This Privacy Policy explains how Northlight VFX Studio Ltd collects, uses, stores, discloses, and protects personal data in connection with its business activities as a visual-effects studio. It applies to personal data obtained through our website, email communications, project discussions, production services, recruiting activities, client onboarding, vendor relationships, and any other interactions with us.
1. Introduction and company information
For the purposes of applicable privacy laws, the data controller is:
Northlight VFX Studio Ltd
Northlight VFX, 2-4 Great Marlborough Street, London W1F 7HF, United Kingdom
Email: [email protected]
Phone: +44 20 7946 8372
Northlight VFX Studio Ltd provides visual-effects and related creative production services, which may include pre-production consultation, project planning, asset creation, compositing, animation, editorial support, vendor management, client communications, and delivery of finished media. In providing these services, we may process personal data relating to clients, prospective clients, suppliers, contractors, employees, freelancers, website users, and other business contacts.
This Privacy Policy is intended to inform you about the categories of personal data we process, the purposes for which we process it, the legal bases we rely on, and the rights you may have in relation to your personal data.
2. Data collection and processing
We may collect and process the following categories of personal data, depending on your relationship with us and the nature of your interaction:
- Identity data: name, job title, company name, role, and professional contact details.
- Contact data: email address, telephone number, business address, and other contact information.
- Client and project data: project briefs, notes, production requirements, reference materials, timelines, approvals, feedback, and correspondence.
- Financial and transaction data: billing details, invoices, payment records, purchase orders, bank details where necessary, and tax-related information.
- Technical data: IP address, browser type, device information, operating system, log data, and website interaction data.
- Usage data: information about how you use our website, forms, email communications, and digital services.
- Recruitment data: CVs, portfolios, work samples, references, employment history, qualifications, right-to-work information, and interview notes.
- Supplier and contractor data: business contact details, service descriptions, contractual terms, and compliance information.
- Special category data: where strictly necessary and permitted by law, limited information such as health-related adjustments or diversity data may be processed in specific employment or compliance contexts, subject to additional safeguards.
We may obtain personal data directly from you, from your employer or organisation, from publicly available sources, from our clients or service providers, or automatically through our website and digital systems. Where appropriate, we may combine information from different sources to manage our business relationship, deliver services, or improve our operations.
We do not intentionally collect more personal data than is necessary for the relevant purpose. If you provide personal data relating to another person, you should ensure that you have the authority or lawful basis to do so and that the person concerned is aware of this Privacy Policy where required.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and communicate with clients, prospects, suppliers, and other business contacts;
- to assess project requirements, prepare proposals, and negotiate or enter into contracts;
- to provide visual-effects and related creative production services;
- to manage project planning, scheduling, delivery, quality assurance, and approvals;
- to administer billing, invoicing, accounts, taxes, and payments;
- to maintain internal records, audits, and legal or regulatory compliance;
- to manage recruitment, hiring, onboarding, and employment or contractor relationships;
- to operate, secure, and improve our website, IT systems, and communications;
- to monitor and prevent fraud, security incidents, misuse, and unauthorized access;
- to exercise or defend legal claims and protect our rights, property, or safety;
- to send service-related updates, where permitted, and, where applicable, marketing communications;
- to analyse and improve our business processes, service quality, and customer experience.
Where we use personal data for marketing, we will do so in accordance with applicable law and any relevant opt-in or opt-out preferences you have provided. You may object to direct marketing at any time.
4. Legal basis for processing
We process personal data only where we have a lawful basis to do so. Depending on the context, our legal bases may include:
- Performance of a contract: where processing is necessary to enter into or perform a contract with you or the organisation you represent.
- Legitimate interests: where processing is necessary for our legitimate business interests, such as operating our studio, managing client relationships, maintaining security, and improving services, provided those interests are not overridden by your rights and freedoms.
- Consent: where we have asked for your consent, for example for certain marketing activities or the use of optional cookies or similar technologies where required.
- Legal obligation: where processing is necessary to comply with applicable legal, tax, accounting, employment, or regulatory obligations.
- Vital interests: in rare circumstances, where processing is necessary to protect someone’s life or physical safety.
- Public interest or official authority: where applicable law permits processing for tasks carried out in the public interest or under official authority.
Where we process special category data, we will do so only where an additional condition applies under relevant privacy laws, such as explicit consent, employment law obligations, establishment or defence of legal claims, or another lawful condition permitted by applicable law.
5. Data sharing and third parties
We may share personal data with third parties where necessary and lawful for the purposes described in this Privacy Policy. These may include:
- Clients and project partners: where sharing is required for project execution, approvals, or delivery obligations.
- Service providers and processors: such as IT hosting providers, cloud storage providers, email and communications platforms, payroll providers, accounting software, document management tools, and cybersecurity providers.
- Professional advisers: including lawyers, accountants, auditors, insurers, and other advisors.
- Recruitment and HR service providers: where necessary for hiring and workforce management.
- Payment and banking providers: for processing transactions and preventing fraud.
- Authorities and regulators: where we are required to disclose information by law, court order, or other legal process.
- Potential buyers or investors: in connection with a merger, acquisition, reorganisation, or sale of assets, subject to confidentiality protections.
We require third parties who process personal data on our behalf to handle it securely and in accordance with applicable data protection obligations. Where a third party acts as an independent controller, that party’s own privacy policy will apply to its processing activities.
We do not sell personal data in the ordinary course of our business.
6. Data transfer to third countries
Because we work with international clients, vendors, and service providers, personal data may be transferred to, stored in, or accessed from countries outside the United Kingdom and, where applicable, outside the European Economic Area. This may include countries that do not provide the same level of data protection as your home jurisdiction.
Where such transfers occur, we will take appropriate safeguards as required by applicable law. These safeguards may include:
- transferring data to countries recognised as providing adequate protection;
- using standard contractual clauses or equivalent transfer mechanisms;
- implementing supplementary technical and organisational measures where necessary;
- relying on other lawful transfer mechanisms permitted by applicable law.
If you would like more information about the safeguards used for international transfers, you may contact us using the details provided in this Privacy Policy.
7. Storage duration
We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, contractual, and reporting requirements.
The retention period may vary depending on the type of data and the context in which it is processed. In general, we consider the following factors when determining retention periods:
- the duration of our relationship with you or the organisation you represent;
- whether the data is needed to provide services or manage a project;
- legal or regulatory retention requirements;
- limitation periods for legal claims;
- industry practice and business necessity;
- whether the data is required for security, audit, or record-keeping purposes.
When personal data is no longer required, we will delete, anonymise, or securely archive it in accordance with our retention practices and applicable law.
8. User rights (access, rectification, erasure, restriction, data portability, objection)
Subject to applicable law, you may have the following rights in relation to your personal data:
- Right of access: to request confirmation of whether we process your personal data and obtain a copy of that data.
- Right to rectification: to request correction of inaccurate or incomplete personal data.
- Right to erasure: to request deletion of personal data in certain circumstances.
- Right to restriction: to request restriction of processing in certain circumstances.
- Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and, where technically feasible, have it transferred to another controller.
- Right to object: to object to processing based on our legitimate interests or to direct marketing at any time.
These rights are not absolute and may be subject to legal exceptions or limitations. If you wish to exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding to your request.
9. Withdrawal of consent
Where our processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal was received.
If you withdraw consent, we may no longer be able to provide certain optional services or communications. We will explain any consequences at the time you withdraw your consent, where relevant.
You may withdraw consent by contacting us at [email protected].
10. Right to complain
If you have concerns about our handling of your personal data, we encourage you to contact us first so that we can address your concerns directly.
You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In the United Kingdom, this is the Information Commissioner’s Office (ICO). Contact details and complaint guidance are available on the ICO’s website.
Depending on where you live or where your data protection rights arise, you may also have the right to complain to another supervisory authority or regulator under applicable law.
11. Data security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include:
- access controls and role-based permissions;
- encryption or secure transmission methods where appropriate;
- secure storage and backup procedures;
- staff confidentiality obligations and privacy training;
- vendor due diligence and contractual safeguards;
- monitoring for security events and incident response procedures;
- regular review of security practices and system access.
While we take reasonable steps to protect personal data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will take steps to investigate, mitigate, and where required notify you and/or the relevant authority in accordance with applicable law.
12. Contact information
If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise your rights, please contact:
Northlight VFX Studio Ltd
Northlight VFX, 2-4 Great Marlborough Street, London W1F 7HF, United Kingdom
Email: [email protected]
Phone: +44 20 7946 8372
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. Any updated version will be published on our website or otherwise made available to you as appropriate.
Where changes are material, we may provide additional notice, such as by email or a prominent notice on our website. The “last updated” date should be reviewed if provided with the published version. Your continued use of our services or interaction with us after an updated Privacy Policy takes effect will, where permitted by law, signify your acknowledgment of the updated terms.
This Privacy Policy is intended to be read together with any other notices or terms we provide to you in specific contexts. If any inconsistency arises, the more specific notice may apply to the relevant processing activity.