requests from authorities.
7. Legal bases for processing
Depending on the circumstances, Annapurna Media may process personal data on one or more of the following legal bases under Article 6 GDPR:
performance of a contract or taking steps at the request of an individual before entering into a contract;
legal obligation, where processing is required by law;
legitimate interests, where processing is necessary for legitimate business interests and those interests are not overridden by the rights and freedoms of the individual;
consent, where consent is required or where we choose to rely upon it;
another lawful basis available under applicable data protection legislation.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
8. AI-assisted processing
Annapurna Media uses artificial intelligence tools as part of its internal business and service-delivery workflows.
For example, information submitted through our questionnaires may be processed using the Anthropic API to assist with activities such as:
organising questionnaire information;
summarising information;
identifying business and marketing requirements;
analysing responses;
developing strategic recommendations;
preparing internal briefs;
assisting with proposals and other business documents.
AI systems are used as tools within Annapurna Media's workflows. AI-generated outputs may be reviewed, amended or rejected by human members of our team.
Information sent to AI systems
Questionnaire information may be transmitted to Anthropic for processing through its API.
We do not intend to send information to an AI system where it is unnecessary for the particular processing purpose.
For example, information such as payment details, tax information or other administrative information is not required for a marketing-strategy analysis and should not be included in an AI processing request where it is unnecessary.
Anthropic states that commercial products, including its API, do not use customer inputs and outputs to train its models by default, unless the customer explicitly opts in or another permitted circumstance applies. Anthropic Trust Center
Anthropic may nevertheless process information in accordance with its own contractual, security and privacy documentation. Consequently, the use of AI does not mean that questionnaire information is necessarily processed exclusively within the European Union.
Where applicable, Annapurna Media relies on contractual data-protection arrangements and appropriate safeguards for transfers of personal data outside the European Economic Area.
9. Our technology providers
Annapurna Media uses a number of third-party technology services to operate its business and provide services to clients.
These may include:
Fillout – questionnaires and forms;
Airtable – structured business and client information;
Anthropic – AI-assisted processing;
n8n – workflow automation;
Hostinger – hosting infrastructure for n8n;
Google Workspace / Gmail – business email and collaboration;
Microsoft 365 / Microsoft PowerPoint – document and presentation production;
Meta – Instagram, Facebook, Meta Business and advertising services;
Google Ads – advertising;
Google Analytics – website and digital analytics;
Google Search Console – website search-performance information;
Google Search Consoleaccounting and invoicing platforms;
CRM and business-management systems;
email marketing services;
other technology providers required for specific client projects.
The specific services used may vary depending on the services purchased by a client.
Where a third-party provider processes personal data on our behalf, we seek to use providers that provide appropriate safeguards and enter into appropriate contractual arrangements where required.
The GDPR requires controllers to use processors that provide sufficient guarantees and requires appropriate contractual arrangements governing processor processing. Eur-Lex
10. Airtable and international data transfers
Annapurna Media currently uses Airtable to store and manage information collected through its questionnaires and other business workflows.
Our current Airtable account does not use Airtable's Enterprise Scale European Data Residency feature.
Accordingly, Airtable's default infrastructure means that relevant Airtable data is stored in the United States rather than exclusively within the European Union.
Airtable states that its default servers are located in the United States and that European Data Residency is available to Enterprise Scale customers. Airtable also provides a Data Processing Addendum containing contractual safeguards for international data transfers. Airtable Help Center
This means that information submitted through an Annapurna Media questionnaire may be transferred to and stored on infrastructure located outside the European Economic Area.
We do not represent that questionnaire data stored in Airtable is stored exclusively within the EU.
Where applicable, Annapurna Media relies on the contractual and legal mechanisms made available by the relevant provider for international transfers, including applicable Standard Contractual Clauses and other safeguards required under GDPR.
We may change our infrastructure in the future, including potentially moving to an EU data-residency configuration where commercially and operationally appropriate.
11. n8n and hosting
Annapurna Media uses n8n for workflow automation.
Our n8n environment is hosted through Hostinger.
n8n may process information necessary to perform automated workflows, including information relating to enquiries, clients, content, campaigns, analytics and other business processes.
Access to automated workflows is restricted to authorised users and systems.
Because hosting arrangements and infrastructure locations can change, the applicable hosting provider's current contractual and privacy documentation should also be considered when determining the precise location and international-transfer mechanism applicable to a particular processing activity.
12. Internal servers and production data
Annapurna Media stores photography, video and other production-related files on internal servers located at the registered office of 46NORTH SRL in Italy.
These servers may contain:
photographs;
video;
audio;
project files;
production materials;
client deliverables;
archival material;
other files generated or received during projects.
Access to internal production systems is restricted according to operational requirements.
Annapurna Media takes technical and organisational measures appropriate to the risks associated with the processing of personal data.
These measures may include access controls, authentication, permissions management, backups, system security and physical security.
The exact security measures may vary according to the system, nature of the data and risk involved.
The GDPR requires security measures appropriate to the risk, including measures addressing confidentiality, integrity, availability and resilience. Eur-Lex
13. Sharing personal data
We may disclose personal data to:
employees and authorised members of Annapurna Media;
photographers, filmmakers and other production personnel;
freelancers and contractors;
suppliers and service providers;
technology providers;
hosting providers;
cloud and software providers;
advertising platforms;
analytics providers;
accounting and professional advisers;
legal advisers;
insurers;
public authorities where legally required;
clients, where the processing is carried out as part of the relevant service;
other recipients where disclosure is necessary to provide a requested service or fulfil a contractual obligation.
We do not sell personal data to third parties.
Where a third party processes personal data on our behalf, we seek to ensure that appropriate contractual and organisational safeguards are in place.
14. International transfers
Some of the technology providers used by Annapurna Media may process personal data outside the European Economic Area.
This may include, depending on the service and configuration:
the United States;
the United Kingdom;
other countries in which relevant technology providers or their subprocessors operate.
Where personal data is transferred outside the EEA, we will seek to ensure that the transfer is carried out using a lawful mechanism under Chapter V GDPR.
Depending on the circumstances, this may include:
an adequacy decision of the European Commission;
Standard Contractual Clauses;
other appropriate safeguards recognised under GDPR;
another lawful transfer mechanism available under applicable law.
We do not claim that all personal data processed by Annapurna Media remains within the European Economic Area.
15. Data retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.
Retention periods depend on the nature of the information and the reason for processing.
For example:
Prospective clients and enquiries
Information relating to enquiries and prospective clients may be retained for as long as reasonably necessary to manage the business relationship, follow up on the enquiry and maintain appropriate commercial records.
Client information
Information relating to clients may be retained for the duration of the contractual relationship and subsequently for as long as necessary for accounting, legal, contractual, tax or dispute-resolution purposes.
Production material
Photography, video and other production material may be retained according to the relevant client contract, project requirements, archival requirements and legitimate business needs.
Accounting and tax records
Certain information must be retained for periods required by applicable Italian accounting and tax legislation.
Marketing subscriptions
Marketing information is retained while an individual remains subscribed or until consent is withdrawn, subject to any information that we are required or permitted to retain for other purposes.
Model releases
Physical model releases are retained for as long as reasonably necessary to establish or defend rights relating to the relevant production.
Where appropriate, personal data is deleted, anonymised or otherwise securely disposed of when it is no longer required.
16. Your rights under GDPR
Subject to the conditions and limitations provided by applicable law, you may have the right to:
obtain confirmation as to whether we process your personal data;
request access to your personal data;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to certain processing;
request portability of personal data in applicable circumstances;
withdraw consent where processing is based on consent;
object to direct marketing;
lodge a complaint with a competent supervisory authority.
These rights are not absolute and may be subject to legal exceptions or limitations.
For example, we may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.
17. How to exercise your rights
To exercise your data protection rights, contact:
Email: admin@annapurnamedia.org
Please provide enough information for us to identify you and understand your request.
We may need to verify your identity before responding to certain requests.
We will respond within the period required by applicable data protection law.
18. Right to complain
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent data protection supervisory authority.
For Italy, the relevant authority is:
Garante per la protezione dei dati personali
Website: Garante per la protezione dei dati personali
You may also contact a supervisory authority in another EU Member State where permitted by GDPR.
19. Direct marketing and newsletters
Annapurna Media may send marketing communications about its services, projects, news or related activities.
Where consent is required, marketing communications are only sent to individuals who have actively opted in to receive them.
Marketing recipients can unsubscribe at any time.
Every marketing email should contain an appropriate mechanism for withdrawing consent or unsubscribing.
Withdrawing marketing consent does not affect the lawfulness of processing carried out before withdrawal.
20. Cookies and website technologies
Our website may use cookies and similar technologies.
These technologies may be used for purposes including:
essential website functionality;
security;
website performance;
analytics;
understanding how visitors use the website;
advertising and marketing;
measuring advertising campaigns;
embedded content and third-party services.
Where required by applicable law, non-essential cookies and similar tracking technologies will only be activated after the appropriate consent has been obtained.
You may be able to manage cookie preferences through the cookie-management mechanism provided on the website and through your browser settings.
Because the specific technologies used on the website may change, the website's cookie configuration should be reviewed periodically to ensure that this Privacy Policy and any separate Cookie Policy remain accurate.
21. Third-party websites
Our website and communications may contain links to third-party websites or services.
Those websites operate independently from Annapurna Media and have their own privacy policies.
We are not responsible for the privacy practices, security or content of third-party websites.
We recommend reviewing the privacy policy of any third-party website before submitting personal data.
22. Data relating to children
Our services are primarily directed towards businesses, organisations and adults.
We do not intentionally collect personal data from children through our general business questionnaires.
Where children or minors appear in photography, video or other production work, their participation will be managed according to the circumstances of the production and any applicable parental or guardian consent requirements.
23. Special-category personal data
Annapurna Media's general business questionnaires are not designed to intentionally collect special-category personal data under Article 9 GDPR.
This includes information concerning matters such as:
health;
medical conditions;
racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade-union membership;
genetic data;
biometric data used for identification;
sex life or sexual orientation.
If you voluntarily provide such information in a free-text field, please understand that Annapurna Media did not request that information unless the relevant form specifically states otherwise.
Where special-category data is genuinely required for a particular project, it will only be processed where an appropriate legal basis and, where required, an Article 9 condition applies.
24. Automated decision-making and profiling
Annapurna Media may use artificial intelligence and automated workflows to assist with business processes.
For example, questionnaire information may be analysed automatically to help structure requirements or prepare strategic recommendations.
However, Annapurna Media does not intend to make decisions producing legal or similarly significant effects on individuals solely through automated processing of questionnaire information.
AI-generated or automated recommendations may be reviewed and modified by human personnel.
25. Data security
Annapurna Media takes the security of personal data seriously.
We use technical and organisational measures designed to protect personal data against:
unauthorised access;
accidental loss;
destruction;
alteration;
unauthorised disclosure;
misuse.
Measures may include:
access controls;
authentication;
restricted permissions;
secure connections;
physical security;
appropriate server security;
controlled access to internal production systems;
contractual controls with relevant suppliers;
data minimisation;
appropriate backup and recovery arrangements;
periodic review of systems and access.
Security measures are proportionate to the nature and risk of the processing.
No internet-based or electronic system can be guaranteed to be completely secure. Consequently, while we take appropriate measures to protect personal data, we cannot guarantee absolute security.
26. Data breaches
If Annapurna Media becomes aware of a personal-data breach, we will assess the incident and take appropriate steps in accordance with applicable data protection law.
Where GDPR requires notification to a supervisory authority or communication to affected individuals, we will make those notifications within the applicable legal requirements.
27. Client data and processor relationships
When Annapurna Media processes personal data solely on behalf of a client, the client may remain the data controller.
In those circumstances, Annapurna Media will:
process personal data according to the client's documented instructions;
only use the information for the agreed purposes;
apply appropriate technical and organisational security measures;
assist the client where required by GDPR;
use appropriate subprocessors where authorised;
maintain appropriate confidentiality obligations;
return or delete personal data where required by the contractual arrangement.
Where required by Article 28 GDPR, Annapurna Media and the relevant client will enter into an appropriate Data Processing Agreement.
28. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
Changes may be necessary because of:
changes to our services;
changes to our technology systems;
changes to our suppliers;
changes to applicable legislation;
changes to our data-processing practices;
changes to our website or digital services.
The most recent version will be published at:
www.annapurnamedia.org/privacy
The "Last updated" date at the beginning of this policy indicates when the policy was most recently revised.
29. Contact us
If you have questions about this Privacy Policy or how Annapurna Media processes personal data, please contact:
46NORTH SRL / Annapurna Media
Via Rin 385
23041 Livigno (SO)
Italy
Email: admin@annapurnamedia.org
PEC: 46north@pec.it
30. Questionnaire-specific privacy notice
When you complete an Annapurna Media questionnaire, the information you submit may be used to assess your requirements, prepare a proposal, communicate with you and, where you become a client, deliver the requested services.
Questionnaire information is stored in Airtable and may be processed through our automated workflows and AI systems, including the Anthropic API, where necessary for the purposes described in this Privacy Policy.
Because our current Airtable account does not use Airtable's European Data Residency feature, relevant questionnaire information may be stored on infrastructure located in the United States. Airtable confirms that US hosting is its default configuration and that European data residency is available on Enterprise Scale. Airtable Help Center
By providing information through the questionnaire, you acknowledge that you have been given access to this Privacy Policy and have had the opportunity to review how Annapurna Media processes the information you provide.
Where consent is legally required for a particular processing activity, the relevant consent will be requested separately.