Menu Nutopia Privacy Statement 1 Contents 2 Introduction 3 Security 4 Data that we hold 4.1 Contacting and Engaging with Nutopia 4.1.1 Why do we process data? 4.1.2 What data is processed and what it the basis for that processing? 4.1.3 How long do we hold data for? 5 Sharing personal data 6 Locations of processing 7 Individual’s Rights 8 Complaints 9 Data Controller and contact information 10 Changes to our privacy statement 2 Introduction Nutopia Limited (“we”, “us”, “our”, “Nutopia”) is an independent television production company based in London, producing quality programmes and other content for worldwide distribution. We are a company incorporated in England under company number 03371279 and our registered office is at Summit House, 170 Finchley Road, London NW3 6BP. Our main office is at 1st Floor, Kirkman House, 12-14 Whitfield Street, London W1T 2RF. We are committed to protecting and respecting the personal data that we hold. This privacy statement describes why and how we collect, store, transfer and use personal data and provides information about individuals’ rights. It applies to personal data obtained by or provided to us, by individuals themselves or by others or from other sources. We may store, transfer and use personal data provided to us for the purposes described in this privacy statement or as made clear before collecting personal data. Personal data is any information relating to an identified or identifiable living person. When collecting and using personal data, our policy is to be transparent about why and how we collect, process, store and transfer personal data. We process personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose are set out in the relevant sections below. The personal data that is obtained by or provided to us is either provided directly by the individual concerned or by a third party acting on behalf of an individual or obtained from a publicly available source (e.g. press articles, social media profiles, online searches).Where we receive personal data that relates to an individual from a third party acting on behalf of an individual, we request that this third party informs the individual of the necessary information regarding the use of their data. Where necessary, reference may be made to this privacy statement. 3 Security We take the security of all the data we hold seriously. We have implemented appropriate measures and safeguards to ensure that your personal information is kept safe and secure including the following: Staff are trained on data protection, confidentiality and security; We have a framework of policies and procedures which ensure we regularly review the appropriateness of the measures we have in place to keep the data we hold secure; All information you provide to us is stored in a secure way. The transmission of information via the internet is not completely 100% secure and although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted by this means; any transmission is at your own risk. Once we have received your information, we will use our procedures and security measures to try to prevent unauthorised access. 4 Data that we hold 4.1 Contacting and engaging with Nutopia The exact data we process will depend on the nature of our interaction with you. Where we engage with individuals, we request that individuals only provide the personal data that is necessary for the purposes of our engagement. 4.1.1 Why do we process data? We may process personal data for various purposes, including: responding to queries from members of the public; considering the suitability of individuals to take part in our programmes and in connection with contributions they then make to our programmes; as part of and in connection with our programme-making and other activities including producing, exhibiting, exploiting, distributing, publicising, advertising and promoting our programmes by any media (now known or hereafter invented) throughout the world; operating and managing our business effectively and lawfully; and making payments to individuals. 4.1.2 What data is processed and what is the basis for that processing? The data that is processed by Nutopia and the lawful bases for that processing includes: Members of the Public (who contact us by phone, e-mail or otherwise in writing, or online): your name, contact details and handwriting – to correspond with you and for administrative purposes (with such processing being necessary for the purposes of our legitimate interests). Prospective Employees, Contractors and Contributors: your name, contact details and handwriting - to correspond with you and for administrative purposes (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it); your image and the other information in your passport, driving licence and other official documents - to verify your identity and to ensure compliance with relevant laws (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it); information about your work history, qualifications and experiences - to assess your suitability to work with us or take part in our programmes and / or to comply with contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests); information about your personal, home and family life - to assess your suitability to work with us or take part in our programmes and / or to comply with our contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests); information about you on social media and the internet including images of you and other information - to verify your identity and to assess your suitability to work with us or take part in our programmes (with such processing being necessary for the purposes of our legitimate interests); information about your physical and mental health - to assess your suitability to work with us or take part in our programmes and / or to comply with contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it – and undertaken with your consent); information about any criminal convictions or cautions you have or any criminal activity or proceedings you have been involved in - to assess your suitability to work with us or take part in our programmes and / or to comply with contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests and / or for the performance of our contract with you or steps taken prior to entering into it – and undertaken with your consent); your financial details including your bank details - to pay or reimburse pre-approved costs or expenses (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it); and your age, gender, gender identity, ethnicity, disability and sexual orientation - for diversity analysis monitoring (with such processing being necessary for the purposes of our legitimate interests and undertaken with your explicit consent). Contributors: information contained in footage filmed for our programmes or provided to us including a very wide range of personal information about you including: your image, your age; date of birth; handwriting; information about your personal, home and family life and your work history, qualifications and experiences (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you); information about your racial and ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, health, sex life or sexual orientation (so called ‘special category data’) (with such processing being necessary for the purposes of our legitimate interests and/or the performance of our contract with you and undertaken with your explicit consent and / or in connection with public interest journalism); and information about any criminal convictions or cautions you have or any criminal activity or proceedings you have been involved in (so called ‘criminal convictions and offences data’) (with such processing being necessary for the purposes of our legitimate interests and/or the performance of our contract with you and undertaken with your explicit consent and / or in connection with public interest journalism). We need the information in such footage for editorial reasons and for the production of our programmes, for contractual reasons and obligations we have to third parties, and / or to comply with our obligations to you pursuant to our contract with you. If we intend to process your personal information with your consent, we will seek your explicit consent. We will only process your personal information for our legitimate interests where our legitimate interests do not override your own legitimate rights and interests. Following the exploitation of our programmes, any information about you in them will have been manifestly made public by you and we may also continue to process it on that basis. Transfers of Personal Data to a country outside of the EEA We may also transfer the personal information we collect about employees, workers and other collaborators to other recipients in countries outside the European Economic Area where necessary for the performance of a contract, for example to broadcasters/clients/our agents in the USA and elsewhere, or when arranging travel for such individuals. Where doing so, we seek to ensure that the personal information of those individuals is protected and treated in a way which is consistent with EU and UK data protection laws. 4.1.3 How long do we hold data for? We retain personal data for as long as is considered necessary for the purpose(s) for which it was collected. For those participating in our programmes, we are likely to retain your personal data for as long as is necessary in order to produce, exhibit, exploit, distribute, advertise, publicise and promote the programme in accordance with our legitimate interests and legal obligations. There may also be occasions which will require data to be kept for longer, however this will typically be for legal and contractual purposes. Personal data that is no longer required will be deleted/destroyed. 5 Sharing personal data We will only share personal data with others when we are legally permitted to do so. When we share data with others, we put contractual arrangements and security mechanisms in place to protect the data and to comply with our data protection, confidentiality and security standards. Your personal information is processed by our employees and staff and we use third parties to support us in providing our services including as follows: Contracting / Commissioning parties involved in our business activities e.g. broadcasters, sales agents, distributors, financiers; Production partners involved in our business activities e.g. post production houses, co-producers; Insurance companies / Health and Safety advisors / IT services / Legal advisors / Accountancy services who are providing services to us; and Others – we may share your data on with other third parties on an ad-hoc basis, however as and when this happens, we will inform if and when this happens. We may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights e.g. Ofcom and other broadcasting regulators, the police or other regulatory bodies. We may share special category personal information about you with members of the production team, and with the parties set out above, and (to the extent you provide such information as part of your contribution to a programme and the same is incorporated in a programme and/or we include details of your biography background and past experiences in a programme) with the public on transmission of the programme in which you appear. 6 Locations of processing Although based in the UK, our business is global which means that the data that we collect from you may be transferred to and stored at a destination outside the European Economic Area (“EEA”). Where that is the case, we will ensure that adequate safeguards are in place to ensure the safety and security of your personal information and that it is processed in accordance with this privacy statement. 7 Individual’s Rights Individuals have certain rights over their personal data including the following: Individuals may request access to their personal data held by us as a data controller; Individuals may request that we rectify any inaccurate personal data that we hold about them; Individuals may request that we erase their personal data; Where we process personal data based on consent, individuals may withdraw their consent at any time; Individuals may have other rights to restrict or object to our processing of personal data and the right to data portability; and Individuals may request information about any automated data processing that we may undertake. If you wish to exercise any of these rights, please send an email to Data.protection@nutopia.com. Please note that most of these rights are not absolute and are limited to certain defined circumstances. Accordingly, we may not be able to comply with any such request. 8 Complaints We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to Data.protection@nutopia.com. We will look into and respond to any complaints we receive. You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner's Office (“ICO”). For further information on your rights and how to complain to the ICO, please refer to the ICO website https://ico.org.uk/concerns 9 Data Controller and contact information The data controller for Nutopia is Nutopia. If you have any questions about this privacy statement or how and why we collect, process, store and transfer personal data, please contact us at Data.protection@nutopia.com. 10 Changes to our privacy statement We may update or amend this privacy statement from time to time. Updates to this privacy statement will appear on this website. This privacy statement was last updated on 25/02/2019. SHARE THIS PAGE: GET IN TOUCH Tel +44 (0)20 7299 3430 Email info@nutopia.com 2021 © Nutopia Ltd Terms and Conditions Nutopia Privacy Statement