Privacy Policy

For the purposes of the GDPR and similar laws, Esha Bargate Productions, LLC is the “data controller” (or “data fiduciary” under the DPDP Act) responsible for your personal information.

You can contact us at:

• ▸General inquiries: contact@eshabargateproductions.com
• ▸Careers: eshabargateproductions@gmail.com
• ▸WhatsApp: +1 510-953-2966
• ▸Location: San Francisco, CA, United States

We collect the following categories of personal information:

a) Information you provide directly:

• ▸Contact / “Send a Message” form: When you complete the contact form on our Site, we collect your name, email address, and the details of your project or inquiry. All fields on this form are required.
• ▸Newsletter subscription (“The EBP Dispatch”): When you subscribe to our monthly newsletter, we collect your email address.
• ▸Career inquiries: When you send your reel and résumé, we collect your name, email address, and any information contained in the materials you submit.
• ▸Investor, distribution, licensing, and partnership inquiries: When you contact us by email or WhatsApp about investor relations, screenings, catalog requests, brand placement, or collaborations, we collect your name, contact details, and the contents of your communication.

b) Information collected automatically:

• ▸Analytics and usage data:Our Site is hosted on Vercel and may use Vercel Web Analytics and Vercel Speed Insights, which are privacy-focused, cookieless analytics tools. Per Vercel's published Data Point Information, these tools collect anonymized, aggregated data points including event timestamp, page URL and dynamic path, referrer, filtered query parameters, approximate geolocation (to city level, e.g., “US, California, San Francisco”), device operating system and version, browser and version, and device type (mobile/desktop/tablet). This data is not tied to or associated with any individual, customer, or IP address.
• ▸Server and hosting logs: As our hosting provider, Vercel processes technical data including IP addresses and system configuration information in the course of delivering the Site.

c) Cookies and similar technologies:

See Section 6 below.

We do not knowingly collect special categories of sensitive personal data through the Site, and we ask that you do not submit such information through our forms.

We use your personal information to:

• ▸Respond to your inquiries and communicate with you about projects, collaborations, investment, distribution, licensing, and partnership opportunities;
• ▸Send you our newsletter and marketing communications where you have requested them;
• ▸Review and respond to career and talent submissions;
• ▸Operate, maintain, secure, and improve our Site and understand how visitors use it;
• ▸Comply with legal obligations and enforce our terms; and
• ▸Protect against fraud, security incidents, and misuse of the Site.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.

Where the GDPR or UK GDPR applies, we rely on the following legal bases under Article 6:

• ▸Consent (Art. 6(1)(a)): for sending you our newsletter and marketing emails, and for any non-essential cookies or analytics where consent is required. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• ▸Performance of a contract or steps prior to a contract (Art. 6(1)(b)): to respond to your inquiries and take steps at your request before entering into any engagement.
• ▸Legitimate interests (Art. 6(1)(f)): to operate, secure, and improve our Site, respond to business inquiries, and understand site usage, provided these interests are not overridden by your rights and freedoms.
• ▸Legal obligation (Art. 6(1)(c)): where we must process data to comply with applicable law.

Under India's DPDP Act, we process your personal data primarily on the basis of your consent or for a legitimate use, such as where you voluntarily provide your data for a specified purpose and have not indicated that you do not consent to its processing.

We may share personal information with:

• ▸Service providers and processors who help us operate our Site and business, including our hosting and analytics provider, Vercel Inc., and any email or form-handling services we use to receive and respond to messages;
• ▸Professional advisers such as lawyers and accountants where necessary;
• ▸Authorities or third parties where required by law, regulation, legal process, or to protect our rights, safety, or property; and
• ▸Successors in connection with a merger, acquisition, financing, or sale of assets, subject to the protections described in this Policy.

We do not sell or rent your personal information to third parties.

Our Site is built with Next.js and hosted on Vercel. Vercel Web Analytics and Speed Insights are designed to be cookieless — they do not use cookies and instead, per Vercel's documentation, identify visitors using a temporary hash created from the incoming request; that hash “is valid for a single day, at which point it is automatically reset,” and the data is automatically discarded after 24 hours and is not tied to your identity or IP address.

We may use strictly necessary cookies or local storage required for the Site to function. If we deploy any non-essential or analytics cookies that require consent under the EU ePrivacy Directive and GDPR, we will request your consent through a cookie banner before they are placed, with “Accept” and “Reject” options of equal prominence, granular control by purpose, and the ability to withdraw consent at any time.

You can also control cookies through your browser settings. For EU/EEA and UK users, where consent is required, non-essential cookies will not be set until you provide it.

We are based in the United States, and our hosting provider Vercel processes data primarily in the United States and may process it elsewhere in the world. As a result, your personal information may be transferred to, stored in, and processed in countries other than your own, which may have different data protection laws.

Where we transfer personal data out of the EU/EEA, the UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's 2021 Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum (IDTA). In addition, per Vercel's Privacy Policy, “Vercel complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce,” providing an additional recognized transfer mechanism for personal data sent to the United States. The U.S. Federal Trade Commission has jurisdiction over Vercel's DPF compliance.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• ▸Contact and inquiry data: retained for as long as needed to handle your inquiry and our ongoing relationship, and for a reasonable period thereafter to address follow-up questions or disputes.
• ▸Newsletter data: retained until you unsubscribe or withdraw consent.
• ▸Career submissions: retained for the duration of any consideration process and a reasonable period thereafter, unless you ask us to delete them.

When personal data is no longer required and no legal basis exists to retain it, we will delete or anonymize it.

Depending on where you live, you may have some or all of the following rights:

GDPR / UK GDPR (EU, EEA, UK):

• ▸The right to be informed;
• ▸The right of access;
• ▸The right to rectification;
• ▸The right to erasure (“right to be forgotten”);
• ▸The right to restrict processing;
• ▸The right to data portability;
• ▸The right to object; and
• ▸Rights related to automated decision-making and profiling.

You also have the right to withdraw consent at any time and the right to lodge a complaint with your local supervisory authority (for example, in Ireland the Data Protection Commission, or in the UK the Information Commissioner's Office).

California (CCPA/CPRA):

• ▸The right to know/access the personal information we collect, use, and disclose;
• ▸The right to delete personal information;
• ▸The right to correct inaccurate personal information;
• ▸The right to opt out of the sale or sharing of personal information (note: we do not sell or share personal information);
• ▸The right to limit the use of sensitive personal information (we do not use sensitive personal information for purposes requiring this right); and
• ▸The right to non-discrimination for exercising your rights.

We honor recognized opt-out preference signals such as Global Privacy Control (GPC) where applicable.

India (DPDP Act):

You have the right to access a summary of your personal data and processing activities, the right to correction and erasure, the right to grievance redressal, and the right to nominate another individual to exercise your rights in the event of death or incapacity. You may withdraw consent at any time, and we will provide a means to do so.

Other jurisdictions:

For example, Brazil's LGPD, Canada's PIPEDA, and US state privacy laws such as those in Virginia, Colorado, Connecticut, Texas, Oregon, and others: You may have comparable rights to access, correct, delete, port, and object to the processing of your personal information, and to withdraw consent.

To exercise any of these rights, contact us at contact@eshabargateproductions.com. We will respond within the timeframes required by applicable law (generally within 30 to 45 days, extendable where permitted). We may need to verify your identity before fulfilling your request, and we will not discriminate against you for exercising your rights.

Our Site is intended for a general, professional audience and is not directed to children. We do not knowingly collect personal information from children under the age of 13 (or under the applicable age of digital consent in your jurisdiction, which may be up to 16 in the EU/EEA). Under India's DPDP Act, individuals under 18 are treated as children, and verifiable parental or guardian consent is required before processing their personal data. If you believe a child has provided us with personal information without appropriate consent, please contact us and we will delete it promptly.

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. Our Site is served over encrypted HTTPS/TLS connections.

Our hosting provider, Vercel, maintains industry-standard security practices. Per Vercel's Security & Compliance Measures documentation, “Vercel has a SOC 2 Type 2 attestation for Security, Confidentiality, and Availability” and “Vercel is ISO 27001:2022 certified” (the ISO 27001 certification was audited by independent assessor Schellman). Vercel maintains customer data in an encrypted format at rest using AES-256 and in transit using TLS 1.2 or higher.

However, no method of transmission or storage over the Internet is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify the relevant supervisory authorities and affected individuals where and within the timeframes required by applicable law.

Our Site links to and references third-party platforms and services, including Apple TV, Google TV, IMDb, WhatsApp, social media platforms, and calendar/scheduling tools. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your personal information.

If you subscribe to our newsletter or otherwise opt in to marketing, you can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us directly. We will honor opt-out requests promptly (and, in any case, within 10 business days as required under the US CAN-SPAM Act). In accordance with the CAN-SPAM Act and similar laws, our marketing emails will identify us as the sender, use accurate subject lines and header information, include a valid physical postal address, and provide a clear means to opt out. We will not charge a fee or require information beyond your email address to honor an opt-out request.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated version on this page and revise the “Last Updated” date above. Where a change materially affects how we use your data or alters the basis on which you provided consent, we will notify you and, where required by law, obtain fresh consent.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: