1. Who we are (data controller)

Data controller:
Drift Studio LTD
3rd Floor, 86-90 Paul St, London, EC2A 4NE
12370136. Registered in England & Wales

Contact for privacy enquiries:
Email: office@driftstudio.london

2. What personal data we collect

We may collect and process the following categories of personal data:

2.1 Information you give us directly

  • Contact and identity data: name, email address, phone number, job title, company/organisation name.

  • Project and enquiry data: details you provide in contact forms, lead generation forms (including on Facebook/Instagram), or emails (e.g. project type, budget range, timeline, description of your project).

  • Communications: records of our correspondence with you (emails, messages, call notes).

  • Marketing preferences: whether you have opted in to receive newsletters, updates, or marketing communications.

2.2 Information collected automatically when you use our website

  • Usage data: pages you visit, time and date of your visit, time spent on pages, clickstream data, referring website.

  • Device and technical data: IP address, browser type and version, operating system, device type.

  • Cookies and similar technologies: see the “Cookies” section below.

We do not knowingly collect data from children. Our services are not directed to individuals under 18.

3. How and why we use your data (purposes and lawful bases)

We only process your personal data where we have a lawful basis under GDPR. Our main purposes and lawful bases are:

3.1 Responding to enquiries and providing services

Purpose:
To respond to your messages, discuss potential projects, provide quotes, and deliver film production and related services.

Lawful basis:

  • Contract: processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you.

  • Legitimate interests: where needed to manage our business relationship with you (e.g. project administration, invoicing, client communications), provided this does not override your rights.

Data used: contact details, project/enquiry data, communications.

3.2 Website operation, security and analytics

Purpose:
To operate, secure, and improve our website; detect and prevent fraud or abuse; understand how visitors use the site.

Lawful basis:

  • Legitimate interests: in maintaining a functional, secure, and improving website and business.

Data used: usage data, device data, IP address, cookies.

3.3 Marketing and communications (where you opt in)

Purpose:
To send you newsletters, updates about our work, events, or relevant offers where you have agreed.

Lawful basis:

  • Consent: where you have explicitly opted in (e.g. by checking a box on a form or subscribing via our website or social channels).

You can withdraw your consent at any time by using the unsubscribe link in our emails or contacting us at office@driftstudio.london.

3.4 Legal and regulatory obligations

Purpose:
To comply with applicable laws, tax, accounting, and regulatory requirements; to respond to lawful requests from public authorities.

Lawful basis:

  • Legal obligation.

Data used: contact details, transaction and invoice data as required.

4. How we collect your data

We collect personal data:

  • Directly from you when you:

    • Fill in contact or lead generation forms on our website or on platforms such as Facebook/Instagram.

    • Email or message us.

    • Engage us for services.

  • Automatically when you visit our website via cookies and similar technologies.

  • From third parties where necessary (e.g. referral partners, publicly available information) to confirm details of a potential project, where lawful.

5. Who we share your data with

We do not sell your personal data. We may share it with:

  • Service providers (processors): companies that help us run our business, such as:

    • Website hosting and analytics providers.

    • Email and marketing platforms.

    • Cloud storage and backup providers.

    • Accounting and invoicing software.

  • Professional advisers: lawyers, accountants, insurers where necessary.

  • Public authorities: where we are legally required to do so.

All third parties are required to respect the security and confidentiality of your data and to process it only on our instructions and in line with applicable data protection laws.

6. International transfers

Some of our service providers may be located outside the UK or European Economic Area (EEA), including in countries such as the United States.

Where we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs) approved by the UK/EU, or

  • Other legally approved transfer mechanisms.

If you would like more information about specific transfers and safeguards, please contact us at office@driftstudio.london.

7. How long we keep your data

We only keep your personal data for as long as necessary for the purposes set out in this policy.

Our general retention principles:

  • Enquiries that do not lead to a contract: we typically retain your contact and project details for [e.g. 12–24 months] from our last communication, unless you ask us to delete them sooner.

  • Clients and active contracts: we retain relevant data for the duration of the contract and then for [e.g. 6–7 years]to meet legal, tax, and accounting obligations.

  • Marketing lists: we keep your data until you unsubscribe or request deletion.

  • Website logs and analytics: retained for [e.g. 12 months] or as needed for security and analysis.

Where we cannot specify an exact period, we use criteria such as: the nature of the data, the purpose of processing, legal requirements, and whether there is an ongoing business need.

8. Your rights under GDPR

Depending on your location and the circumstances, you have the following rights:

  • Right of access: to request a copy of the personal data we hold about you.

  • Right to rectification: to correct inaccurate or incomplete data.

  • Right to erasure (“right to be forgotten”): to request deletion of your data in certain circumstances.

  • Right to restrict processing: to limit how we use your data in certain cases.

  • Right to data portability: to receive your data in a structured, commonly used format or have it transferred to another controller, where applicable.

  • Right to object: to object to processing based on legitimate interests or for direct marketing.

  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

  • Right to lodge a complaint: with a supervisory authority (e.g. the Information Commissioner’s Office (ICO) in the UK).

To exercise any of these rights, please contact us at office@driftstudio.london. We will respond within one month(subject to limited extensions for complex requests).

We may need to verify your identity before fulfilling your request. In some cases, we may be legally entitled or required to refuse or limit your request (e.g. where it affects others’ rights or our legal obligations).

9. Cookies and similar technologies

9.1 What are cookies?

Cookies are small text files stored on your device when you visit our website. They help us:

  • Remember your preferences.

  • Understand how you use our site.

  • Improve performance and security.

9.2 Types of cookies we use

  • Essential cookies: required for the website to function (e.g. security, load balancing). These cannot be disabled.

  • Analytics cookies: help us understand visitor behaviour (e.g. Google Analytics, if used).

  • Marketing cookies: used to deliver relevant ads or measure campaign performance (if we run advertising).

9.3 Managing cookies

You can control and/or delete cookies via your browser settings. Most browsers allow you to:

  • View cookies stored on your device.

  • Delete existing cookies.

  • Block all or some cookies.

Note that disabling certain cookies may affect website functionality.

For more detail, see our separate [Cookie Policy] or our cookie banner/management tool on the website.

10. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • Secure connections (HTTPS) on our website.

  • Access controls and password protection.

  • Regular software updates and security patches.

  • Staff training on data protection.

  • Secure contracts with processors who handle your data.

While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you and relevant authorities of any significant breach as required by law.

11. Automated decision‑making and profiling

We do not currently use automated decision‑making or profiling that produces legal or similarly significant effects for individuals.

If this changes in future, we will update this policy and provide clear information about the logic involved and the consequences for you.

12. Use of Facebook / Instagram (Meta) lead forms and ads

When you interact with our ads or lead generation forms on Facebook or Instagram:

  • Personal data you submit (such as name, email, phone number, and project details) is shared with us and stored in our systems.

  • Meta acts as a separate controller for some data; its own privacy policy applies to Meta’s processing.

  • We use this data solely to contact you about your enquiry and potential projects, as described in this policy.

13. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

  • The “Last updated” date at the top of this page will be revised.

  • Significant changes will be communicated via our website or by email where appropriate.

  • We encourage you to review this policy periodically.

14. Contact and complaints

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

Email: office@driftstudio.london

If you are in the UK, you also have the right to complain to the Information Commissioner’s Office (ICO):
https://ico.org.uk