Freeform Privacy Policy
This Privacy Notice (the “Notice”, for short) is intended to provide you
with information about how we gather and use your personal data and
about your legal rights under the General Data Protection Regulation - or
GDPR” - the European law on the use of personal data.
Freeform Productions Limited (“Freeform”) respects your privacy and is
committed to protecting your personal data. We maintain electronic and
paper versions of this Notice. The electronic version is indexed, so that
you can click through to the areas of relevance to you.
The Glossary at the end of the Notice explains what some of the terms
used in the GDPR and this Notice mean.
Freeform Privacy Policy
1. Important information and who we are
Purpose of this Notice
Contact details
This Notice aims to give you information on how Freeform collects and
Our full details are:
processes your personal data, whether you have provided it to us directly
or whether we’ve obtained it from other people and organisations.
Full name of legal entity: Freeform Productions Limited (we’re a company
registered in England and Wales with registered number 03392216)
We may provide you with more specific privacy information where we
collect information from you for certain specific purposes. If we do so, you
Contact our Data Privacy Manager at:
should still refer to this Notice so that you are fully aware of how and why
we are using your data and how we may use it in future. This Notice adds
Email address:
to other information we may give you, and is not intended to replace it.
Postal address:
Freeform Productions Limited,
Freeform is the data controller and responsible for your personal data
West Clayton Business Centre,
(when we refer to “Freeform”, “we”, “us” or “our” in this Notice, that’s who
Berry Lane,
we’re talking about).
We have appointed a data privacy manager who is in charge of answering
questions in relation to this Notice. If you have any questions about it or
if you want to use any of your legal rights, please contact the data privacy
Telephone number: 01923 287 305
manager using the details set out below.
You have the right to make a complaint about our use of your personal
data at any time to the Information Commissioner’s Office (“ICO”).
The ICO is the UK’s supervisory authority for data protection issues
If you do have a problem, question or concern about our use of your
personal data, we would really appreciate the chance to try to help you
before you approach the ICO, so please feel free to contact us in the first
instance using the data privacy manager’s contact details above. You can
contact us about data privacy issues in other ways, but if you contact the
Data Privacy Manager, that will make it much easier for us to help you.
Changes to the Notice and your duty to inform us of changes
This Notice was last updated on 3 May 2018.
The data protection law in the UK will change on 25 May 2018 when
GDPR comes into force. Although this Notice sets out most of your rights
under the new laws, we may not yet be able to respond to some of your
requests until then as we are still working towards getting our systems
ready for some of these changes.
It is important that the personal data we hold about you is accurate and
current. Please keep us informed if your personal data changes during
your relationship with us.
Freeform Privacy Policy
2. The data we collect about you
Personal data” means any information about an individual, held by a
o Information about your relationship with a contributor who
data controller, from which the controller can identify a specific, living
applies or is invited to contribute to one of our programmes
person. It does not include data about a living person that the controller
with you. This may include ordinary personal data relating to your
can’t identify.
hobbies and interests and the names and ages of any children, and
special categories of personal data, including details of your
Some personal data falls into “Special Categories” under the GDPR and
personal relationship with them, but also any unsolicited data in
are given greater protection. These include any personal data revealing
that category which you choose to include in an application form.
your race or ethnicity, religious or philosophical beliefs, sex life, sexual
orientation, political opinions, trade union membership, and information
o Information about your plans to purchase a property, including
about your health, as well as genetic and biometric data. Information
your motivations for purchasing, your preferred location, type of
about criminal convictions and offences is also treated differently from
property, specific requirements for a property, your own search
ordinary personal data under the GDPR.
efforts to date and why you would like to appear on one of
our programmes.
We may collect, use, store and transfer different kinds of personal data
about you. The personal data we collect will depend on the relationship
o Financial Data including your budget, method of finance for the
you have with Freeform.
purchase and source of funds, information about any existing
property ownership (including the status of any sale, equity release
If you are:
or applications for finance).
An employee of Freeform, someone working with us under a contract
o Information about your availability for filming, including dates
for services, or someone who applies for employment or work with
when you may not be available, any advance notice you may
us, we will provide you with specific privacy information and ask for
need, past appearances on television or other media, as well as
your consent to use your personal data. We will also collect the
special category data relating to any health condition which could
following information on you:
affect decisions about filming (including information that our
insurers may require us to collect).
o Identity Data including first name, last name, title, job title, role or
similar identifier, and gender, as well as proof of identity and your
Related to or in a relationship with a contributor, we may collect your
right to work in the UK.
information from the contributor, including
o Contact Data which may include your address, email address
o Identity Data includes your full name, title, date of birth, gender,
and telephone numbers.
age and occupation.
o Financial Data to provide pay, benefits and conduct other financial
o Contact Data including home address, email address and
transactions with you.
telephone numbers.
A business contact, including persons who supply us with goods
o Information about your relationship with a contributor who
(including hiring things to us) or services and any contacts at a
applies or is invited to contribute to one of our programmes
company or other organisation which does so, and customers
with you.
(including contacts at companies or other organisations) to whom
we supply our products and services, we may collect the following
If you fail to provide personal data
types of data on you:
Where we need to collect personal data by law, or under the terms of
a contract we have with you and you fail to provide that data when
o Identity Data includes first name, last name, title, job title, role
or similar identifier, and gender.
We may not be able to agree, enter in to or perform a contract we have
o Contact Data includes your work address, email address and
or are trying to enter into with you or a person or organisation
telephone numbers.
associated with you.
o Financial Data if we supply or purchase goods and services to
If you are a contributor or prospective contributor, failure to provide
or from you as an individual (including some sole traders and
data may result in us being unable to accept or use your contribution
partnerships), we may record and retain details of
to our programmes.
those transactions.
If you are an employee, contractor or applicant for a position with us,
Someone who applies to, or is selected to be a contributor to one of
we may not be able to consider your application, provide you with
our programmes, we may collect the following types of data on you:
pay or benefits, or administer a contract for services or contract of
employment with you.
o Identity Data includes your full name, title, date of birth, gender,
age and occupation.
o Contact Data including home address, email address and
telephone numbers.
Freeform Privacy Policy
3. How is your personal data collected?
4. How we use your personal data
We use different methods to collect data from and about you including
We will only use your personal data when the law allows us to. Most
commonly, we will use your personal data in the following circumstances:
Direct interactions. You may give us your information by filling in
Where we need to perform or negotiate a contract we are about to
forms, on the telephone, or by corresponding with us by post, fax,
enter into or have entered into with you.
email or otherwise. This includes personal data you provide when you:
Where it is necessary for our legitimate interests (or those of a third
apply to or are invited to contribute to our programmes;
party) and your interests and fundamental rights do not override those
interests. If you are a child (this is likely to be where a parent or sibling
ask us to send information to you;
is appearing or has asked to appear on one of our programmes), we
will take this into account when comparing your interests and rights to
provide us (yourself or on behalf of an organisation) with goods
our own.
or services or obtain products and services from us; or
Where we need to comply with a legal or regulatory obligation.
give us feedback or contact us about our work.
Where you consent to our use of personal data, typically in relation to
Third parties or publicly available sources. We may receive personal
employment or a contract for services with us, where you have applied
data about you from various third parties and public sources as set
to be or been invited to be a contributor to one of our programmes, or
out below:
where we have your consent to contact you with information about
our products and services.
Contact, financial and transaction data from your employer or any
person or entity for whom you provide services or do work.
Where we have asked you to consent to our use of your data for other
purposes, you can also withdraw that consent at any time. Please be
Contact, financial and transaction data from providers of technical,
aware that data protection law may still allow us to use some or all of
payment and delivery services where we supply goods or services to,
your personal data, even special categories of personal data, if we have a
or purchase them from you or your organisation (including where you
have another lawful basis for doing so and have told you (in this Notice or
are a member of a partnership).
elsewhere) that we intend to do so.
Identity and contact data from publicly availably sources such as
Purposes for which we will use your personal data
Companies House.
We have set out below, in a table format, a description of all the ways we
Contributors to our programmes (or prospective contributors)
plan to use your personal data, and which of the legal bases we rely on
may provide us with your data while preparing for or making
to do so. We have also identified what our legitimate interests are where
the programme.
If you are an employee, candidate, contractor or third-party supplier
Note that we may process your personal data for more than one lawful
and we are permitted or required to do so by any law or regulation,
ground depending on the specific purpose for which we are using your
we may require you to obtain and provide us with information from
data. Please contact us if you need details about the specific legal ground
the Disclosure and Barring Service.
we are relying on to process your personal data where more than one
ground has been set out in the table on the next page.
Freeform Privacy Policy
4. How we use your personal data (continued)
Type of data
Lawful basis for processing including
basis of legitimate interest
To register you (or your employer or a person or
(a) Identity data
(a) Performance of a contract with you
entity to whom you provide services) as a new
(b) Contact data
(b) Necessary for our legitimate interests
customer or supplier
(c) Financial data (for credit purposes)
(c) Your consent
To fulfil our contractual obligations to you or
(a) Identity data
(a) Performance of a contract with you
your organisation or to enforce your or your
(b) Contact data
(b) Necessary for our legitimate interests (to recover
organisation’s obligations to us, including to
(c) Financial data
debts due to us)
(a) Manage payments, fees and charges
(d) Transaction data
(b) Collect and recover money owed to us
To manage our relationship with you which will
(a) Identity data
(a) Performance of a contract with you
(b) Contact data
(b) Necessary to comply with a legal obligation
(a) Notifying you about changes to our terms or
(c) Necessary for our legitimate interests (to keep
privacy policy
our records updated and to study how our products/
(b) Contacting you about products or services we
services are used and received)
obtain from or provide to you or your employer
(c) Contacting you about a past, present or future
contribution to one of our programmes
To administer and protect our business
(a) Identity
(a) Necessary for our legitimate interests (for
(b) Contact
running our business, provision of services, to
prevent fraud and in the context of a business
reorganisation or group restructuring exercise)
(b) Necessary to comply with a legal obligation
To participate (and give you an opportunity to
(a) Name
(a) Necessary for our legitimate interests and
participate) in industry-wide diversity monitoring
(b) Email
those of the broadcasters who may broadcast our
programmes, including the “Diamond” programme,
programmes to monitor and increase diversity in
which are intended to provide broadcasters with
our industry and in the media generally.
information about who is on television and who is
making television.
To administer a contract for services or contract
(a) Identity data
(a) Performance of a contract with you
of employment between us - we will provide you
(b) Contact data
(b) Necessary for our legitimate interests (to
with further information about this when we collect
(c) Financial data
administer the economic relationship between us)
information from you and during the course of our
(c) Necessary to comply with a legal obligation
(related to your work or workplace or our obligations
under the law in relation to these)
To interact with contributors to our programmes
(a) Identity data
(a) Consent
and people who apply to contribute to them
(b) Contact data
(b) Necessary for our legitimate interests (to
(c) Any personal data provided to us on a
administer the relationship between us and to make
contributor’s application form or which the
and distribute our programmes)
contributor provides to us in the course of making
(c) Necessary to comply with a legal obligation
or preparing to make a programme
(d) To protect your vital interests or those of
another person
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider
that we need to use it for another reason and that reason is compatible with the original purpose. If you wish
to get an explanation as to how the processing for the new purpose is compatible with the original purpose,
please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal
basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with
the above rules, where this is required or permitted by law.
Freeform Privacy Policy
5. Disclosures of your personal data
6. International transfers
We may have to share your personal data with the parties set out below
Some of our programmes involve locations outside of the European
for the purposes set out in the table in paragraph 4 above.
Economic Area (“EEA”), or locations where, for geographical, economic
or logistical reasons, support may be required from places which are
External Third Parties as set out in the Glossary.
themselves outside of the EEA. In these circumstances, processing of
your personal data will may involve a transfer of data outside the EEA.
Specific third parties listed in the table in paragraph 4 (previous page).
Whenever we transfer your personal data out of the EEA, in normal
Third parties to whom we may choose to sell, transfer, or merge parts
circumstances, we ensure a similar degree of protection is afforded to it
of our business or our assets. Alternatively, we may seek to acquire
by ensuring at least one of the following safeguards is implemented:
other businesses or merge with them. If a change happens to our
business, then the new owners may use your personal data in the
We will only transfer your personal data to countries that have been
same way as set out in this Notice.
deemed to provide an adequate level of protection for personal data
by the European Commission. Currently, this means Andorra,
Broadcasters and other entities involved in the production,
Argentina, Canada (where your data goes to commercial
transmission, distribution and resale of our programmes.
organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man,
Jersey, New Zealand, Switzerland, Uruguay and the USA (but only
We require all third parties to respect the security of your personal data
where the recipient adheres to the Privacy Shield framework)
and to treat it in accordance with the law. We do not allow our third-party
For further details, you should look up the information provided by
service providers to use your personal data for their own purposes and
the European Commission on their website regarding
only permit them to process your personal data for specified purposes
adequacy decisions.
and in accordance with our instructions.
Where we use certain service providers, we may use specific
contracts approved by the European Commission which give personal
data the same protection it has in Europe. For further details, you
should look up the information provided by the European Commission
on model contracts for the transfer of personal data to third countries.
Where we use providers based in the US, we may transfer data to
them if they are part of the “Privacy Shield” programme, which
requires them to provide similar protection to personal data shared
between the Europe and the US. Further information on Privacy Shield
is available from the European Commission.
In certain circumstances, the requirements of programme-making may
prevent us from being able to ensure a similar level of protection when on
location overseas. In these situations, we will ask you for your consent to
transfer your personal data for processing overseas.
Freeform Privacy Policy
7. Data security
8. Data retention
How long will you use my personal data for?
We have put in place appropriate security measures to prevent your
personal data from being accidentally lost, used or accessed in an
unauthorised way, altered or disclosed. In addition, we limit access to
We will only retain your personal data for as long as necessary to fulfil the
your personal data to those employees, agents, contractors and other
purposes we collected it for, including for the purposes of satisfying any
third parties who have a business need to know. They will only process
legal, accounting, or reporting requirements.
your personal data on our instructions and they are subject to a duty of
To determine the appropriate retention period for personal data, we
consider the amount, nature, and sensitivity of the personal data, the
We have put in place procedures to deal with any suspected personal
potential risk of harm from unauthorised use or disclosure of your
data breach and will notify you and any applicable regulator of a breach
personal data, the purposes for which we process your personal data and
where we are legally required to do so.
whether we can achieve those purposes through other means, and the
applicable legal requirements.
By law we have to keep basic information about our contractors, suppliers
and customers (which may include your contact, identity, financial and
transaction data) for six years after our relationship with them ceases for
tax purposes.
Where you apply to appear on one of our programmes, we may keep your
application form and other information about you for up to 10 years so
that we can consider you for current and future programmes.
In some circumstances you can ask us to delete your data: see [Request
erasure] below for further information.
Freeform Privacy Policy
9. Your legal rights
You have rights under data protection law in relation to your personal
data. Further information on these rights is set out in the Glossary, below:
Request access to your personal data.
Request correction of your personal data.
Request erasure of your personal data.
Object to processing of your personal data.
Request restriction of processing your personal data.
Request transfer of your personal data.
Right to withdraw consent.
If you wish to exercise any of the rights set out above, please contact our
data privacy manager.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise
any of the other rights). However, we may charge a reasonable fee if your
request is clearly unfounded, repetitive or excessive. Alternatively, we
may refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm
your identity and ensure your right to access your personal data (or to
exercise any of your other rights). This is a security measure to ensure
that personal data is not disclosed to any person who has no right to
receive it. We may also contact you to ask you for further information in
relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month.
Occasionally it may take us longer than a month if your request is
particularly complex or you have made a number of requests. In this case,
we will notify you and keep you updated.
Freeform Privacy Policy
10. Glossary
There are a number of different lawful bases for processing your personal
You have the right to:
data which we may use:
Request access to your personal data (commonly known as a “data
Legitimate Interest means the interest of our business in conducting
subject access request”). This enables you to receive a copy of the
and managing our business to enable us to make the best programmes
personal data we hold about you and to check that we are lawfully
and to provide the best products and services we can. We make sure
processing it.
we consider and balance any potential impact on you (both positive and
negative) and your rights before we process your personal data for our
Request correction of the personal data that we hold about you. This
legitimate interests. We do not use your personal data for activities where
enables you to have any incomplete or inaccurate data we hold about
our interests are overridden by the impact on you (unless we have your
you corrected, though we may need to verify the accuracy of the new
consent or are otherwise required or permitted to by law). You can obtain
data you provide to us.
further information about how we assess our legitimate interests against
any potential impact on you in respect of specific activities by contacting us
Request erasure of your personal data. This enables you to ask us to
delete or remove personal data where there is no good reason for us
Performance of Contract means processing your data where it is
continuing to process it. You also have the right to ask us to delete or
necessary for the performance of a contract to which you are a party, or
remove your personal data where you have successfully exercised your
to take steps at your request before entering into such a contract.
right to object to processing (see below), where we may have processed
your information unlawfully or where we are required to erase your
Comply with a legal or regulatory obligation means processing your
personal data to comply with local law. Note, however, that we may not
personal data where it is necessary for compliance with a legal or
always be able to comply with your request of erasure for specific legal
regulatory obligation that we are subject to.
reasons which will be notified to you, if applicable, at the time of your
Protecting your vital interests applies where we would otherwise require
your consent to use data but you are physically or legally incapable of
Object to processing of your personal data where we are relying on
giving consent, and processing is to protect your interests - for example,
a legitimate interest (or those of a third party) and there is something
to facilitate urgent medical treatment.
about your particular situation which makes you want to object to
processing on this ground as you feel it impacts on your fundamental
rights and freedoms. In some cases, we may demonstrate that we
have compelling legitimate grounds to process your information which
External Third Parties
override your rights and freedoms.
Service providers acting as processors based inside and outside the
Request restriction of processing of your personal data. This enables
EEA who provide technical, financial, logistical or other support for our
you to ask us to suspend the processing of your personal data in the
work, including services relating to pre-production, filming on location
following scenarios: (a) if you want us to establish the data’s accuracy;
and post-production aspects of our programme making.
(b) where our use of the data is unlawful but you do not want us to
erase it; (c) where you need us to hold the data even if we no longer
Professional advisers acting as processors or joint controllers
require it as you need it to establish, exercise or defend legal claims;
including lawyers, bankers, auditors and insurers based in the EEA
or (d) you have objected to our use of your data but we need to verify
and outside of it who provide consultancy, banking, legal, insurance
whether we have overriding legitimate grounds to use it.
and accounting services.
Request the transfer of your personal data to you or to a third party.
HM Revenue & Customs, regulators and other authorities based in the
We will provide to you, or a third party you have chosen, your personal
United Kingdom who require reporting of processing activities in
data in a structured, commonly used, machine-readable format. Note
certain circumstances.
that this right only applies to automated information which you initially
provided consent for us to use or where we used the information to
Governments and public authorities in other countries where we carry
perform a contract with you.
out filming who require information on our crew and contributors.
Withdraw consent at any time where we are relying on consent to
Broadcasters and any other parties involved in the financing,
process your personal data. However, this will not affect the lawfulness
production, distribution, transmission, sale, resale or syndication
of any processing carried out before you withdraw your consent. If you
of our programmes.
withdraw your consent, we may not be able to provide certain products
or services to you. We will advise you if this is the case at the time you
withdraw your consent.