Privacy Notice

1. Introduction

Bexmedia respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains:

• what personal information we collect;
• how and why we use it;
• who we may share it with;
• how long we keep it;
• how we protect it; and
• the rights available to you.

This notice applies to clients, prospective clients, suppliers, freelancers, production contributors, people appearing in our content, job applicants, website visitors, marketing contacts and other people who interact with Bexmedia.

It should be read alongside our Terms and Conditions, Cookie Policy and any project-specific privacy information, contributor release form or data-processing agreement that we provide.

2. Who we are

Bexmedia is the trading name of:

Podchains Limited trading as Bexmedia
Company number: 06574496

Registered office:
2 Stanthill Drive
Dursley
Gloucestershire
GL11 4PP

Trading address:
Bexmedia
Unit 10, The Steadings Business Centre
Maisemore
Gloucester
GL2 8EY

Email: hello@bexmedia.net
Telephone: 01452 347585

For the purposes of data-protection law, Podchains Limited will usually be the data controller for the personal information described in this notice.

Please mark any privacy enquiry or data-protection complaint for the attention of the Directors.

3. Data controller and data processor roles

The role Bexmedia performs will depend on the circumstances.

When we are the controller

We will normally act as a data controller when we decide why and how personal information is used. This includes information relating to:

• enquiries and prospective clients;
• our clients and business contacts;
• suppliers and freelancers;
• our own marketing;
• production planning;
• people appearing in content that we commission;
• our website and premises;
• recruitment;
• accounting and business administration; and
• the security and operation of our systems.

When we are a processor

In some projects, a client determines why personal information is being used and Bexmedia processes it only on the client’s documented instructions.

This may apply where a client provides us with:

• customer or employee contact details;
• participant lists;
• interviewee information;
• event registration information;
• existing footage, photographs or audio;
• marketing contact lists;
• health or accessibility information;
• survey or research material; or
• other personal information required to complete a project.

In these circumstances, the client will normally be the controller and its own privacy notice will apply. Bexmedia will process the information in accordance with its contract and data-processing agreement with that client.

Questions about information controlled by one of our clients may need to be referred to that client.

4. Personal information we collect

The information we collect depends on your relationship with Bexmedia and the nature of the project.

Contact and identity information

This may include:

• your name;
• job title;
• employer or organisation;
• business or personal email address;
• telephone number;
• postal address;
• social-media username; and
• preferred method of communication.

Client and project information

This may include:

• project briefs;
• proposals and quotations;
• contracts and purchase orders;
• project correspondence;
• call sheets and production schedules;
• location information;
• travel and accommodation details;
• meeting notes;
• approvals and feedback;
• contributor information;
• usage and licensing information; and
• information needed to organise or deliver a production.

Video, photography and audio

As a video-production and animation company, we may collect and process:

• video footage;
• photographs;
• voice recordings;
• interviews;
• livestream recordings;
• transcripts;
• subtitles;
• names, job titles and biographical information;
• footage recorded by drones; and
• other identifiable creative or production material.

Financial information

This may include:

• billing addresses;
• bank details;
• payment records;
• invoices;
• expense information;
• tax information; and
• information required for credit control or accounting.

We do not normally collect or retain payment-card information because payments are generally made by BACS.

Website and technical information

When you use our website or online services, we may collect:

• IP address;
• browser and device information;
• website activity;
• referral source;
• cookie identifiers;
• approximate location derived from an IP address;
• form-submission information; and
• security and diagnostic logs.

Further information is provided in our Cookie Policy.

Account and access information

Where it is necessary to provide a service, a client may give us temporary access to a website, platform or online account.

We will only request access that is reasonably necessary for the project. Access details should be provided using an agreed secure method wherever possible.

We do not ask clients to provide access to their personal email accounts unless this is specifically necessary, agreed and appropriately protected.

Access credentials will be restricted to authorised people and deleted or returned when they are no longer required.

CCTV and premises security

We may use CCTV or other security systems at our premises to:

• protect staff, visitors and property;
• prevent and investigate theft or damage;
• support health and safety; and
• investigate security incidents.

CCTV information is retained only for a short and proportionate period unless it is required to investigate an incident, establish or defend legal claims, or comply with a legal obligation.

Recruitment information

If you apply to work with us, we may collect:

• your CV and application;
• employment and education history;
• portfolio or showreel;
• references;
• interview notes;
• right-to-work information; and
• information about your availability and suitability.

Employee information is covered by separate internal privacy information.

5. Special-category information

Some projects may involve more sensitive information, known as special-category personal data. This may include information about:

• health or disability;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• sex life or sexual orientation; or
• biometric information used for identification.

We will only collect or use this information where it is genuinely necessary and where both a lawful basis and an additional legal condition apply.

For example, we may receive health, dietary or accessibility information to keep contributors and crew safe or to make reasonable adjustments.

Where a client provides special-category information, the client is responsible for ensuring that it has an appropriate lawful basis and condition for doing so unless otherwise agreed in writing.

Access to sensitive information will be limited to those who need it.

6. Children and vulnerable people

Some productions may involve children or vulnerable people.

Where appropriate, we will:

• involve a parent, guardian, school, employer, responsible organisation or authorised representative;
• provide age-appropriate information;
• obtain appropriate permissions or releases;
• restrict access to information;
• apply suitable safeguarding measures; and
• avoid collecting unnecessary information.

The exact arrangements will depend on the production and the responsibilities agreed with the client.

7. How we obtain personal information

We may obtain information:

• directly from you;
• from your employer or organisation;
• from one of our clients;
• from a production agency or project partner;
• from a parent, guardian or authorised representative;
• from a supplier or freelancer;
• through our website, email or telephone;
• during meetings, events, filming or livestreaming;
• from publicly available professional sources;
• from social-media or business-networking platforms; and
• from website analytics and security systems.

Where we receive information from another organisation, that organisation is responsible for ensuring that it is permitted to provide the information to us.

8. How and why we use personal information

We will only use personal information where we have a valid legal basis.

Purpose	Typical lawful basis
Responding to enquiries and preparing quotations	Taking steps before entering a contract and our legitimate interests in developing our business
Managing and delivering client projects	Performance of a contract and our legitimate interests in delivering and administering projects
Planning filming, animation, livestreaming and post-production	Performance of a contract and legitimate interests
Communicating with clients, contributors, suppliers and crew	Performance of a contract and legitimate interests
Recording and using interviews, video, photographs and audio	Contract, legitimate interests or consent, depending on the circumstances
Managing contributor releases and content permissions	Contract and legitimate interests
Appointing and managing suppliers and freelancers	Contract, legal obligation and legitimate interests
Producing invoices, managing payments and keeping financial records	Contract and legal obligation
Maintaining project records and responding to later queries	Legitimate interests and the establishment or defence of legal claims
Protecting our staff, premises, equipment, systems and information	Legitimate interests and legal obligation
Preventing fraud, misuse and unauthorised access	Legitimate interests and legal obligation
Sending relevant business-to-business marketing	Legitimate interests or consent, as applicable
Sending marketing to individuals where consent is required	Consent
Operating essential website functions	Legitimate interests and provision of the requested service
Using non-essential cookies or analytics	Consent
Handling complaints, legal claims and regulatory enquiries	Legal obligation and legitimate interests
Considering job applications	Steps before entering a contract, legitimate interests and legal obligation

Where we rely on legitimate interests, we consider:

• the purpose and benefit of the processing;
• whether the processing is necessary;
• what an individual would reasonably expect;
• the possible effect on the individual; and
• whether additional safeguards are needed.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

Withdrawing consent will not necessarily require us to stop processing information where another lawful basis applies, such as a legal obligation or the performance of a contract.

9. Video, photography, audio and published content

The production and publication of identifiable content may involve both data-protection rights and separate contractual, copyright, licensing or contributor-release arrangements.

The basis on which content is recorded and used will depend on the project. This may be explained through:

• a contributor release;
• a filming notice;
• a contract;
• a client privacy notice;
• project-specific information; or
• another appropriate form of notification.

Content may be supplied to a client for publication on websites, social media, internal systems, advertising, events, training platforms, television or other agreed channels.

Once content has been lawfully published or distributed, it may not always be possible to recall every copy. We will nevertheless consider any valid data-protection request and work with the relevant client or publisher where appropriate.

Bexmedia will not make a client’s private project public without the client’s permission or another lawful reason.

Our contractual right to display completed work in our portfolio or for promotional purposes is addressed in our Terms and Conditions and may also be agreed on a project-specific basis.

10. Marketing communications

We may contact business customers and professional contacts about Bexmedia services where we believe the communication is relevant and where the law allows us to do so.

We may rely on legitimate interests for appropriate business-to-business marketing. Where consent is required, we will obtain it before sending the communication.

Every electronic marketing message will provide a straightforward way to unsubscribe or object.

You may ask us to stop using your personal information for direct marketing at any time by:

• using the unsubscribe option in the message; or
• contacting hello@bexmedia.net.

When someone unsubscribes, we may retain a minimal suppression record so that we can respect the request and avoid contacting them again.

We do not sell personal information or marketing lists.

Marketing carried out for a client

Where a client asks Bexmedia to process a contact list or support a marketing campaign, the client is responsible for ensuring that:

• the information was obtained lawfully;
• the proposed communication is permitted;
• any required consent has been obtained;
• appropriate privacy information has been provided; and
• objections and suppression requests are respected.

Unless otherwise agreed, Bexmedia will use the information only to carry out the client’s instructions and will securely delete or return it after the campaign has been completed.

11. Cookies

Our website may use cookies and similar technologies.

Cookies that are strictly necessary for the operation and security of the website may be used without consent where the law permits.

We will ask for consent before using non-essential cookies or similar technologies for purposes such as analytics, advertising or tracking.

You can find further details and manage your preferences through our Cookie Policy and cookie settings.

12. Who we share personal information with

We may share personal information with:

• authorised Bexmedia employees;
• freelancers, crew and production suppliers;
• clients and their authorised representatives;
• production agencies and project partners;
• cloud-storage, collaboration and file-transfer providers;
• video-hosting and review platforms;
• website, email and IT providers;
• transcription, subtitling and production-software providers;
• accountants, payroll providers and financial advisers;
• banks and payment providers;
• insurers;
• legal and professional advisers;
• auditors and certification bodies;
• law-enforcement agencies, regulators or courts;
• health and safety or emergency services where necessary; and
• a purchaser or adviser involved in a sale, restructuring or transfer of our business.

We only provide information that is reasonably necessary for the relevant purpose.

Suppliers that process personal information on our behalf are subject to proportionate checks and appropriate contractual, confidentiality and security requirements.

We may disclose information where this is necessary to comply with the law, protect someone’s safety, prevent fraud, enforce a contract or establish, exercise or defend legal claims.

13. Systems and service providers

Bexmedia uses a range of business and production systems. These may include:

• project and workflow-management systems;
• email and productivity platforms;
• cloud-storage and file-transfer services;
• video-review and hosting services;
• accounting and financial software;
• production, editing and transcription software;
• secure local and off-site storage;
• backup systems; and
• specialist systems selected for an individual project.

The particular suppliers used may change over time. Bexmedia maintains internal records of its principal systems, suppliers and processing arrangements.

14. International transfers

Some of our suppliers, platforms or project partners may process personal information outside the United Kingdom.

Where a restricted international transfer takes place, we will use a legally recognised mechanism where required. This may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another approved safeguard; or
• a specific exception permitted by law.

Where appropriate, we will also assess the risks associated with the transfer and apply additional technical, organisational or contractual protections.

15. Information security

Bexmedia uses proportionate technical and organisational measures to protect personal information.

These measures may include:

• individual user accounts;
• strong passwords;
• multi-factor authentication where available;
• access restrictions based on job role and project need;
• secure physical storage;
• confidential-waste disposal;
• secure deletion of electronic information;
• controlled access to production storage;
• secure backup arrangements;
• staff confidentiality obligations;
• cyber-security and data-protection training;
• supplier checks;
• anti-malware and system-security measures;
• security monitoring;
• incident-reporting procedures; and
• periodic reviews of our systems and controls.

No system can be guaranteed to be completely secure. However, we regularly review our arrangements and take reasonable steps to address identified risks.

16. Retention of personal information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected.

Our usual approach is:

Information	Typical retention approach
Unsuccessful enquiries and quotations	Normally up to two years after the last meaningful contact
Client contracts, correspondence and project-administration records	Normally up to seven years after completion or termination
Invoices, payments and accounting records	Normally six years after the end of the relevant financial year, or longer where legally required
Supplier and freelancer records	Normally up to seven years after the relationship or transaction ends
Contributor releases and usage records	For as long as the content remains in use and for an appropriate period afterwards
Working footage, audio, project files and production assets	For the project period and any additional period stated in our contract, estimate or Terms and Conditions
Marketing information	Until consent is withdrawn, an objection is received or the information is no longer required
Marketing suppression information	For as long as reasonably necessary to respect the objection
Recruitment information for unsuccessful applicants	Normally up to 12 months unless a longer period is agreed
Website and security logs	For a limited period determined by their security and operational purpose
CCTV	For a short, proportionate period unless required for an incident, claim or investigation

Project files are not retained indefinitely unless this has been specifically agreed. Clients should maintain their own copies of final deliverables and any project material that they are required to keep.

Information may be kept for longer where necessary to:

• comply with a legal or regulatory obligation;
• deal with a complaint;
• investigate an incident;
• establish or defend a legal claim;
• protect someone’s safety; or
• comply with an agreed client retention requirement.

When information is no longer required, it will be securely deleted, anonymised or destroyed. Information held in backups will be removed through the relevant backup-rotation process.

17. Your data-protection rights

Depending on the circumstances, you may have the right to:

• ask whether we process your personal information;
• request a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• object to direct marketing;
• request the transfer of information in a portable format;
• withdraw consent;
• raise concerns about automated decision-making; and
• make a complaint.

These rights are not absolute. Whether a right applies may depend on the purpose of the processing, the lawful basis and any applicable legal exemptions.

We do not currently make decisions that have a legal or similarly significant effect on individuals solely through automated processing.

To exercise a right, contact:

Email: hello@bexmedia.net

Post:
The Directors
Bexmedia
Unit 10, The Steadings Business Centre
Maisemore
Gloucester
GL2 8EY

Please describe the information or processing concerned. We may ask for reasonable proof of identity or authority before releasing or changing personal information.

We will respond within the time required by data-protection law.

There is normally no charge for exercising a right. However, the law may allow a reasonable fee or permit us to refuse a request where it is manifestly unfounded or excessive.

18. Data-protection complaints

You may complain to Bexmedia if you are concerned about how we have collected, used, shared, retained or protected your personal information.

Complaints may be sent to hello@bexmedia.net or to our trading address. Please mark the communication Data Protection Complaint.

We will:

• provide a clear way for you to make a complaint;
• acknowledge receipt within 30 days;
• take appropriate steps to investigate;
• keep you informed where appropriate; and
• communicate the outcome without undue delay.

We may ask for additional information or proof of identity where reasonably necessary to investigate the complaint.

We would appreciate the opportunity to address your concern directly. However, you also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information is available from the Information Commissioner’s Office website.

19. Personal data breaches

Bexmedia maintains procedures for identifying, assessing, recording and responding to personal data breaches.

Where Bexmedia is the controller, we will assess the likely risk to the people affected.

Where legally required, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to an individual, we will also inform the affected individual without undue delay unless an applicable legal exception applies.

Where Bexmedia is acting as a processor, we will notify the relevant client or controller without undue delay and provide reasonable assistance in accordance with our contract.

Not every security incident is legally reportable, but relevant incidents will be assessed and documented.

20. Confidentiality and client information

Bexmedia employees are subject to confidentiality obligations.

Freelancers, suppliers and production partners may also be required to enter into appropriate confidentiality and data-processing agreements.

We are willing to consider reasonable client confidentiality agreements where these are appropriate to the project. Any additional confidentiality requirements should be raised before the relevant information is provided.

Clients must ensure that they have the necessary authority, permissions and lawful basis before providing Bexmedia with personal information, photographs, designs, footage, account access or third-party materials.

21. Changes to this Privacy Notice

We may update this notice to reflect:

• changes in the law;
• regulatory guidance;
• changes to our services;
• new systems or suppliers;
• changes to our business; or
• improvements to our privacy practices.

The latest version will be published on our website and will show the date on which it was last updated.

Where a change is likely to have a significant effect on how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals.

22. Contact us

Questions about this notice or Bexmedia’s use of personal information should be sent to:

The Directors
Podchains Limited trading as Bexmedia

Email: hello@bexmedia.net
Telephone: 01452 347585

Trading address:
Unit 10, The Steadings Business Centre
Maisemore
Gloucester
GL2 8EY