How Fan Films handles faces, data and rights
Everything a legal team or a fan needs to know, in one place. It covers the public demos on fanfilm.vsn.hr and ht.vsn.hr, and the rules every paid deployment follows.
Last updated: 29 September 2026
Who we are
Ulica jablanova 31, 31000 Osijek, Croatia
VAT ID: HR83589860827
Email: office@vsn.hr · Web: vsn.hr
For the public demos, VSN is the data controller. In a paid deployment the sponsor or event organiser is usually the controller and VSN acts as processor under a written data processing agreement.
Privacy notice: Hero Film demo
This applies when you take a selfie in the Hero Film demo (for example at ht.vsn.hr/hero). The Choice Film demo collects no personal data; your taps stay in your browser.
What we process
- Your selfie, sent from your phone to our server only to make your film.
- A numeric face template calculated from the selfie. Under the GDPR this counts as biometric data, a special category of personal data.
- Your personal film clips and fan card, which show your face on the hero.
- Technical data such as your IP address, which the network and hosting providers listed below process when you load the page.
Why, and on what legal basis
Only to create your personal film and fan card, on the basis of your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), which you give by ticking the consent box before the camera starts. You must be 16 or older. Without consent you can still play the demo with the stand-in hero.
What we do not do
- We do not store your selfie. It is held in memory only while the face template is calculated.
- We do not identify you. The face template is used only to place your face on the hero. It is never compared with other people or with any database.
- We do not give your face, template or films to any sponsor or third party, and we do not use them to train AI models.
- We do not use them for advertising, profiling or automated decisions about you.
How long we keep it
The face template and your personal clips are deleted automatically within 3 hours. The fan card is created on your phone. It stays with you and is not stored by us.
Where it is processed, and who helps us
| Provider | Role | Data |
|---|---|---|
| VSN, own GPU server in Croatia (EU) | Makes your film | Selfie (in memory only), face template, clips |
| Cloudflare, Inc. | Hosts the pages and carries the connection to our server | IP address and encrypted traffic, including the selfie in transit |
| Google (Google Fonts) | Delivers the page fonts | IP address |
Cloudflare and Google may process data outside the EU. They do so under the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
Your rights
You can withdraw consent at any time: close the demo and nothing more is processed. You have the right to access, correction, erasure, restriction and objection. Because everything is deleted within 3 hours and we do not know who you are, after that time we hold nothing that could be linked to you. For any request, write to office@vsn.hr. You can also complain to the Croatian data protection authority, AZOP (Agencija za zaštitu osobnih podataka, azop.hr).
AI disclosure
Hero Film and Choice Film use generative AI. The films, the stadium scenes and the hero characters in our examples are AI-generated, and the faces of the stand-in heroes do not belong to real people. In the Hero Film, AI places the fan's face on the hero.
Every personal film and fan card is labelled as AI-generated, in line with the transparency rules for synthetic content in the EU AI Act (Art. 50). The label cannot be switched off in a deployment.
Model licensing
| Component | Used for | Licence |
|---|---|---|
| InsightFace models: InSwapper, SCRFD, ArcFace | Face placement, detection and alignment | Research and non-commercial licence. Used in the public demos only. |
| GFPGAN 1.4 | Face detail restoration | Apache 2.0, commercial use permitted |
| Generated film footage | Stadium scenes and heroes | Created by VSN on paid generation plans that include commercial use |
Paid deployments run only on commercially licensed models. Licensing for the face models is arranged before any paid event, and the client receives written confirmation.
What every paid deployment includes
- A data processing agreement between VSN and the client, plus a privacy notice written for the event.
- Explicit consent before the camera starts, with an age check (16+ or the local age of digital consent).
- An optional, separate consent for sponsor offers. It is never pre-ticked, and the face is never part of it.
- A fixed deletion period agreed with the client, 24 hours by default, with a written deletion confirmation after the event.
- Processing in the EU on dedicated GPU servers, and faces never used to train models.
- AI labelling on every personal film and card.
- A data protection impact assessment (DPIA), prepared with the client before the first event.
Trademarks and concepts
The examples on this site are concepts made by VSN on real brands to show the formats. The Aircash × Hellas Verona example was not commissioned by, and is not affiliated with, Aircash or Hellas Verona. The HT Hero example is a demo made for discussion with partners and is not a public Hrvatski Telekom or SuperSport HNL campaign. All trademarks and logos belong to their owners, are shown unchanged, and are used only to illustrate the formats.
Contact
Questions about privacy, licensing or a deployment: office@vsn.hr. Legal teams receive the full data flow and draft agreements in writing before any pilot.