1. Introduction and Company Information
This Privacy Policy explains how Northbridge Creative Productions Ltd collects, uses, stores, shares, and protects personal data when you interact with us, including when you contact us, use our services, visit our website, attend our studio, or otherwise engage with our photography and production services.
Northbridge Creative Productions Ltd is the data controller for the personal data described in this Privacy Policy.
- Company name: Northbridge Creative Productions Ltd
- Address: Northbridge Creative Studio, Unit 4, The Maltings, Station Road, Cambridge, CB1 2JT, United Kingdom
- Email: [email protected]
- Phone: +44 1223 846 759
This Privacy Policy is intended to provide clear information about our data handling practices in connection with our photography-production-studio business, including portrait sessions, commercial shoots, event coverage, creative production, client consultations, editing, delivery of media, and related services.
2. Data Collection and Processing
We may collect and process the following categories of personal data:
- Identity data: name, title, date of birth, job title, company name, and similar identifiers.
- Contact data: email address, phone number, postal address, billing address, and communication preferences.
- Booking and service data: appointment details, project brief, creative preferences, shoot location, schedules, invoices, and service history.
- Image, video, and audio data: photographs, video footage, voice recordings, and related media captured during our services or supplied to us.
- Technical data: IP address, device identifiers, browser type, operating system, log data, and website usage information.
- Payment and transaction data: payment method details, transaction records, and billing information, although card details are usually handled by third-party payment providers.
- Correspondence data: emails, messages, call notes, feedback, complaints, and other communications.
- Special category data: only where relevant and necessary, and usually only where you voluntarily provide it or where it is clearly required for a specific service, such as accessibility-related information or other sensitive content appearing in images or communications.
We collect personal data directly from you, from your employer or organisation if you engage us on their behalf, from third-party service providers, from our website, from social media platforms where you interact with us, and from publicly available sources where lawful and appropriate.
Where we photograph events, productions, or public-facing activities, personal data may also be captured incidentally in images or recordings. We seek to process such data fairly and in accordance with applicable law.
3. Purpose of Data Processing
We process personal data for the following purposes:
- to respond to enquiries and provide quotations;
- to manage bookings, contracts, and client relationships;
- to carry out photography, filming, production, editing, and delivery services;
- to communicate with clients, models, vendors, and other relevant individuals;
- to process payments, issue invoices, and manage accounts;
- to maintain records and administer our business operations;
- to improve our services, website, and customer experience;
- to market our services, subject to applicable consent and marketing laws;
- to protect our legal rights, prevent fraud, and ensure security;
- to comply with legal, regulatory, tax, accounting, and insurance obligations;
- to manage disputes, complaints, and claims;
- to create and maintain portfolios, archives, and showcase materials where permitted.
4. Legal Basis for Processing
We only process personal data where we have a lawful basis to do so. Depending on the context, our legal bases may include:
- Consent: where you have given clear permission for a specific purpose, such as certain marketing communications or the use of particular images in promotional materials.
- Contract: where processing is necessary to enter into or perform a contract with you, including providing photography or production services.
- Legal obligation: where we must process data to comply with laws, regulations, tax rules, court orders, or lawful requests from authorities.
- Legitimate interests: where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and interests, such as operating our studio, securing our systems, improving services, and managing business relationships.
- Vital interests: in rare circumstances where processing is necessary to protect someone’s life or physical safety.
- Public task or official authority: where applicable in limited circumstances, though this is unlikely to be our usual basis.
Where we process special category data, we will only do so where an additional lawful condition applies under applicable law.
5. Data Sharing and Third Parties
We may share personal data with trusted third parties where necessary for the purposes described in this Privacy Policy. These may include:
- cloud storage and file transfer providers;
- website hosting, analytics, and IT support providers;
- payment processors and accounting software providers;
- professional advisers such as lawyers, accountants, auditors, and insurers;
- production assistants, freelancers, editors, stylists, retouchers, and other service collaborators;
- delivery and logistics providers;
- marketing and communication platforms;
- public authorities, law enforcement, and regulators where required by law;
- clients, where necessary for project delivery and with appropriate safeguards;
- other third parties where you instruct us to share data or where sharing is otherwise lawful.
We require third parties to respect the security of personal data and to process it in accordance with applicable law and our instructions where they act as processors. Some third parties may act as independent controllers and will be responsible for their own privacy practices.
6. Data Transfer to Third Countries
Where personal data is transferred outside the United Kingdom or the European Economic Area, we will take appropriate steps to ensure that the transfer is lawful and that your data is protected. These steps may include:
- transferring data to countries recognized as providing adequate protection;
- using standard contractual clauses or equivalent safeguards;
- implementing supplementary technical and organisational measures where necessary;
- relying on another lawful transfer mechanism permitted by applicable law.
If you would like further information about international data transfers, you may contact us using the details below.
7. Storage Duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, contractual, insurance, and reporting requirements.
- Client and contract records: typically retained for the duration of the relationship and for a reasonable period afterwards.
- Financial and tax records: retained for the period required by applicable law.
- Images and media files: retained according to project requirements, contractual arrangements, licensing terms, archiving needs, and lawful business purposes.
- Marketing data: retained until you opt out or unsubscribe, or until it is no longer needed.
- Correspondence and support records: retained for as long as necessary to handle the enquiry, complaint, or related follow-up.
When personal data is no longer required, we will delete, anonymise, or securely archive it in accordance with our retention practices and legal obligations.
8. User Rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: to request a copy of the personal data we hold about you.
- Rectification: to request correction of inaccurate or incomplete data.
- Erasure: to request deletion of your personal data in certain circumstances.
- Restriction: to request that we limit the processing of your data in certain situations.
- Data portability: to request transfer of certain data to you or another controller in a structured, commonly used, machine-readable format.
- Objection: to object to processing based on legitimate interests or for direct marketing purposes.
You may also have the right not to be subject to certain automated decisions, where applicable. These rights may be subject to legal exemptions and limitations.
To exercise any of your rights, please contact us using the information provided in this Privacy Policy. We may need to verify your identity before responding.
9. Withdrawal of Consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
If you withdraw consent, we may not be able to provide certain services or continue particular activities, such as specific marketing communications or the use of images for promotional purposes where consent is required.
10. Right to Complain
If you are concerned about how we handle your personal data, please contact us first so that we can try to resolve the issue.
You may also have the right to lodge a complaint with the relevant data protection authority in your country of residence, place of work, or where you believe an infringement has occurred. In the United Kingdom, this is generally the Information Commissioner’s Office (ICO).
11. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include:
- access controls and role-based permissions;
- password protection and, where appropriate, multi-factor authentication;
- secure file storage and encrypted communications where feasible;
- staff awareness and confidentiality obligations;
- regular maintenance of systems and security practices;
- backup and disaster recovery procedures;
- careful selection and oversight of service providers.
While we work to protect your data, no system can be guaranteed completely secure. You should take care when transmitting information to us electronically.
12. Contact Information
If you have any questions about this Privacy Policy or how we process your personal data, please contact:
- Northbridge Creative Productions Ltd
- Address: Northbridge Creative Studio, Unit 4, The Maltings, Station Road, Cambridge, CB1 2JT, United Kingdom
- Email: [email protected]
- Phone: +44 1223 846 759
13. Changes to Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. Any updated version will be posted with a revised effective date where appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how Northbridge Creative Productions Ltd processes personal data.