Data Protection (& GDPR) Policy

Company Name: Bloodaxe Studios Limited (the "Company")

Document Version: 1.0

Effective Date: 3rd June 2026

1. Introduction and Purpose

1.1. The Company is committed to protecting the privacy and security of the personal data it processes. As a film production company, we may collect and use personal data relating to scriptwriters, cast, crew, investors, contractors, website visitors and our commercial/creative audience.

1.2. This policy outlines how the Company, including its personnel and anyone processing data on its behalf, complies with the General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope and Data Types We Process

The Company may act as a Data Controller for the personal data it collects, owns, and controls. 

The Company may act as a Data Processor when processing personal data controlled by others, such as contractors, clients, or specific third-party entities.

In the course of developing, financing, and producing film projects under either capacity, we may process:

  • Production & Talent Data: Names, contact details, CVs, headshots, showreels, agents' details, and passports (for right-to-work checks).

  • Special Category Data: Health/medical information (for on-set safety and insurance), union memberships (e.g., Equity, Bectu), and criminal record checks (where required for working with minors).

  • Financial Data: Bank details, National Insurance numbers, and tax statuses for paying cast, crew, and invoicing freelancers.

  • Investor & Corporate Data: Contact and financial information of investors and stakeholders.

3. The Data Protection Principles

The Company ensures that all personal data is processed in accordance with the six UK GDPR principles. Data must be:

  1. Lawful, fair, and transparent: We must have a valid legal basis (e.g., contract performance, legal obligation, or legitimate interests) to process data.

  2. Purpose limitation: Collected only for specified, explicit, and legitimate production purposes.

  3. Data minimisation: Adequate, relevant, and limited to what is necessary (e.g., do not collect medical histories unless strictly required for on-set health and safety).

  4. Accuracy: Kept accurate and up to date.

  5. Storage limitation: Kept in a form which permits identification of data subjects for no longer than is necessary.

  6. Integrity and confidentiality: Processed securely using appropriate technical or organisational measures.

4. Lawful Bases for Processing

We will only process personal data when at least one of the following applies:

  • Contractual Necessity: To fulfil our contract with you (e.g., paying an employee or managing a writer’s option agreement).

  • Legal Obligation: To comply with UK laws (e.g., HMRC tax reporting, health and safety regulations on set).

  • Legitimate Interests: For the standard assessment of creative showreels, scripts, and industry networking, provided it does not override individuals' privacy rights.

  • Consent: Where explicit consent has been given (e.g., marketing newsletters or specific public promotional materials).

5. Data Security and Third-Party Sharing

5.1. Security Measures: All digital data must be securely stored using encrypted cloud services (e.g., Google Workspace, Microsoft 365) with Multi-Factor Authentication (MFA) enabled. Physical documents (e.g., paper release forms) must be kept in locked filing cabinets.

5.2. Third-Party Sharing: We will only share personal data with trusted third parties essential to film operations, including:

  • Payroll providers and accountants.

  • Production insurance brokers.

  • Completion bond companies, distributors, and co-producers.

5.3. International Transfers: Film production often involves overseas entities (e.g., US distributors). We will ensure appropriate safeguards (such as UK International Data Transfer Agreements) are in place before transferring data outside the UK/EEA.

6. Data Retention

6.1. Personal data will not be kept longer than necessary for the purposes it was collected.

  • Casting/Unsuccessful Applications: Deleted within [e.g., 1 year] of production wrap.

  • Crew/Cast Contracts & Financials: Retained for 7 years to comply with UK tax law and corporate record requirements.

  • Employee Contracts & Financials: Retained for 7 years to comply with UK tax law and corporate record requirements.

  • Chain of Title / Copyright Data: Scriptwriter agreements and clear copyright documentation will be retained indefinitely to protect the commercial viability and distribution rights of the film.

7. Data Subject Rights

Individuals have the right to request access to, rectification of, or erasure of their personal data (known as a Subject Access Request or SAR).

  • Any SAR received by a team member must be forwarded to the Managing Director immediately.

  • The Company will respond to valid requests within one calendar month free of charge.

8. Data Breaches

8.1. A data breach includes unauthorized access, loss, or destruction of personal data (e.g., leaving a physical crew list on set, or a laptop hack).

8.2. Any suspected breach must be reported immediately to the Managing Director. If the breach poses a risk to individuals, the Company must notify the Information Commissioner’s Office (ICO) within 72 hours.

9. Policy Reviewed and Approved by the Company as of the Effective Date.