PRIVACY AND DATA PROTECTION POLICY

1. We at Creative Studios are the data controller. Our contact details are:

Telephone 07812078635
Email: creativestudiosmedia@gmail.com

This Privacy Policy explains how we will use any personal data we collect, use and store about you.

What data we collect about you
2. We collect your personal data when you register for access to an online photo gallery, place an order in the on line photo gallery, place an order for delivery of a video via an on line streaming service, or when you book us for any other of our services.

3. We collect the following personal data in order to provide customers with the service(s) they require:
o Full name and/or Business Name and contact details (home address; business address; home and mobile telephone numbers; email address and age / date of birth where applicable).

The purpose of collecting your data
We only process your personal data as is necessary:

4. For legitimate interests including:
o Your email addresses for access to on line photo galleries to notify you of when it is ready to view or about to expire.
o Your email addresses for access to on line video streaming service “MediaZilla” so that you can take ownership and view your videos in your own private library.
o Transferring digital files (e.g. artwork) to you that are part or the product or services we offer to you.
o A photograph may in some instances constitute a form of personal data where they can be processed to allow “the unique identification or authentication of a natural person”. Creative Studios will never photograph an individual as a means of unique identification or authentication unless consensually contracted to do so. Performers at events or shows appear in photos or video taken by Creative Studios as a part of service we provide on the basis of 'legitimate interests', unless there is a good reason to protect a given individual’s personal data which overrides this legitimate interest. Operating within the parameters of legitimate interests as laid out in GDPR legislation, the disproportionate effort involved in providing privacy policy information to all performers at an event and the degree to which it would distract us from performing our job renders it infeasible to do. Event organisers are therefore requested to gain consent from all performers and/or parents/guardians of performers.
o Communications, such as newsletters, notices and updates. This includes email and telephone communication such as text messaging and also the use of social media (Facebook, Twitter and Instagram) to keep you up to date with data on our products and services.
o For record keeping such as ordering of products or services.
o For surveys, market research and developing statistical data that allow us to improve our services.
o You have the ‘right to object’ to all legitimate interests relating to you.

5. To comply with a legal obligation including:
o Compliance with legal and regulatory requirements and related disclosures e.g. HMRC.
o Exercising your rights under data protection law and making rights’ requests.
o Verifying your identity under data protection law, other legal and regulatory requirements and related disclosures.
o The establishment and defence of legal claims and rights.

6. Based on your consent (please note that withdrawal of consent from one activity does not mean withdrawal from other activities you’ve given consent to. Withdrawal of consent may also affect what we can do for you) including:
o Sending you marketing, advocacy and other communications about Creative Studios.
o Photographs, video and audio recordings for use in Creative Studios publications, publicity materials and online platforms including websites and social media (Facebook, Twitter and Instagram). All rights to any photographs, videos and audio recordings remain the property of Creative Studios.

Who we share your data with
7. We do not share any personal data with third parties unless we are required to do so by law or for any of the following reasons:
o You have entered your email address for access to an online photo gallery via a third party provider Shootproof (www.shootproof.com). This includes placing an order for photographs through the online store Shootproof. Shootproof's Privacy Policy can be found here:
https://www.shootproof.com/legal/privacy-policy
o We are required to take payment via debit or credit card via our on line photo gallery third party provider Shootproof. Your card payment is taken via a thiord party merchant Braintree Payments A Pay Pal Service (www.braintreepayments.com). Braintree Payments Privacy Policy can be found here:
https://www.braintreepayments.com/en-gb/legal/braintree-privacy-policy
o We are required to send large files related to the products or services you have purchased. We use a third party file transfer service called WeTransfer. WeTransfer's Privacy Policy can be found here:
https://wetransfer.com/legal/privacy
o We are required to send digital artwork (e.g. publicity posters) to print using a third party professional printing service provider. This service provider may vary based on providing you with the best service possible.
o You have provided your email address to us which we have then shared with our online “MediaZilla” for you to take ownership of the video in your “MediaZilla” library, via a third party video stream service provider “MediaZilla” (www.mediazilla.com).
o We are required to send digital for duplication or print using a third party professional printing service provider. This service provider may vary based on providing you with the best service possible.
o Government bodies and agencies in the UK: Disclosure and Barring Service for DBS checks and the Data Commissioner’s Office.
o Anyone else where we have your consent or as required by law.

How long we hold your data for
8. We will hold your personal data for as long as is necessary to meet the purpose for which it was originally collected. For on line photo galleries this is typically when the gallery is deleted after it has expired.

9. Where you have given your consent for collecting your personal data, we may hold it for as long as your consent is not withdrawn.

10. Where you have given consent for direct marketing, we will stop processing your data once we receive a withdrawal of your consent.

11. Where we may have collected your personal data to meet a legal obligation (e.g. HMRC) we will hold your data in accordance with the retention periods given by legal and regulatory bodies and subject to the exceptions below.

12. Exceptions: We may hold your personal data for longer than originally collected for archiving, keeping statistical data, to defend or make a legal claim or for as long as a claim may be brought against us or made by us and/or in accordance with legal and regulatory requirements.

Your rights
13. Right to be informed: You have the right to be informed about the collection and use of your personal data. This Privacy Policy notice meets this.

14. Right to access your personal data and rectify it: You have the right to confirm that your data is being processed and to access the data we hold about you. You have the right to have inaccurate data rectified or completed if it is incomplete. You can make these requests verbally or in writing. We will aim to provide these requests separately within one month following the date of your access or rectification request or three months if it is complex to provide it.

15. Right to erasure (the “right to be forgotten”): You have the right to have your data deleted by us:
o Your personal data is no longer necessary for the purposes we originally collected it for.
o You have informed us that you’ve withdrawn your consent and we do not have any legal grounds to continue to hold your data.
o You object to direct marketing from us.
o You object to any of the legitimate interests for collecting personal data.
o We did not collect your data lawfully.
o Where we must comply with legal and regulatory requirements.
o We give emphasis to personal data collected from children where they may have joined social media groups and/or may no longer be a child as they may not have been aware of the risks at the time they may have given consent to us.
o You right to erasure may not apply where we hold your data for one of the following reasons:
o To exercise the right of freedom of expression and data as follows:
o To comply with a legal obligation.
o For the performance of a task carried out in the public’s interest or in the exercise of official authority.
o For archiving purposes in the public interest, scientific or historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of these purposes
o For the establishment, exercise or defence of legal claims.
o Where your right to erasure applies we will aim to provide this request within one month following the date of your request or three months if it is complex to provide it.

16. Right to restrict processing: You have the right to request that we only store your personal data but not use it. You can make this request verbally or in writing. Where an erasure request is manifestly unfounded or excessive we may charge a fee or refuse to respond. Where we refuse to respond we will explain why and you have the right to complain to the Data Commissioner’s Office. This right only applies where:
o You contest the accuracy of your personal data and we are working to verify the accuracy of your data.
o We did not collect your data lawfully.
o We no longer need your personal data, but you need us to keep it to establish, exercise or defend a legal claim.
o You have objected (see “right to object”) to us using your personal data and we are considering whether our legitimate grounds override the nature of the objection.
o We will not process your restricted data in any way except to store it, unless:
o You give your consent to continue processing it.
o It is for the establishment, exercise or defence of a legal claim.
o It is for the protection of the rights of another person (natural or legal).
o It is for reasons of important public interest.

17. Right to object: You have the right to object to:
o Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); direct marketing (including profiling); and holding data for purposes of scientific/historical research and statistics.
o You must have “grounds relating to your particular situation” in order to exercise your right to object to processing for research purposes. If we are conducting research where the processing of personal data is necessary for the performance of a public interest task, we are not required to comply with an objection to the processing.
o Right to object to processing our legitimate interests and the performance of a legal task: You have the right to object to:
o Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling).
o You must have an objection on “grounds relating to your particular situation”. We will stop processing your personal data unless:
o We can demonstrate compelling legitimate grounds for holding your data after considering your rights and expectations;
o It is for the establishment, exercise or defence of a legal claim.
o You have the right object to direct marketing. We will stop processing your personal data purposes as soon as we receive an objection.

18. Right to data portability: You have the right to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The right to data portability only applies:
o To personal data an individual has provided to us;
o Where the processing is based on the individual’s consent or for the performance of a contract; and when processing is carried out by automated means.
o We are only able to provide some personal data in Microsoft Excel / CSV format and are unable to provide data portability for data outside this.
o We will aim to provide this request within one month following the date of your request or three months if it is complex to provide it. If we are unable to meet your request we will explain why and you have the right to complain to the Data Commissioner’s Office.

Security
19. We are committed to ensuring that your data is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the data we collect.
20. We try where possible to only hold data digitally that is password protected, however we do at times use paper copies of information and these are stored securely in locked cabinets when not in use.

How we use cookies
21. A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular website. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering data about your preferences.
22. We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this data for statistical analysis purposes and then the data is removed from the system.
23. Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any data about you, other than the data you choose to share with us.
24. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites
25. Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any data which you provide whilst visiting such sites and such sites are not governed by this privacy policy. You should exercise caution and look at the privacy policy applicable to the website in question.

How to contact us
26. For data protection matters, you can contact us:

Creative Studios
Telephone 07812078635
Email: creativestudiosmedia@gmail.com

How to complain
27. You can complain to us using our “How to contact us” details above. You also have the right to complain to the Data Commissioner’s Office. It has enforcement powers and can investigate compliance with data protection law: ico.org.uk

This privacy policy was last updated on 25th July 2021.