Privacy
Privacy notice
How personal information is collected, used, stored and shared when you enquire about or take part in a Now & Then film.
1. Who is responsible for your information
Alexander Jordan, a sole trader trading as Now & Then, is the controller of the personal information described in this notice.
16 Ash Grove, Kingsbury, B78 2JW, UK
alec@nowandthenfilms.co.uk
2. Who this notice covers
This notice covers people who enquire about or buy the service, people who take part in filming, intended recipients who contact the Provider, and other people whose information is supplied for a project. A customer who receives and privately uses a family film is responsible for their own subsequent use and sharing of that copy.
3. Information collected
- Contact, booking, quotation, correspondence and complaint information.
- Planning questionnaires, interview topics, access needs and scheduling information.
- Video, audio, photographs, archive material, captions and edited films.
- Biographical information and any special category information a participant chooses to disclose, such as health, ethnicity, beliefs, politics or sexual orientation.
- Invoice and payment records. The Provider does not normally retain full card or bank-security details.
- Website and enquiry-form information, including submission details and limited technical or security information supplied by the website and form providers.
- Review, delivery and technical information, such as access logs supplied by the chosen review or file-delivery service.
- Optional marketing permissions, approved clips, stills, names and testimonials.
Information normally comes from the person concerned. It may also come from the customer, another family member, archive materials or a service provider. When information is collected from someone else, the Provider will give the person this privacy information within one month, or earlier if the Provider first contacts them or discloses the information, unless a lawful exception applies.
4. Information needed to provide the service
A name, a reliable contact method and enough project information to answer an enquiry are normally needed. If a booking proceeds, the information identified in the service agreement, participant form and invoice is needed to administer the contract, confirm voluntary participation and deliver the film. Other questionnaire answers, archive material, accessibility details and optional publicity permissions are voluntary. If required information is not supplied, the Provider may be unable to quote, reserve a filming date, film a participant or deliver the service.
5. Purposes and lawful bases
Enquiries and quotations
Contact details, the project outline and correspondence are used to take steps requested before a contract under Article 6(1)(b), or under legitimate interests in responding to other project contacts under Article 6(1)(f). Special category information is not routinely required.
Customer service and administration
Booking, contract, access, project and delivery information is used to perform the contract under Article 6(1)(b). Explicit consent under Article 9(2)(a) is used where special category information is necessary.
Participant filming and the private family film
A participant's image, voice, contribution, biography and project correspondence are used with consent under Article 6(1)(a). Explicit consent under Article 9(2)(a) is used for special category information about that participant.
Accounts and legal duties
Invoices, payments, contracts and tax records are used to meet legal obligations under Article 6(1)(c) and the legitimate interest in managing and defending claims under Article 6(1)(f). The legal-claims condition may apply under Article 9(2)(f).
Optional publicity
Specifically approved clips, stills, names and testimonials are used with consent under Article 6(1)(a), and explicit consent under Article 9(2)(a) if approved material reveals special category information.
Security and service improvement
Access, incident and limited technical information is used under the legitimate interest in operating a secure, reliable service under Article 6(1)(f). Special category information is not routinely required.
Right to object: You may object to processing based on legitimate interests. The Provider will stop unless there are compelling legitimate grounds or the information is needed for legal claims.
6. Information about other living people
Life interviews can mention relatives, friends and other living people. The Provider aims to minimise identifiable third-party information and may remove material that is irrelevant, intrusive or cannot be used lawfully. A participant's consent does not cover another person's special category information or criminal allegations and convictions. That material will not normally be included without a separate lawful basis and, where required, an additional condition under data protection law.
7. Who receives information
Information may be provided only as necessary to:
- the customer and intended private family recipients;
- email, website hosting, enquiry-form, video-hosting, cloud storage, backup, editing, transcription, captioning, review, delivery and IT-support providers;
- payment, banking, accounting, insurance and professional advisers; and
- regulators, courts or public authorities where disclosure is required or permitted by law.
Current providers are Zoho Mail for email, Cloudflare for website hosting and security, Formspree for enquiry forms, YouTube (Google) for public video hosting, Dropbox Standard for storage and backup, Dropbox Replay for review and Dropbox Standard for delivery, and Adobe Creative Cloud for editing and approved transcription or captioning features. Where a provider processes personal information for Now & Then, it is used under the applicable business terms and data-processing agreement. Some providers also use limited account or security information for their own purposes under their privacy information. Customers use direct invoices paid by bank transfer; no separate card-payment service is currently used.
8. International transfers
Some service providers process information outside the UK. Where this is a restricted transfer, Now & Then relies on the relevant provider's contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved Standard Contractual Clauses, and completes any required transfer-risk assessment. Details of the safeguard used for a particular provider, and how to obtain a copy, are available by contacting Now & Then.
9. Website videos and storage technologies
The website does not use analytics or advertising cookies operated by Now & Then. Public film excerpts are hosted by YouTube using its privacy-enhanced mode. Loading or playing an embedded film may allow YouTube/Google to store or access information on the visitor's device and receive technical information such as the IP address, browser details and viewing activity. Further information is provided with the players. YouTube/Google is responsible for its own subsequent use of that information under its privacy information.
10. Retention
| Record | What is kept | Normal period |
|---|---|---|
| Website form submissions | Enquiry details held in the Formspree account. | Up to 30 days |
| Enquiries not booked | Correspondence and quotation information. | 12 months after last contact |
| Customer agreement | Agreement and core project correspondence. | 6 years after project completion |
| Finance and tax | Invoices and payment records. | At least 5 years after the 31 January tax-return deadline for the relevant tax year |
| Planning material | Questionnaires, topic notes and supplied documents. | 90 days after final delivery |
| Project media | Raw footage, project files, review copies and delivery copies held in the Provider's systems or service-provider accounts. | 90 days after final delivery |
| Participant permissions | Consent, withdrawal and action records, including the privacy-notice version supplied. | 6 years after project completion or withdrawal |
| Optional publicity | Consent, withdrawal and action records, and approved material. | Approved material while consent remains valid; minimal consent record for 6 years after last use or withdrawal |
| Complaints or claims | Relevant correspondence and evidence. | 6 years after closure, or longer if a claim remains active |
Information may be retained longer where a dispute, legal hold, insurance requirement or law requires it. When no longer needed, digital information is securely deleted from active systems and allowed to expire from backups in line with the backup cycle; paper is securely destroyed.
11. Security
The Provider uses access controls, device and account security, appropriate backups, private review and delivery links, and limited access to reduce the risk of loss, misuse or unauthorised disclosure. No method is completely risk-free. A personal data breach will be assessed and reported to affected people or the ICO where the law requires.
12. Your rights and withdrawing consent
Depending on the circumstances and lawful basis, you may ask for access, correction, deletion, restriction or transfer of your information, or object to its use. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. After withdrawal, the Provider may retain a minimal record of the consent, withdrawal and action taken under a different lawful basis where necessary to demonstrate compliance or deal with legal claims. Some rights are subject to legal limits and may not apply to every record.
To exercise a right or withdraw consent, email alec@nowandthenfilms.co.uk or write to Alexander Jordan, 16 Ash Grove, Kingsbury, B78 2JW, UK. The Provider may need enough information to confirm identity and locate the relevant records. There is normally no charge. The Provider will normally respond to a rights request within one month; if a request is complex, the law may permit more time and the person will be told within the first month.
13. Data-protection complaints and changes
A data-protection complaint may be made by email to alec@nowandthenfilms.co.uk or in writing to the address above. The Provider will acknowledge the complaint within 30 days, investigate it without undue delay, keep the complainant informed where appropriate, and explain the outcome. Making a complaint to the Provider does not affect the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.
This notice will be reviewed when the service, retention periods or service providers change. The version and effective date above identify the notice that applied when information was collected.