1. Introduction and company information
This Privacy Policy explains how Northlight Virtual Production Studios Ltd collects, uses, discloses, stores, and protects personal data when operating its business as a virtual-production-studio, including through its website, communications, bookings, studio services, production support, and related activities.
Northlight Virtual Production Studios Ltd acts as the data controller in relation to personal data processed under this Privacy Policy, unless otherwise stated.
Company name: Northlight Virtual Production Studios Ltd
Address: Northlight VP Studio, 3B Trinity Street, Huddersfield, HD1 4DT, United Kingdom
Email: [email protected]
Phone: +44 1484 739 562
2. Data collection and processing
We may collect and process personal data directly from you, from your organisation, from our website, from email and telephone communications, from booking and production arrangements, and from third parties where lawful and appropriate.
The categories of personal data we may collect include:
- Identity data: name, job title, employer, professional role, and identifiers used in production and studio access.
- Contact data: email address, telephone number, postal address, and preferred communication details.
- Contract and booking data: enquiry details, quotations, scheduling information, service specifications, invoices, payment status, and contract records.
- Technical data: IP address, browser type, device information, operating system, and website usage data.
- Usage data: information about how you interact with our website, systems, and services.
- Production-related data: project instructions, call sheets, attendance records, access logs, content-related metadata, and studio usage information.
- Financial data: billing information, payment records, and tax-related information.
- Correspondence data: messages, feedback, complaints, and any information provided when contacting us.
- Security data: CCTV or access-control records where applicable and lawfully used for security purposes.
We do not intentionally collect special category data unless necessary and lawful for a specific purpose, such as where you provide it in the context of a production, access arrangement, or employment-related matter, and only where permitted by applicable law.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and provide quotations;
- to enter into and perform contracts for studio, production, or related services;
- to manage bookings, schedules, access, and on-site operations;
- to communicate with clients, crew, suppliers, and other stakeholders;
- to issue invoices, manage payments, and maintain financial records;
- to operate, maintain, and improve our website, systems, and services;
- to ensure health, safety, security, and site access management;
- to prevent fraud, misuse, and unauthorised access;
- to comply with legal, regulatory, tax, accounting, and contractual obligations;
- to preserve business records and manage disputes or claims;
- to send service-related updates and, where permitted, marketing communications;
- to analyse service performance and enhance the customer experience.
4. Legal basis for processing
Where applicable privacy law requires a legal basis for processing, Northlight Virtual Production Studios Ltd relies on one or more of the following:
- Performance of a contract: where processing is necessary to provide services, manage bookings, or fulfill contractual obligations.
- Legitimate interests: where processing is necessary for our legitimate business interests, such as operating and securing our studio, managing client relationships, improving services, and protecting our legal rights, provided those interests are not overridden by your rights and freedoms.
- Consent: where you have given clear consent, for example for certain marketing communications or optional data uses.
- Legal obligation: where processing is required to comply with applicable law, tax rules, accounting obligations, health and safety requirements, or lawful requests from authorities.
- Vital interests: where processing is necessary to protect someone’s life or physical safety in an emergency.
5. Data sharing and third parties
We may share personal data with trusted third parties where necessary and lawful for the purposes described in this Privacy Policy. These may include:
- IT, cloud hosting, website, and cybersecurity providers;
- payment processors, banks, and accountancy or payroll providers;
- professional advisers, including lawyers, auditors, and insurers;
- production crew, contractors, freelancers, and suppliers involved in a project;
- security, access-control, and facilities management providers;
- government bodies, regulators, law enforcement, and courts where required by law;
- marketing or communications service providers where relevant and lawful.
We require third parties to handle personal data in accordance with applicable legal requirements and only for authorised purposes. Where a third party acts as a data processor, we seek appropriate contractual protections.
6. Data transfer to third countries
Some of our service providers or project partners may be located outside the United Kingdom and may process personal data in countries that do not provide the same level of data protection as the United Kingdom.
Where we transfer personal data internationally, we will take steps designed to ensure that appropriate safeguards are in place, which may include:
- adequacy regulations or decisions where available;
- standard contractual clauses or equivalent transfer mechanisms;
- additional technical and organisational safeguards where appropriate;
- assessments of the recipient’s ability to protect the data.
You may contact us using the details below if you would like more information about international data transfers.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, reporting, and dispute-resolution requirements.
Retention periods depend on the type of data and the context in which it is used. In general:
- enquiry records are retained for a reasonable period after the last contact;
- contract and billing records are retained for the period required by law and business practice;
- production records are retained for as long as needed for project administration, legal compliance, and claims management;
- security and access records are retained for a limited period unless needed longer for an incident, investigation, or legal matter;
- marketing data is retained until you unsubscribe, object, or the data is otherwise no longer required.
When personal data is no longer needed, we will securely delete, anonymise, or archive it as appropriate.
8. User rights (access, rectification, erasure, restriction, data portability, objection)
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: to request confirmation of whether we process your personal data and to obtain a copy of it;
- Rectification: to request correction of inaccurate or incomplete data;
- Erasure: to request deletion of your personal data where lawful grounds apply;
- Restriction: to request that we limit processing in certain circumstances;
- Data portability: to request a copy of certain data in a structured, commonly used, machine-readable format, where applicable;
- Objection: to object to processing based on legitimate interests or to direct marketing at any time;
- Automated decision-making: to not be subject to decisions based solely on automated processing where applicable law gives you that right.
To exercise any of these rights, please contact us using the details provided in the Contact Information section. We may need to verify your identity before responding.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
If you withdraw consent, we may no longer be able to provide certain optional services or communications, where consent was the basis for that processing.
10. Right to complain
If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue.
You may also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In the United Kingdom, this is the Information Commissioner’s Office (ICO).
11. Data security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
These measures may include:
- access controls and role-based permissions;
- password protection and authentication measures;
- encryption where appropriate;
- secure storage and backup procedures;
- staff confidentiality obligations and training;
- physical security measures at our premises;
- procedures to manage and investigate security incidents.
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Contact information
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:
Northlight Virtual Production Studios Ltd
Northlight VP Studio, 3B Trinity Street, Huddersfield, HD1 4DT, United Kingdom
Email: [email protected]
Phone: +44 1484 739 562
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal obligations, or operational requirements.
Any revised version will be posted with an updated effective date where appropriate. We encourage you to review this Privacy Policy periodically to stay informed about how Northlight Virtual Production Studios Ltd processes personal data.