Privacy
Policy
This policy explains what personal information Mash Media Productions Ltd collects, why we collect it, how long we keep it and what rights you have over it. It covers this website and the video, photography and livestream production work we carry out.
Two details still need filling in: the ICO data protection registration number in section 1, and confirmation of the retention periods in section 6. Both are marked [TO ADD] or [CONFIRM] in the text below. This document is a solid working draft, but it has not been reviewed by a solicitor.
On this page
1. Who we are
Mash Media Productions Ltd is the data controller for the information described in this policy. That means we decide why and how it is used.
- Registered name
- Mash Media Productions Ltd
- Company number
- 17239889 (registered in England and Wales)
- Registered office
- 2nd Floor Apple Market House, 17 Union Street, Kingston upon Thames, England, KT1 1RP
- Trading as
- Mash Productions
- Group
- Part of Mash Media Group Ltd
- mashproductions@mashmedia.net
- Telephone
- +44 (0) 208 481 1122
- ICO registration
- [TO ADD] — our registration number with the Information Commissioner's Office
We have not appointed a Data Protection Officer, as we are not required to. Data protection questions go to the email address above.
2. What we collect
When you use the enquiry form
The form on our home page asks for your name and email address, and optionally your company, the type of event and any details you want to give us. We also record the date and time of the submission and whether you opted in to marketing.
We deliberately do not ask for a phone number, postal address or anything else we do not need in order to reply to you and prepare a quote.
When you email, call or message us
We keep the correspondence itself and whatever contact details it contains, so we can handle your enquiry and keep a record of what was agreed.
When you visit the website
Our host generates standard server logs, which include IP addresses, timestamps, the pages requested and browser information. We use these only for security and to keep the site running. We do not run Google Analytics or any other analytics or advertising tracker on this site.
When we work with you as a client
Names, job titles, work email addresses and phone numbers of the people we deal with, plus booking, invoicing and payment records.
What we do not collect
We do not knowingly collect special category data (such as health, ethnicity, religion or political opinions) through this website, and we do not ask for it. We do not sell personal data to anyone, ever. This site is aimed at businesses and is not directed at children.
3. Why we use it, and our lawful basis
Under UK GDPR we must have a lawful basis for each use of your data. Ours are set out below.
| What we do | Data used | Lawful basis |
|---|---|---|
| Reply to your enquiry and prepare a quote | Name, email, company, event details | Legitimate interests — responding to someone who has contacted us about our services. Also steps prior to entering a contract where you go on to book. |
| Deliver a booked production and hand over the footage | Client contact details, brief, delivery details | Performance of a contract |
| Invoice you and keep accounting records | Billing contact and payment records | Legal obligation (tax and company law) and performance of a contract |
| Send marketing emails about our services | Name, email | Consent, which you give by ticking the optional box on our form and can withdraw at any time. Existing clients may also receive these under the soft opt-in in regulation 22(3) of PECR, with an unsubscribe link every time. |
| Keep the site secure and working | Server logs, IP address | Legitimate interests — protecting our systems |
| Load embedded YouTube video | IP address and device data shared with Google | Consent — nothing loads until you agree. See our Cookie Policy. |
| Publish a client testimonial or name a client we have worked with | Name, job title, employer, the quote itself | Legitimate interests, and we obtain the person's agreement before publishing. Tell us and we will take it down. |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we think it is not, because the data involved is business contact information used for the purpose you provided it. You can object at any time — see section 8.
4. Filming and photography at events
Our work involves filming and photographing people at exhibitions, conferences, award shows and live events. Footage and stills of identifiable people are personal data, so this section explains how that works.
Who is responsible for what
When an event organiser or venue engages us to cover their event, the organiser is normally the data controller for the footage: it is their event, their attendees, their notices and their decision about how the content gets used. In that arrangement we act as their processor, filming to their brief and handing the material over. Where UK GDPR requires that arrangement to be recorded in writing, we will enter into a written processor agreement with the organiser.
Where we film our own marketing content, or where we retain and reuse footage as part of our own showreel, we are a controller in our own right and rely on legitimate interests, having weighed that against the interests of the people shown.
What we expect from event organisers
If you book us, you are responsible for making sure attendees are told that filming is taking place — typically through signage at entrances, a line in the ticket terms or an announcement — and for handling any objections. We will cooperate with reasonable requests to stop filming someone or to remove them from an edit.
Interviews and pieces to camera
Anyone we interview on camera is asked to agree to the recording and its intended use before or at the point of filming. Tell us if you want a recording of yourself withdrawn and we will remove it from material we control and ask the client to do the same, though we cannot always retrieve content that has already been published by a third party.
Requests about footage
If you appear in something we filmed and want to know what we hold or ask for it to be removed, contact us at the address in section 12. If we filmed on behalf of an organiser we will pass the request to them and tell you we have done so.
5. Who we share it with
We share personal data only with the suppliers we need to run the business, and only so they can do their job for us. Each is bound by contract to protect it.
| Who | What for | Where |
|---|---|---|
| Netlify | Website hosting and delivery of enquiry form submissions | USA / EU |
| Microsoft (Microsoft 365) | Email, calendar and file storage | UK / EU |
| Google Ireland / Google LLC (YouTube) | Video hosting and embedded playback, only after you consent | EU / USA |
| Our accountants and payment providers | Invoicing, bookkeeping and statutory accounts | UK |
| Mash Media Group Ltd | Shared back-office and administration within our group | UK |
| Freelance crew we engage | Delivering a booked shoot, on written terms including confidentiality | Usually UK |
We may also disclose information where the law requires it, or to establish or defend legal claims. We do not sell or rent personal data, and we do not share it for third-party advertising.
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Enquiries that do not become bookings | 24 months from last contact [CONFIRM] | Enquiries in this industry often revive a season or two later |
| Client records and correspondence | 6 years after the end of the relationship | Limitation Act 1980 — the window for contract claims |
| Invoices and accounting records | 6 years after the end of the accounting period | Required by tax and company law |
| Marketing consent records | Until you unsubscribe, plus 2 years | To evidence that consent was given, and to honour the opt-out |
| Delivered footage and project archives | Per contract, otherwise 24 months [CONFIRM] | Reshoots, re-edits and archive requests |
| Server logs | As set by our host, typically 30 days | Security and diagnostics |
When a period ends we delete the data or anonymise it so it can no longer identify you.
7. Transfers outside the UK
Some of our suppliers are based in, or store data in, the United States — Netlify and Google in particular. Where personal data leaves the UK we rely on one of the safeguards allowed by UK GDPR: either the UK Government's adequacy regulations for the UK–US Data Bridge where the supplier is certified under it, or the International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard applying to a particular supplier.
8. Your rights
Under UK GDPR you can ask us to:
- Give you a copy of the personal data we hold about you (a subject access request).
- Correct it if it is wrong or incomplete.
- Delete it, where we no longer have a good reason to keep it.
- Restrict how we use it while a query about it is resolved.
- Object to us using it on the basis of legitimate interests, including profiling. If you object to direct marketing we will stop, no questions asked.
- Receive it in a portable format, where we hold it on the basis of consent or a contract and process it by automated means.
- Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo anything done beforehand.
These rights are not absolute and some have conditions attached. We will always tell you what we have done and why.
Exercising them is free. We will respond within one month. If a request is unusually complex we may extend that by up to two further months and will tell you if so. We may need to confirm your identity before we act.
We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.
9. Security
We use access controls, multi-factor authentication on our business accounts, encrypted connections (HTTPS) across the site, and reputable suppliers with their own security programmes. Footage and project files are held in access-controlled storage.
No system is perfectly secure, and we cannot guarantee the security of data while it is in transit to us over the internet. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you where we are required to.
10. Cookies
This site sets no advertising or analytics cookies. We store your cookie choice in your browser so we do not have to ask again, and we load nothing from YouTube until you say yes. The Cookie Policy sets out the detail and lets you change your mind at any time.
11. Changes to this policy
We update this policy when our practices change. The version number and date at the top tell you which one is current. Material changes will be flagged on the website. We recommend checking back before sending us anything sensitive.
12. How to contact us or complain
For anything in this policy, or to exercise a right, email mashproductions@mashmedia.net with “Data protection” in the subject line, or write to us at the registered office address in section 1.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain directly to the UK supervisory authority:
- Regulator
- Information Commissioner's Office
- Address
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline
- 0303 123 1113
- Website
- ico.org.uk/make-a-complaint