Like most businesses, we hold and process a wide range of information, some of which relates to individuals who we engage to take part in our productions. Three Arrows Media is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations under the GDPR (General Data Protection Regulations).
This Privacy Notice explains the type of information we process, why we are processing it and how that processing may affect you.
The notice focuses on individuals who we are speaking to about potentially taking part in one of our productions, as well as those who actually take part in our productions. It also covers information on those who have previously taken part in our productions.
This Privacy Notice is set out in this document and the Supplementary Information attached to this document. In the Supplementary Information, we explain what we mean by “personal data”, “processing”, “sensitive personal data” and other terms used in the notice.
We process data for the purposes of our business including for development and production of programmes, broadcasting, distribution and marketing of those programmes.
The Supplementary Information provides more specific information on these purposes, on the type of data that may be processed and on the grounds on which we process data. See Legal grounds for processing personal data and further information on the data we process and our purposes.
Some of the personal data that we process about you comes from you. For example, your name, age and email address, mobile number. Other personal data about you is generated in the course of you taking part in the production.
If you are under 18 years of age we will need your parent/guardian’s permission before you provide us with any personal information.
Your personal data may be seen internally by relevant people working on the production. We may also pass your data outside the organisation, for example for distribution and marketing purposes and also to relevant bodies such as the Commissioning broadcaster.
Further information on this is provided in the Supplementary Information. See Where the data comes from and Who gets to see your data?
We do not keep your personal data for any specific period but will not keep it for longer than is necessary for our purposes.
In general, if you are chose to work on a production we will keep your personal data for so long as you take part in a production and for a period afterwards. If you are not chosen to take part in the programme we will only retain your personal data for a short period of time after our discussions have ended.
See Retaining your personal data – more information in the Supplementary Information.
We may transfer your personal data outside the EEA to processors in the US or to other jurisdictions to perform our business.
Further information on these transfers and the measures taken to safeguard your data are set out in the Supplementary Information under Transfers of personal data outside the EEA – more information.
You have a right to make a subject access request to receive information about the data that we process about you.
Further information on this and your other rights is in the Supplementary Information under Access to your personal data and other rights. We also explain how to make a complaint about our processing of your data.
In processing your personal data, we act as a data controller. Our contact details are as follows: Jon Hancock – jon.hancock@threearrowsmedia.com for Data Protection in the Company and address, Three Arrows Productions, Ellesmere House, 79 Hope Rd, Sale, Cheshire M33 3AW
This notice does not form part of your contract and does not create contractual rights or obligations. This Policy was last updated on 25th May 2018. It should be regarded as a living document that may be amended by us at any time, to ensure our ongoing compliance with The General Data Protection Regulations and the UK’s Data Protection Act 2018.
“Personal data” is information relating to you (or from which you may be identified) which is processed by automatic means or which is (or is intended to be) part of a structured manual filing system. It includes not only facts about you, but also intentions and opinions about you.
Data “processed automatically” includes information held on, or used on, a computer, laptop, mobile phone or similar device. It covers data derived from equipment such as access passes within a building, data on use of vehicles and sound and image data such as CCTV. It also covers video, audio and images captured as part of a production.
“Processing” means doing anything with the data, for example, it includes collecting it, holding it, disclosing it and deleting it.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership and genetic and biometric data are subject to special protection and considered by EU privacy law to be “special category data”.
References in this Contributor Privacy Notice to “work” or “services” (and similar expressions) include any arrangement we may have under which an individual provides us services in relation to a production. We use the word “you” to refer to anyone within the scope of this notice.
References to “Programmes” or “Productions” includes the development of the programme, the programme itself and/or series you have applied for, or been approached to appear in; and any re-edited, re-voiced, re-formatted, updated or compilation, or any other versions thereof, or further series or spin-off’s and/or other content.
Under data protection law, there are various grounds on which we can rely when processing your personal data. In some contexts more than one ground applies. We have summarised these grounds as Legal obligation, Legitimate Interests, To Perform the Contract and Consent and outline what these terms mean in the following table.
Term: Legal obligation
Ground for processing: Processing is necessary to comply with our legal obligations
Explanation: Ensuring that we perform our legal and regulatory obligations. For example, avoiding unlawful discrimination, ensuring a Safe working environment.
Term: Legitimate Interests
Ground for processing: Processing is necessary for our or a third party’s legitimate interests We or a third party have legitimate interests in carrying on, managing and administering our respective businesses effectively and properly, and in connection with those interests we process your data.
Explanation: Your data will not be processed on this basis if our or a third party’s interests are overridden by your own interests, rights and freedoms.
Term: To Perform the Contract
Ground for processing: Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
Explanation: To prepare and fulfill the contract between us we process your data.
Term: Consent
Ground for processing: You have given specific consent to processing your data
Explanation: In general, processing of your data in connection with the services you provide is not conditional on your consent, although there may be exceptions to this.
If we process sensitive personal data about you (which includes medical information, political opinions, sexual orientation), as well as ensuring that one of the grounds for processing mentioned above applies, we will make sure that one or more of the grounds for processing sensitive personal/special category data applies. In outline, these include:
More specific information on the reasons we process your personal data and examples of the data and the grounds on which we process data, are in the table below.
The examples in the table cannot, of course, be exhaustive. For example, we may also require criminal background checks for certain roles (for example those working with minors or vulnerable adults) and for contributors to certain programmes in development and production, or we may ask you to self-declare any criminal convictions or offences. If we require these checks we rely on the legal basis that is it is necessary to comply with statutory or regulatory requirements and obligations, and we are entitled to carry out a criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the programme. On occasions we may ask for your explicit Consent to such checks. Where we require criminal background checks the company has in place an appropriate policy document and safeguards, which we are required by law to have.
Where we need to ask you about sensitive information, e.g. criminal convictions, your health information, you do not need to provide this information to us. However, if you do not, you may be unable to take part in the programme.
Purpose: Potential Engagement and Actual Engagement Information concerning your application to take part in our productions and our assessment of it, your references, any checks we may make to verify your identify and information you have provided, or any other background checks. Including any information submitted by an agent on your behalf, if appropriate.
Examples of personal data that may be processed: This may include information we obtain from others, including publicly available and accessible directories and sources, social media platforms, tax authorities and governmental and regulatory authorities, fraud prevention and detection agencies and organisations. If relevant, depending on the nature of the programme, we may also process information that is special category/sensitive data, for example health information, political opinions, sexual orientation, religious beliefs and where relevant, criminal conviction and offences history (see above). If relevant we may also process information concerning your health and any disability you have in connection with any adjustments that need to be made to filming arrangements.
Grounds for processing: Legal obligation, Legitimate interests
Purpose: Evaluating your potential role on a production to enable its creation, broadcast, sale and distribution.
Examples of personal data that may be processed: Information connected with your potential role including, if you are in consideration for an on-screen or voiceover role, the processing of images/video/audio of you.
Grounds for processing: Legal obligation, Legitimate interests
Purpose: To Create a Contract with you, and, if appropriate, to pay you
Examples of personal data that may be processed: Information that is included in the contract and if appropriate your payment details
Grounds for processing: To Perform the Contract
Purpose: Contacting you or others on your behalf
Examples of personal data that may be processed: Your address and phone number, emergency contact information and information on your next of kin.
Grounds for processing: Legitimate interests
Purpose: Enabling the creation, sale and distribution / broadcast of a production you are taking part in (including online content, publicity and promotional materials)
Examples of personal data that may be processed: Information connected with your participation including, the processing of images/ video/ audio of you.
Grounds for processing: Legal obligation, Legitimate interests
Purpose: Physical and system security
Examples of personal data that may be processed: CCTV images. Records of use of swipe and similar entry cards.
Grounds for processing: Legal obligation, Legitimate interests
Purpose: Providing details in connection with your seeking to participate on other production
Information on your potentially or actually taking part in one of our other productions.
Grounds for processing: Consent, Legitimate interests
Purpose: Monitoring of diversity and equal opportunities
Examples of personal data that may be processed: Information on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability and age as part of diversity monitoring initiatives. Such data will be aggregated and used for equality of opportunity monitoring purposes. We are required to share aggregated and anonymised diversity statistics with regulators and commissioners under the ‘Diamond’ project, the system managed by the Creative Diversity Network, on behalf of the UK Broadcasters BBC, ITV, Channel 4, Sky and Channel 5/Viacom.
Grounds for processing: Legitimate interests
Purpose: Disputes and legal proceedings
Examples of personal data that may be processed: Any information relevant or potentially relevant to a dispute or legal proceeding affecting us.
Grounds for processing: Legitimate interests, Legal obligation
Purpose: Day to day business operations including marketing and where you travel on our behalf
Examples of personal data that may be processed: Information relating to your participation in a programme. This may include a picture or profile of you.
Information regarding your travel arrangements and location.
Grounds for processing: Legitimate interests
Purpose: Maintaining appropriate business records during and after your participation in a programme
Examples of personal data that may be processed: Information relating to your participation in one of our productions.
Grounds for processing: Legal obligation, Legitimate interests
Please note that owing to the fact that you may be appearing in one of our programmes, on some occasions we or third parties will rely upon exemptions to data protection rules in relation to journalistic freedom, the right to artistic expression or more generally, the right to freedom of expression (as mentioned in article 85 of the General Data Protection Regulation and in the UK’s Data Protection Bill section on the exemption for ‘journalistic, academic, artistic or literary purposes)’.
When you apply to be in one of our productions, and/or participate in one of our productions, the initial data about you that we process is likely to come from you, but we may also require references and information from third parties and carry out background checks.
For example, we will collect data from The Disclosure & Barring Service in respect of criminal convictions and offences.
Internal use: Your personal data may be disclosed within Three Arrows Media to our employees and staff working on your production. It may also be shared with the Company’s Business Affairs Team and any of our staff involved in commercial exploitation, finance (if appropriate), Health and Safety and Insurance.
Data will be stored in a range of different places, including on your application record, in management systems and on other IT systems (including email).
External use: We will only disclose your personal data outside the company if disclosure is consistent with a ground for processing on which we rely and doing so is lawful and fair to you. We may disclose your data if it is necessary for our legitimate interests as an organisation, or for the legitimate interests of a third party (but we will not do this if these interests are over-ridden by your interests and rights in particular to privacy).
Specific circumstances in which your personal data may be disclosed include:
Any Companies or Organisations and/or individuals with whom we share your Data will be required to comply with current Data Protection laws.
Your Data will not be subject to any automated decision making processes.
The company takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our staff and relevant third parties in the proper performance of their duties.
Although there is no specific period for which we will keep your personal data, we will not keep it for longer than is necessary for our purposes. In general, we will keep your personal data until the show has been produced and for a period afterwards. In considering how long to keep it, we will take into account its relevance to our business and your participation either as a record or in the event of a legal claim.
Personal data relating to contributors applications (if not successful) will normally be deleted after 12 months. If your application is successful, and your data is only useful for a short period (for example, CCTV images), we may delete it. Some data, such as production footage itself and credit information, will be kept indefinitely for as long as the Programme is being broadcast, distributed and/or exploited, as we have an ongoing legitimate interest in retaining the product.
Where we cannot specify a date for the destruction of your personal data, we will review our retention periods annually.
In connection with our business and for production, broadcasting, distribution, administrative, management, marketing and legal purposes, we may transfer your personal data outside the EEA to data processors in the US or to other jurisdictions in which we are established or where we have 3rd party service providers or business relationships. We will ensure that any transfer is lawful and that there are appropriate security arrangements and safeguards to protect your data.
We try to be as open as we reasonably can about your personal data that we process. If you would like specific information, please ask us.
You have a legal right to make a “subject access request”. If you exercise this right and we hold personal data about you, we are required to provide you with information, within a month, including:
If you make a subject access request and there is any question about who you are, we may require you to provide information so that we can satisfy ourselves as to your identity.
As well as your subject access rights, you may have a legal right to have your personal data rectified or erased, to object to its processing or to have its processing restricted.
If you have provided us with data about yourself you have the right to be given the data in machine readable format for transmitting to another data controller. This only applies if the ground for processing is Consent.
If we have relied on consent as a ground for processing, you may withdraw consent at any time – though if you do so that will not affect the lawfulness of what we have done before you withdraw consent.
If you have complaints relating to our processing of your personal data, you should raise these with your key contact at the production in the first instance.
You may also raise complaints with your statutory regulator, which in the UK is the Information Commissions Officer.
