Privacy Policy
Introduction
Bold Yellow Media Ltd - Privacy Notice
This privacy notice tells you what to expect us to do with your personal information.
We are a video content production company that provides a range of services related to video production, including filming, editing, and other post-production.
We are committed to protecting the public’s privacy and the confidentiality of their personal information. Our policy is not just an exercise in complying with the law, but a continuation of our respect for the public and their personal information.
Our contact details
We have appointed a data protection officer (DPO) who is responsible for ensuring that our policy is followed. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact our DPO, Emily Jones at hello@boldyellow.co.uk
What information we collect, use, and why
We collect or use the following information to provide video production services and goods, including delivery:
Names and contact details
Addresses
Date of birth
Health information (including dietary requirements, allergies and health conditions)
Health and safety information
Photographs or video recordings
Records of meetings and decisions
We collect or use the following information to comply with legal requirements:
Identification documents
We collect or use the following information to be able to gather, retain, adapt, edit and use recorded video material:
Names and contact details
Date of birth
Photographs or video recordings
Recorded images, such as photos or videos
Records of consent, where appropriate
Lawful bases
Our lawful bases for collecting or using personal information to provide services and goods, including the collection, retention, adaptation, editing, and use of recorded video material are:
Consent: We have robust consent mechanisms in place when obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information.
Contract
Legal obligation
Legitimate interest: A real business interest is pursued in the collection and processing of data that exists within video footage that has been shared with the correct consent collected and in compliance with GDPR.
Our lawful bases for collecting or using personal information for legal requirements are:
Legal obligation
Where we get personal information from
People directly
Recorded images and footage
Schools, colleges, universities or other education organisations
Previous employers
How we safeguard information
We follow strict security procedures in the storage and sharing of personal information to prevent unauthorised access; improper use and accidental loss, damage and destruction:
Information is only kept as long as is necessary (see below);
Hard drives and memory cards containing recorded footage are kept securely;
Footage is transferred from camera(s) / memory cards to a hard drive kept in a secure location as soon as is practically possible;
Unnecessary copies of recorded footage including those held by external suppliers are deleted as soon as is practically possible;
All electronic devices containing personal data are password-protected
We use secure email services to ensure that emails containing personal data are secure
We store files containing personal data on Google Drive, which is only accessible through password-protected email accounts
Any hard copies of personal data we may have are stored securely and access is restricted to authorised personnel only.
How long we keep information
We only retain personal information for as long as is necessary to fulfil our contractual obligations to customers, comply with legal requirements, tax and accounting rules, or for other reasonable legal purposes set out in this Privacy Notice.
The retention period will vary according to the nature of the information held. As a general rule:
Hard copies of personal data are securely destroyed after 12 months;
Digital copies of recorded footage are securely destroyed after 2 years;
Digital copies of recorded footage of children are securely destroyed after 1 year
Who we share information with
Data processors
Vimeo
This data processor does the following activities for us: Vimeo hosts videos that contain personal data, ie participants' image
Squarespace
This data processor does the following activities for us: They host our website which includes videos that contain personal data, ie participants' image
Other organisations
Organisations we need to share information with for safeguarding reasons
Organisations we’re legally obliged to share personal information with
Publicly on our website, social media or other marketing and information media (where appropriate)
Other relevant third parties, ie clients who commission video production services from us. They are in receipt of video content which includes personal data, i.e. participants' image. They are also occasionally in receipt of copies of consent forms gathered by us.
We take steps to ensure that any third-party service providers or business partners with whom we share personal data have adequate measures in place to protect the data and comply with relevant data protection laws and regulations. We only share personal data with these parties when necessary and always in compliance with applicable data protection laws.
Sharing information outside the UK
Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.
Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.
Children’s data
When filming children:
We collect their data in the form of a signed consent form and in the form of recorded footage of their image. We require the consent of the legal guardian of any minor before any personal data is collected;
We always explain what the footage will be used for, how it will be stored and for how long;
We make it clear that if a child or their family withdraw consent for footage to be shared, it may not be possible to delete images that have already been shared or published;
We never publish personal information about individual children and we disguise any identifying information
Your data protection rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask us for copies of your personal data.
Your right to rectification - You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal data in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent.
You don’t usually need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Last updated: March 2025