PRIVACY & DATA PROTECTION POLICY

Global Production Center Ltd 

Status

Regulatory Compliant — UK GDPR / DPA 2018 / EU GDPR / PECR 2003

1. Statutory Identity and Contact Details

This Privacy Policy governs the processing of personal data by Global Production Center Ltd (Company No: 11528256), a company incorporated in England and Wales, trading internationally under the registered trademark Storytailors. This policy applies to our primary digital presence at storytailors.tv, our regional domains, and our internal management systems (collectively, the “Network of Sites”).

• Dedicated Privacy Contact: gdpr@storytailors.tv
• Regulatory Framework: UK GDPR, UK Data Protection Act 2018, EU GDPR (Regulation 2016/679), and Privacy and Electronic Communications Regulations 2003 (PECR)

2. Scope of Data Processing & Controller Roles

We act as a Data Controller for the professional and personal data across our global network. This policy applies to:

• Freelance partners and vendor companies.
• Clients & Partners
• Website Users: Any individual interacting with our Network of Sites.

2.1 Joint Controllership & Independent Client Processing (Article 26 UK GDPR)

The relationship between Storytailors and its clients is determined on a case-by-case basis and may take one of the following forms:

• Data Processor (Article 28): Where we process personal data solely on the documented instructions of a client, Storytailors acts as a Data Processor. In this capacity, we operate under a binding Data Processing Agreement (DPA) with the client, who remains the Data Controller.
• Joint Controllers (Article 26): Where both Storytailors and a client independently determine the purposes and means of processing the same data, we may be Joint Controllers. In all such cases, we enter into a written Article 26 arrangement that sets out our respective responsibilities — in particular, which party fulfils data subject rights and provides privacy information.
• Independent Controllers: Once personal data is transferred to a client for processing that is entirely under their own control and instruction — and is no longer subject to Storytailors’ determination of purpose or means — the client becomes an independent Data Controller. From that point, the client bears sole responsibility for their own processing activities under applicable data protection law.

3. Categories of Personal Data Collected

We collect and process only the minimum data necessary for professional service delivery (the principle of data minimisation under Article 5(1)(c) UK GDPR):

• Professional Identity Data: Full name, nationality, professional portfolio/credits, and vetting credentials.
• B2B Contact Data: Business email addresses, phone numbers, and registered business addresses.
• Financial & Tax Data: VAT/Tax ID numbers, bank details for payment, and registered business addresses.
• Network Communications: Communications and metadata generated through email accounts.
• Call & Meeting Recordings: Audio and video recordings of briefing, selection, and coordination calls (see Section 6).
• Technical Data: IP addresses and cookies used for security and website optimisation (see Section 8).
• Newsletter & Marketing Data: Email address and subscription preferences, where voluntarily provided.

3.1 Special Category Data & Appropriate Policy Document (APD)

Storytailors does not systematically or intentionally collect Special Category data as defined under Article 9 UK GDPR. However, we recognise that during production coordination, incidental sensitive information may be received — for example, a freelancer disclosing a health condition or allergy for on-set insurance or safety purposes.

Where such incidental processing occurs, we rely on the following Article 9(2) conditions:

• Article 9(2)(b): Processing necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law — for example, managing on-set insurance, risk assessments, and occupational health requirements.
• Article 9(2)(f): Processing necessary for the establishment, exercise, or defence of legal claims — for example, retaining health-related incident records where a legal claim may arise from a production.

As required by Schedule 1, Part 4 of the UK Data Protection Act 2018, we maintain an internal Appropriate Policy Document (APD) that sets out our procedures for processing Special Category data, the conditions relied upon, and our retention and erasure policies for such data. This document is available to the ICO upon request.

Children’s Data: Our services are directed exclusively at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that such data has been collected, we will treat it as required by law.

4. Lawful Basis for Processing

Under Article 6 of the UK and EU GDPR, all processing by Storytailors is grounded in one of the following legal bases:

• Contractual Necessity (Art 6.1.b): To execute B2B contracts, manage project assignments, and facilitate cross-border payments.
• Legal Obligation (Art 6.1.c): To comply with mandatory financial reporting and tax regulations. We are required by law to retain financial records for six (6) years to follow UK HMRC requirements.
• Legitimate Interests (Art 6.1.f): To maintain a database of vendors. We have conducted a Legitimate Interest Assessment (LIA) confirming this processing does not override the fundamental rights and freedoms of our partners. Data subjects may object at any time (see Section 7.6).
• Consent (Art 6.1.a): For newsletter subscriptions, non-essential cookies, and call recordings. Consent is freely given, specific, informed, and unambiguous, and may be withdrawn at any time without detriment.

5. Data Infrastructure & International Transfers

We only transfer personal data to jurisdictions with recognised legal safeguards:

• United Kingdom: Processed within the UK (London Region) in accordance with UK data residency standards.
• United States: Protected by the UK Extension to the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses (SCCs) under Article 46 UK GDPR.
• EU: Governed by the UK’s Adequacy Regulations 2021 covering EEA member states.

6. Call & Meeting Recordings

We may record video or audio calls for briefing, talent selection, or project coordination purposes using various providers with or without AI-integrated tools.

• Lawful Basis: Consent (Article 6.1.a). Participants are informed before the start of any recorded call.
• Purpose: Professional coordination, quality assurance, and post-project debriefing.
• Retention: Twelve (12) months from the date of recording, after which recordings are permanently deleted.
• Data Recipient: recording tool acting as a data processor under a Data Processing Agreement.
• Right to Decline: Participants may decline recording without penalty; alternative arrangements for the call will be made.

7. Your Rights as a Data Subject

Under UK GDPR and EU GDPR, you have the following rights. All requests should be directed to gdpr@storytailors.tv. We will respond to all valid requests within 30 calendar days. For complex or multiple requests, this may be extended by a further two months with prior written notice.

7.1 Right of Access (Article 15)

You may request a copy of all personal data we hold about you, together with information about how it is processed, where it is held, and to whom it has been disclosed.

7.2 Right to Rectification (Article 16)

You may request correction of any inaccurate or incomplete personal data held about you.

7.3 Right to Erasure — “Right to be Forgotten” (Article 17)

You may request deletion of your personal data where: the data is no longer necessary for its original purpose; you withdraw consent and no other lawful basis applies; the data has been unlawfully processed; or a legal obligation requires erasure. This right does not apply where retention is required by law (e.g. financial records under HMRC rules).

7.4 Right to Restriction of Processing (Article 18)

You may request restriction of processing where: you contest the accuracy of data (pending verification); processing is unlawful but you prefer restriction over erasure; we no longer need the data but you require it for legal claims; or you have objected to processing pending verification of legitimate grounds.

7.5 Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

7.6 Right to Object (Article 21)

This is an important right. Where we process your data on the basis of Legitimate Interests (Article 6.1.f), you have the right to object at any time on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims. Where personal data is processed for direct marketing, you have an absolute right to object and we will immediately cease.

7.7 Right to Withdraw Consent (Article 7(3))

Where our processing is based on your consent (e.g. newsletter subscriptions, non-essential cookies, call recordings), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7.8 Right Against Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects or similarly significant effects. Storytailors does not make automated decisions of this nature. Any assessment of talent suitability involves human review.

7.9 Right to Lodge a Complaint

If you believe your data protection rights have been breached, you have the right to lodge a complaint with:

• Information Commissioner’s Office (ICO) — United Kingdom: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF | ico.org.uk

8. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on storytailors.tv in accordance with PECR 2003 and UK GDPR. We obtain your consent before setting any non-essential cookies via our cookie management tool.

8.1 Cookie Categories

• Strictly Necessary: Essential for the website to function. No consent required.
• Analytics & Performance: Help us understand how visitors use the site (anonymised). Require consent.
• Marketing & Advertising: Used to deliver relevant advertising and measure campaign effectiveness. Require consent.

8.2 Cookies We Use

Name	Provider	Purpose	Expiry	Type
_ga	Google Analytics	Registers a unique ID to generate statistical data on how the visitor uses the website. IP addresses are anonymised.	2 years	HTTP Cookie
_gat	Google Analytics	Used to throttle request rate to Google Analytics.	1 day	HTTP Cookie
_gid	Google Analytics	Registers a unique ID used to generate statistical data on how the visitor uses the website.	1 day	HTTP Cookie
collect	Google	Sends data to Google Analytics about the visitor’s device and behaviour. Tracks across devices and marketing channels.	Session	Pixel Tracker
_fbp	Meta (Facebook)	Used by Meta to deliver a series of advertisement products such as real-time bidding from third-party advertisers.	3 months	HTTP Cookie
fr	Meta (Facebook)	Used by Meta to deliver, measure, and improve the relevance of ads shown to visitors.	3 months	HTTP Cookie
PHPSESSID	storytailors.tv	Preserves user session state across page requests. Strictly necessary.	Session	HTTP Cookie

8.3 Managing Your Cookie Preferences

You may update or withdraw your cookie consent at any time by clicking ‘Manage Cookie Settings’ in the footer of our website. You may also configure your browser to block cookies, although this may affect functionality.

• Google Analytics opt-out: tools.google.com/dlpage/gaoptout
• Meta opt-out: facebook.com/privacy/explanation

9. Newsletter & Marketing Communications

Where you voluntarily subscribe to our newsletter, we process your email address and subscription preferences on the basis of your consent (Article 6.1.a GDPR / PECR Regulation 22).

• Subscription is confirmed via an opt-in process. We record the IP address and timestamp of registration as evidence of consent.
• You may unsubscribe at any time using the one-click unsubscribe link in every communication, or by emailing gdpr@storytailors.tv.
• We do not share newsletter subscriber data with third parties for their own marketing purposes.
• Retention: Newsletter data is retained until you unsubscribe or request erasure.

For the avoidance of doubt: our team may reach out to any contact, from time to time, to send or request general work updates, including but not limited to: market trends, recent activity, information exchange, film locations, tax incentives, any topics of interest.

10. Website Contact & Enquiry Forms

When you contact us via our website contact form or by email, we collect your name, email address, and message content. This data is processed on the basis of Legitimate Interest (Article 6.1.f) in responding to professional enquiries, or Contractual Necessity (Article 6.1.b) where the enquiry relates to a live engagement.

• Retention: Contact enquiry data is retained for a maximum of three (3) years, after which it is securely deleted.

11. Data Retention & Disposal

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

Processing Activity	Retention Period
Professional information	Duration of professional relationship or until valid erasure request
Financial Records (Invoices, VAT, Bank Data)	6 years — UK HMRC mandatory requirement
Call & Meeting Recordings	12 months from date of recording
Incidental Special Category Data	Deleted without undue delay unless retention is legally required (per APD)
Website Contact / Enquiry Data	6 years from date of contact
Newsletter Subscription Data	Until unsubscribe or erasure request
Website Cookie / Analytics Data	As per cookie-specific expiry dates (Section 8)
CCTV / Physical Access Records (if applicable)	6 years unless required for an active investigation

Upon expiry of any retention period, data is securely deleted from all systems, including backup media, within 30 days.

12. Technical & Organisational Security Measures

In accordance with Article 5(1)(f) and Article 32 UK GDPR, we implement appropriate technical and organisational measures (TOMs):

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest where technically feasible.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff and contractors with data access are subject to confidentiality obligations.
• Processor Due Diligence: All third-party data processors operate under binding Data Processing Agreements (DPAs) in accordance with Article 28 UK GDPR.
• Incident Monitoring: We maintain internal procedures for detecting, reporting, and investigating personal data security incidents.
• Regular Review: This policy and our security measures are reviewed at least annually or following any significant change to processing activities.

13. Personal Data Breaches

In the event of a personal data breach, we will act in accordance with Articles 33 and 34 UK GDPR:

• ICO Notification: If a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the ICO within 72 hours of becoming aware.
• Data Subject Notification: Where a breach poses a high risk to individuals, we will notify affected data subjects without undue delay.
• Internal Records: All breaches are recorded in our internal breach register in accordance with Article 33(5).

If you believe your personal data has been compromised, please contact gdpr@storytailors.tv immediately.

14. Data Protection Officer

As an organisation whose core activities do not consist of large-scale systematic monitoring or large-scale processing of Special Category data, Storytailors is not required to appoint a formal DPO under Article 37 UK GDPR.

Our dedicated privacy contact for all data protection matters, DSARs, and complaints is: gdpr@storytailors.tv

15. Policy Updates & Notification

We may update this Policy to reflect changes in our processing activities, applicable law, or regulatory guidance.

Where consent is the lawful basis for any new or changed processing, we will seek fresh, explicit consent before commencing. We will not rely on implied acceptance through continued use of services as a substitute for valid consent under Article 7 UK GDPR.

16. Governing Law & Jurisdiction

This policy is governed by the laws of England and Wales. For processing activities relating to individuals located in the EEA, EU GDPR applies concurrently and we acknowledge the jurisdiction of the relevant EU supervisory authority.

Global Production Center Ltd  |  Company No: 11528256  |  ICO Ref: C1924442

gdpr@storytailors.tv  |  storytailors.tv