top of page

PRIVACY POLICY

Who This Policy Covers

This policy applies to:

  • Customers and prospective customers
     

  • Children taking part in our programmes
     

  • Parents and guardians
     

  • Partners and suppliers
     

  • Visitors to our website
     

 

Personal Data We Collect

We collect personal data directly from you when you enquire, book, communicate with us, or participate in our activities. This may include:

  • Names
     

  • Postal addresses
     

  • Phone numbers
     

  • Email addresses
     

  • Child participant names*
     

  • Child participant dates of birth*
     

  • Booking and purchase history*
     

*Customer-only information.

 

Sensitive (Special Category) Data

We collect special category data only when strictly necessary for safety, safeguarding, or urgent medical care. This includes:

  • Medical needs
     

  • Access requirements
     

  • Safeguarding considerations
     

We do not collect any other special category data such as racial background, religion, or biometric information.

 

Media Data (Images, Video, Audio)

Because we provide filmmaking activities, we routinely capture:

  • Video footage
     

  • Photographs
     

  • Audio recordings
     

These materials may appear in edited films, project outputs, behind-the-scenes content, and promotional materials (with consent where required).

 

Website and Cookie Data

When you visit our website, we collect:

  • Cookie preferences
     

  • Analytics and usage data
     

  • IP address and browser information
     

This information helps us improve our site. We do not share cookie data with external parties.

 

How We Collect Data

Data is collected when you:

  • Use our website enquiry forms
     

  • Make a booking through our online system
     

  • Contact us by phone or email
     

  • Participate in activities where filming and photography naturally occur
     

We never purchase external marketing lists and we never sell data.

 

Lawful Bases for Processing

Film Steps processes personal data under the lawful bases permitted by the GDPR.

Contractual necessity
To provide our services, manage bookings, communicate essential information, produce course outputs, and maintain operational records.

Legitimate interests
For activities essential to running our programmes, including internal filming required to produce projects, record-keeping, and non-marketing communications. We balance our legitimate interests with your rights and freedoms.

Consent
For email marketing, public-facing use of images, videos, or audio, and optional activities requiring explicit agreement. Consent can be withdrawn at any time.

Vital interests
For medical or safeguarding information needed to protect a child’s health or safety.

Legal obligation
For retaining financial, safeguarding, and business records as required by law.

 

How We Use Personal Data

We use data to:

  • Deliver our programmes safely and effectively
     

  • Communicate with parents and guardians
     

  • Produce films, photographs, and audio projects
     

  • Manage bookings and customer accounts
     

  • Send newsletters and marketing updates (with consent)
     

  • Maintain safeguarding records
     

  • Process payments securely
     

We do not use personal data for automated decision-making or profiling.

 

Sharing Personal Data

We only share data when necessary and appropriate, including with:

  • Venue partners for safety or safeguarding purposes
     

  • Emergency or safeguarding authorities
     

  • Secure payment processors
     

  • Contractors involved in editing or delivering course materials
     

  • Cloud or hosting providers such as YouTube for film project delivery
     

All partners operate under agreements requiring GDPR compliance.
We never sell personal data.

 

International Data Transfers

Some service providers may store data outside the UK/EEA.
When transfers occur, we ensure protection using:

  • UK adequacy decisions
     

  • Standard Contractual Clauses
     

  • Technical and contractual safeguards
     

 

How Long We Keep Personal Data

We retain data only as long as necessary.

  • Customer contact, booking, and payment details: usually seven years for legal and tax purposes.
     

  • Medical and safeguarding information: kept only as long as required for safety, and may be retained longer if safeguarding rules apply.
     

  • Marketing information: kept until consent is withdrawn.
     

  • Media files used internally: retained for up to seven years unless required longer for legitimate business reasons.
     

  • Published media: may be retained permanently, as already-released materials cannot always be withdrawn.
     

Data is reviewed periodically to ensure it remains accurate and relevant.

 

Children’s Data

We handle children’s data with heightened care.
Parental or guardian consent is required for:

  • Participation in externally published media
     

  • Use of images, videos, or audio for promotional purposes
     

  • Optional communications or activities
     

Parental authority overrides the preferences of children under 18, unless safeguarding needs require otherwise.

 

Image, Voice and Likeness Usage

Collection
Filming and photography occur naturally as part of our filmmaking activities.

Processing
All media is transferred securely and handled only by authorised personnel.

Storage
Final projects and raw assets may be stored securely on local or encrypted cloud systems.

Publishing
With explicit consent, completed projects may be shared on our website, password-protected platforms, social media channels, or submitted to festivals. Contractors may use content for their portfolios under agreed terms.

Withdrawal of consent
Withdrawal applies to future uses only. Previously released materials generally cannot be removed.
We make reasonable efforts to accommodate children who cannot be filmed (e.g., assigning alternative roles).

 

Cookies and Analytics

Our website uses cookies to:

  • Improve user experience
     

  • Track usage
     

  • Analyse visitor behaviour

  •  

Analytics tools such as Google Analytics use cookies but do not identify individuals.

 

Your Rights

Under UK and EU GDPR, you have the right to:

  • Access your personal data
     

  • Correct inaccurate or incomplete data
     

  • Request deletion of your data
     

  • Restrict certain types of processing
     

  • Object to processing (including marketing)
     

  • Transfer your data to another provider (data portability)
     

  • Withdraw consent at any time
     

  • Lodge a complaint with the Information Commissioner’s Office (ICO)
     

To exercise any rights, contact us at:
contact@filmsteps.co.uk

We will respond within one month as required by GDPR.

 

Complaints

If you believe your data rights have been breached, you may contact the UK Information Commissioner’s Office:
ico.org.uk
Tel: 0303 123 1113

We encourage you to contact us first so we can work to resolve your concerns promptly.

 

Policy Updates

We may update this policy from time to time to reflect legal or operational changes.
The most recent version will always be available on our website with an updated revision date.

bottom of page