This policy is assessed regularly against changes in regulation, how we operate and our clients needs.
The safety of your data
At Broken Physics Productions we make it a priority to handle your data in a safe and secure way, making sure that our legal obligations are met and complied with. In this document, we lay out the reasons for handling your personal data, who has access to your data, what your rights are and anything else that may be important for you to be aware of.
Who we are
Broken Physics Productions is a video production company and social enterprise. We create films, videos and animations, as well as running and supporting educational opportunities. We produce a wide range of content for businesses, charities and non-profit organisations for a range of purposes including, but not limited to, online marketing, archiving, exhibition and digital advertising.
This policy applies to any personal information handled by Broken Physics Productions. The website produced and operated by us is www.brokenphysics.co.uk
Who has control of your data?
We take permission and consent very seriously and we ask contributors and collaborators to consent to working with us. We ask that all contributors and collaborators give consent of their own free will, that they are able to make a choice about their participation and that any consent gained is precise and targeted to the project that we’re working on.
In order to make sure that the issue of consent is made clear, we’ll explain to those involved why we’re asking for their consent, how their data/image will be used in the context of the project and ask whether they are still willing to participate. We do this so as to alleviate any potential pressure, and to make sure that the consent given is genuine and not forced in any way. We use consent forms so there is a written record of this consent being given and to make sure that a high level of accountability is achievable and so that the contributor is aware of the fact that their consent is tied to a particular project and will be used for a specific purpose.
We also explain to contributors and collaborators that they are within their rights to withdraw consent at any time. This does not mean that the acquisition and use of their data was unlawful before this point, only that it will not be used after this point.
For client led projects, the client is responsible for all requests to withdraw consent. The responsibility to be transparent and open with contributors about their right to withdraw consent and their rights in a wider sense remains with the client we are producing the video for. The client will offer Broken Physics Productions indemnity on this issue.
Legitimate Interest for Businesses
When we work with a client, Broken Physics Productions will make clear that they require the necessary consent to complete the project, and that the client will extend protection and indemnity to Broken Physics Productions in respect to contributors and collaborators in the event that they then withdraw consent.
The client of Broken Physics Productions will be responsible for making sure that there is a “legitimate interest” in relation to the processing of personal data for contributors and collaborators. Broken Physics Productions rely on the client to be solely responsible for assessing issues of “legitimate interest”. With this in mind, Broken Physics Productions work on the assumption that they have a “legitimate interest” in relation to the video content being produced, as they have been commissioned to create this for the client.
Once we are commissioned to carry out a project, Broken Physics Productions will confirm that the client engaging Broken Physics Productions for any of their services have a “legitimate interest” in continuing to process personal data.
For any projects led by Broken Physics Productions, we have a “legitimate interest” in continuing to process personal data where:
- There is a genuine business reason for us to continue to process the personal data.
- The data is required for the business to continue to process the personal data in question ( i.e. a video cannot be completed in any other way which is proportionate) and where the impact on the contributor or collaborator is properly assessed and does not contradict on their rights and freedoms.
Broken Physics Productions require that the client that we are working for have considered the impact that the way that they process data will have on contributors. We trust that the client has the appropriate procedures in place to make sure that this impact is limited.
What personal data do we collect and where is this collected from?
We collect some personal data from you when you become a contributor on one of our client videos or a participant on a Broken Physics Productions workshop. This data can include the following:
- Full name;
- Email address;
- Company/trading name/organisation
- Landline and mobile numbers
- Mailing and/or billing addresses
- Social media handles
- Date of birth; (if you choose to provide it)
- Postcode and address (if you choose to provide them)
- Whether you have a disability (you may choose not to provide this information, we only ask so that we can interact in the appropriate way with workshop participants, contributors and collaborators in the most appropriate way).
- Whether you have a mental health issue (you may choose not to provide this information, we only ask so that we can interact in the appropriate way with workshop participants, contributors and collaborators in the most appropriate way).
Another form of information that we collect is data in relation to how you use the Broken Physics Productions website and social media accounts. This includes data such as website viewing history, your IP address and data pertaining to how long you have viewed particular pages on our website and the pages on our website that you have clicked on.
We ask contributors on our own projects and client projects to fill out consent forms if they are going to be recorded in any way. In the process of doing this we will require certain forms of personal data to be provided.
When we receive applications from a potential job applicants and candidates, we will retain this for future reference. This includes the CV itself, covering letters and any other supporting information or data that has been provided.
Other ways that we may process your data:
When contacting us via email, we collect this data. This may include full names, job roles, places of employment and contact details (including email addresses). We do not actively use this information unless there is a legitimate reason (e.g. as part of an ongoing project) or without prior consent.
We may collect information from social media platforms such as Twitter, YouTube, Facebook, Instagram and LinkedIn profiles in instances where other users mention our own social media platforms, comment on our posts or engage with us in any other way.
We use this information on the understanding that we have a “legitimate interest” for processing it. In this case, it is to maintain our social media platforms effectively and to assess the reach and impact of our posts.
Why might we use your data?
In the interest of clarity and transparency, we do our best to ensure that you understand how we collect your personal data and what we do with it after this point. The section below outlines the different reasons for why we collect and process your data, and more specifically, which pieces of data we collect for which purpose.
As a part of providing you with our services
One way in which we process your data is when we make sure that we have your consent to be a contributor to either one of our projects or on a client project. This is essential for Broken Physics Productions being able to create that video that we have been asked to produce.
We may also use your data to contact you after a project has been completed for reasons that are of importance or potential benefit to you.
As a part of providing you with our services
We always look to make improvements to the services that we provide. As part of this we may use personal data so that we can better understand and identify areas of improvement in order to provide you with a better service in the future.
Marketing and advertising
Marketing and advertising are important parts of our business. We may use data that we have collected for the purposes of marketing and advertising.
Broken Physics Productions will only capture footage at the request of a client, as part of a commissioned project or as part of a Broken Physics Productions led project where the contributors have given their consent to take part. As part of these scenarios we will require that any footage we capture be archived, especially when this footage may be required in the future. The footage that we capture is stored on hard drives which are stored in a securely locked cabinet, in a securely locked building. This means that your data is not only physically secured, but kept away from persons who do not have a “legitimate interest” in the footage. With digital storage such as hard drives, there is the potential for failure, and as a result of this, data loss. We do our best to make sure that footage is accessible in the future, but we make no guarantees in regards to this footage. We appreciate that each client and collaborator that we work with will have their own GDPR policies in place, and we do our best to make sure that we comply with these so that we comply with our client’s own obligations.
In order to keep a record of consent that has been given for our projects, we keep consent forms that we have obtained from contributors on file. The paper copies of these documents are scanned and secured on a computer, with the paper copies eventually being destroyed. We keep these for as long as the project is ongoing and for up to two years after the project has been completed.
Marketing and advertising is crucial to our business, but we strive to deal with any information that relates to marketing and advertising in a responsible and compliant way. The section below outlines the kinds of marketing and advertising that we carry out and how your data is used for these purposes.
Promoting ourselves on third party sites
As well as using our website, we also promote our services through third part applications such as social media sites.
Our social media posts may be visible to you because of your social media usage and behaviours (for example, if you or someone you follow has liked or shared some of our content). We cannot control this, and it is controlled by the third party site where you have seen this content. If you wish, you can use the settings on these sites to make sure that you do not see this kind of content from us in the future. The way that you do this will vary based on the site that you are using.
Third party platforms in the production process.
As part of our production process, we use several external, third party platforms that may collect, export process or store personal data on behalf of Broken Physics Productions. The third party platforms that we use are GDPR compliant and for more information you can visit these sites. The third party providers that we use are:
Dropbox (San Francisco, US)
Xero (Wellington, New Zealand)
Frame io (New York, US)
Are we allowed to use your data?
The law requires that we tell you the legal reasons that mean we can process your personal data as part of our work. The section below will outlines what the law says in relation to the use of your personal data.
We only process your data on the basis that we or our client have “legitimate interest” in doing so. The sections below outlines what those “legitimate interests” are.
Purpose: Video production and workshopping services
- We are creating a video for you or providing you with video production services in some way.
- We are helping organisations to improve their video skills so that they can help the people they support.
- We are training people to improve their video skills as part of an educational programme or project
Legitimate interests: Ensuring that Broken Physics Productions is compliant with existing privacy law and consent policies. Our “Legitimate Interest” in this matter is the production of a commissioned film/video, or in the delivering of an educational programme or project as part of our commitment as a social enterprise.
Purpose: Improvements to our production or workshopping services
Legitimate interests: Ensuring that we always deliver the best possible service is an important part of the way that we conduct our business. In order to do this, we regularly consider ways that we can deliver the best possible service.
Purpose: Marketing and Advertising
Legitimate interests: In order to continue our growth as a business, we need to make sure that our marketing and advertising are helping us to be as successful as possible. We have a “legitimate interest” in data related to this area, in order to help us achieve this aim.
You have the right to object to the use of your personal data by Broken Physics Productions for the purposes laid out in the sections above. This is the case, unless we can provide a legitimate reason as to why we should continue to process your personal data. In the event that we cannot do this, we will stop processing this data.
Freedom of information
Under the Freedom of Information Act 2000, we are required to provide certain pieces of information such as your name, address, email address, telephone number and information about your request as part of our reply. We will retain this information as part of our administrative process.
How long is your data kept for?
We retain your data for two years after you have submitted it to us. We may keep your data for a select few purposes after this point, such as responding to any complaint or request that you might make.
As part of our work, certain personal data will be retained so that we are compliant with the law. Any other information that is not required as part of this will be removed.
What are your rights?
There are a number of rights afforded to you by the law in regards to data protection. In the section below we outline the rights that you have in relation to this. In order to help us act upon these rights, we may ask that you provide proof of ID. This is to make sure that we are able to find all of the data that we have, and carry out your request as quickly and efficiently as possible.
If a request comes to us, we always do our best to respond to these as quickly as possible. Please understand that if your request is especially difficult to carry out or if there are a large number of requests to carry out, then we may take longer than usual to respond to these requests. In all cases where a request is made, we will correspond with you and provide you with timescales for carrying out these requests.
Accessing your data
You can access all of your Data by emailing firstname.lastname@example.org
You are also within your rights to ask us to send you a copy of the data that he hold on you. Asking to access this information is known as a “subject access request” and will need to be submitted via e-mail to email@example.com
Objecting to our data usage
It is your right to object to us processing any of your data which we are using, to which we have a “legitimate interest” in using as is our legal right. This would include the various piece of personal data that have been detailed in this document. As is our responsibility, Broken Physics Productions will keep a detailed log of any complaints or data breaches.
We will always do our best to comply with requests that are made of us. The exception to this, is if we have a legitimate interest and reason for continuing to process your data. If this is not the case, we will stop the processing of your personal data.
In order to make this request of us, email firstname.lastname@example.org
Correcting personal data
If you find that any data we have is inaccurate or incorrect, you have a right to ask us to update or change this. In order to do this, we will need to make sure that the new data provided is correct and after this point we will do this as quickly as possible.
Having your data erased
You can ask us to delete your personal data in situations where the data has been processed unlawfully or the “legitimate interest” in the data has run out. In order to ask to have this right acted up, email email@example.com
Restricting data processing
You have the right to ask us to restrict the processing of your personal data. You can do this in certain circumstances such as you think that we don’t have “legitimate interest” in the data, the data is incorrect or we no longer need the data. By restricting the processing of your data, you ask us to simply store your data (as is our lawful right) and not to further process it any further without your consent, or we need to process the data as part of a claim, to protect a third party or to protect the public.
What if you have a complaint?
You can make a complaint to the Information Commissioner’s Office. This is a body who’s job it is to regulate data protection compliance in the UK. You can make a complaint to them if you feel that we have processed your data in any way that is unlawful. Broken Physics Productions keep a detailed log of any and all complaints and breaches.
Changes to this policy
Aged 18 or Under
As part of our work, we require that a person over the age of 18 engages Broken Physics Productions to carry out their services. In situations where this engagement involves a person under the age of 18 we ask that a parent or guardian provide consent for their young person to be part of a project or workshop. As part of this, we ask that any young person ask their parent or guardian to provide this consent, as a way of ensuring that they are willing participants in a project or workshop. People under the age of 18 are not allowed to provide us with personal information, this must be done by a parent or guardian.
When we provide consent forms, we ask parents to give information about themselves and their dependent. We do this so that we know that the dependent in question is a willing participant in a project or workshop and that we have the proper consent to engage with them.
Other forms or personal information related to the points above are collected directly in situations such as meetings, discussions at educational institutions, and in general correspondence.
Whilst we collect the majority of our personal information directly from contributor, participants and their parents, we may also receive some information from third party sources. This will be from third parties who are directly involved in the project that we are undertaking (e.g. the client or an educational institution.)
In the event that we have been commissioned by an educational institution for a project or workshop, we will ask that the aforementioned third party provide all of the relevant consent forms. As in other similar situations mentioned above, we would ask that the third part engaging us indemnifies Broken Physics Productions before we are able to begin the engagement.
As above, we keep consent forms on file to make sure that we are clear on the consent given and can accurately reply to complaints and requests made to us. These are stored digitally after collection, and will be destroyed after a period of two years.
The policy contained in this document only applies to Broken Physics Productions, and not to the third party services that we employ as part of our production process.
We are also not responsible for third party data that is collected by other sites such as Facebook or Twitter. These sites may collect data about your engagement with Broken Physics Productions and in order to be clear about this we advise that you check the privacy policies of these sites individually.
Once we receive any personal data from you, we make sure that we have the security in place to prevent unauthorised access to this data where possible.
When sending data via the internet, please understand that this is not always secure. Although we do everything in our power to protect your data, we make no guarantees about data that is sent to us via the internet.
Access to your information
If you need to access the data we have, you will need to make a request in writing to us. The address to send this to is: Broken Physics Productions, Basepoint Business Centre, Andersons Road, Southampton, SO14 5FE.
Changes to this policy
Policy last reviewed and updated: 1st March 2019
We have this policy in place to make sure that the data of everyone we work with is as protected and secure as it can be. It is also so that you are aware of your rights and how we can help you in relation to your personal data.