PRIVACY NOTICE | A-OK Media House

AOK Media House

Privacy Notice

Last updated: August 2026

1. About this notice

This notice explains how A-OK Media House Limited collects, uses and protects personal data. It applies to everyone whose personal data we handle, including visitors to our website, crew and freelancers who work with us, contributors and participants in our productions, and our business contacts.

We are the data controller for the personal data described in this notice. That means we decide what data is collected and how it is used, and we are responsible for looking after it.

Our details

Company name: A-OK Media House Ltd
Company registration number: 10014987
Country of registration: England and Wales
Registered office: Bartle House, 9 Oxford Court, Manchester, M2 3WQ
Email: info@aokmediahouse.com
ICO registration number: ZC220237

If you have any questions about this privacy notice, wish to exercise your data-protection rights, or have concerns about how we handle your personal data, please contact the person responsible for data protection at:

Email: info@aokmediahouse.com

Post: Data Protection, A-OK Media House Ltd, 15 Neptune Court, Vanguard Way, Cardiff, United Kingdom, CF24 5PJ

2. Website visitors

When you visit our website, we collect:

Information you give us directly when you contact us by email, such as your name, email address, the content of your message and any other personal information you choose to provide.
Information about your visit collected automatically through cookies and similar technologies, such as your IP address, browser and device type, pages viewed, referring website and the date and time of your visit.

We use enquiry information to respond to you and to keep an appropriate record of our correspondence. Our lawful basis is our legitimate interests, namely responding to people who contact us and managing our business relationships.

Where your enquiry concerns a possible contract or engagement with us, we may also use your information to take steps at your request before entering into a contract.

We use strictly necessary technical information to operate and protect our website. Our lawful basis is our legitimate interests in maintaining the operation and security of our website.

Where we use optional analytics cookies, we use the resulting information to understand how visitors use our website and to improve its content and performance. Where required, our lawful basis is your consent, given through our cookie banner. You can withdraw or change your consent through the cookie settings on our website.

We do not use your email address to send marketing messages, newsletters or updates about our productions.

3. Crew, freelancers and contractors

When you work with us, or apply to work with us, we collect:

Identity and contact details, including your name, address, telephone number, email address and date of birth.
Engagement and payment information, including your bank details, National Insurance number, tax status, loan-out or personal service company details, rate and payment records.
Right-to-work documentation.
Emergency contact and next-of-kin details.
Where relevant to overseas travel, insurance or safety, health, dietary and medical information, and passport and visa details.
CVs, credits and references where you apply for work with us.
Where appropriate and lawful for the role, information obtained through a Disclosure and Barring Service check or other information relating to criminal convictions and offences.
Where you choose to provide it for equal opportunities and diversity monitoring, information such as your age, sex, gender identity, ethnicity, disability, religion or belief, and sexual orientation.

We use this information to consider applications, engage and pay crew, freelancers and contractors, meet our legal and regulatory obligations, arrange insurance and travel, protect health and safety, and manage our productions.

Our lawful bases are taking steps at your request before entering into a contract, performing our contract with you, complying with our legal obligations, and our legitimate interests in recruiting suitable personnel and running our productions safely and efficiently.

Where we handle health or medical information, this is special category data. Where applicable, we rely on Article 9(2)(b) of the UK GDPR because the processing is necessary for us to meet obligations or exercise rights under employment, social security or social protection law. Where that condition does not apply, we will identify another lawful condition before processing the information, such as your explicit consent where this can be freely given and withdrawn.

We collect criminal convictions and offences information only where it is necessary, proportionate and authorised by law. We handle this information in accordance with Article 10 of the UK GDPR and the Data Protection Act 2018, and we restrict access to people who need it for recruitment, safeguarding or production-safety purposes.

Equal opportunities and diversity monitoring information is provided voluntarily and is kept separate from information used to make recruitment or engagement decisions wherever practicable. Where this information is special category data, we process it because it is necessary for the substantial public interest in monitoring and promoting equality of opportunity or treatment, in accordance with Article 9(2)(g) of the UK GDPR and the Data Protection Act 2018. We maintain the safeguards and policy documentation required by law.

4. Contributors and participants

If you apply to take part in, or take part in, one of our productions, we may collect:

Identity and contact details, including your name, address, telephone number, email address and date of birth.
Personal information provided during the casting and research process, including information contained in application forms, casting questionnaires, interviews, correspondence and audition or self-recorded footage.
Background information relevant to the programme, including information about your education, employment, experiences, interests, lifestyle and personal circumstances.
Your image, voice and recorded footage, including material that is not included in the finished programme or otherwise made public.
Signed release forms and any agreements or permissions relating to your participation and the use of programme material.
Where relevant to your safety, welfare or participation, health, medical, accessibility and dietary information, and records of duty-of-care arrangements.
Where relevant to the programme, information you choose to provide about your ethnicity, religion or beliefs, political opinions, health, disability, sex life or sexual orientation.

Core casting and contributor records are managed in-house. Access is limited to members of our team who need the information for casting, research, production, editorial, welfare, legal or compliance purposes. Where necessary, limited personal data may be shared with authorised production suppliers or other recipients described in section 6.

We use this information to assess applications, conduct casting and research, communicate with applicants and contributors, make editorial decisions, produce and deliver our programmes, manage contributor safety and welfare, demonstrate the permissions relating to participation, comply with broadcaster and regulatory requirements, and distribute and otherwise exploit completed programmes.

Our lawful bases are taking steps at your request before entering into an agreement, performing an agreement with you, complying with our legal obligations, and our legitimate interests, and those of the relevant broadcaster, commissioner, co-producer or distributor, in researching, developing, producing, delivering, promoting, distributing and keeping appropriate records relating to the programme.

A contributor release or participation agreement records the permissions and rights relating to your participation and the use of programme material. It does not necessarily mean that consent is our lawful basis under data protection law.

Where we collect special category data, such as information about health, ethnicity, religion, political opinions or sexual orientation, we will identify an appropriate condition under Article 9 of the UK GDPR before processing it. Depending on the circumstances, this may include your explicit consent, information you have manifestly made public, the establishment, exercise or defence of legal claims, or another condition permitted under the Data Protection Act 2018.

You are not required to provide information that we identify as optional. However, if you do not provide information that is reasonably necessary for casting, production, safety, welfare or compliance purposes, we may be unable to assess your application or include you in the production.

Journalism and programme making

Some of our work may be undertaken for journalistic, artistic or literary purposes. The Data Protection Act 2018 provides exemptions from certain data-protection requirements where the relevant statutory conditions are met and compliance would be incompatible with those purposes.

Where we rely on an exemption, some of the rights described in this notice may be limited. We will assess its application in the particular circumstances and will only rely on it where we reasonably believe that publication would be in the public interest.

5. Business contacts

We collect and hold names, job titles, employer or organisation details, business email addresses, telephone numbers and other relevant professional information about people we work with at broadcasters, commissioners, distributors, agencies, suppliers, production companies, professional advisers and partner organisations.

We normally collect this information directly from you, from the organisation you work for, through professional introductions, or from publicly available professional sources.

We use this information to communicate with you, manage our business relationships, obtain and provide services, develop, finance, produce and distribute programmes, maintain appropriate business records, and pursue potential production and commercial opportunities.

Our lawful basis is our legitimate interests in operating and developing our business, maintaining professional relationships and managing our productions. Where the processing is necessary to enter into or perform a contract with you personally, we may also rely on taking steps at your request before entering into a contract or performing that contract.

We do not use business contact details to send newsletters or general marketing communications.

6. Who we share personal data with

We share personal data only where we need to. Recipients may include:

Broadcasters, commissioners and distributors, in connection with the productions they commission or acquire.
Production service companies, fixers and local crew engaged in the territories where we film.
Post-production facilities, editors and technical suppliers.
Payroll providers, accountants, auditors and banks.
Insurers and insurance brokers.
Legal advisers and compliance consultants.
IT, cloud storage, media management and communications providers, including Dropbox and Google drive.
Regulators, law enforcement and other public bodies where we are legally required to do so.

We disclose only the personal data that the recipient reasonably needs for the relevant purpose. We require recipients to protect personal data and handle it in accordance with applicable data-protection law.

Where a supplier processes personal data on our behalf as our processor, we put an appropriate written data-processing agreement in place as required by Article 28 of the UK GDPR. The agreement requires the supplier to process personal data only on our documented instructions, maintain appropriate security measures and assist us in meeting our data-protection obligations.

Some recipients, including broadcasters, commissioners, co-producers, distributors, insurers and professional advisers, may process personal data as independent or joint controllers. Where this applies, they are responsible for complying with their own data-protection obligations. Further information may be provided in a production-specific privacy notice or by the relevant organisation.

Where a recipient is located outside the United Kingdom, we handle the disclosure in accordance with the international-transfer arrangements described in section 7.

We do not sell personal data.

7. International transfers

We produce programmes overseas, including in countries that are not covered by UK adequacy regulations, such as China. As a result, personal data may be transferred to, stored in or accessed from countries outside the United Kingdom.

This may include personal data shared with production service companies, fixers, local crew and other suppliers in the countries where we film. It may also include contributor and crew information needed to arrange filming, travel, accommodation, insurance, safety and production logistics, as well as recorded material carried or securely transmitted from location.

Where UK adequacy regulations apply to the destination country or recipient, we may rely on those regulations to make the transfer.

Where UK adequacy regulations do not apply, we use an appropriate safeguard before making a restricted transfer. Depending on the arrangement, this will normally be the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses. We also complete the required data protection test, commonly known as a transfer risk assessment, and introduce any additional contractual, organisational or technical measures needed to protect the personal data.

These additional measures may include limiting the personal data transferred, restricting access to authorised individuals, using secure transfer methods, encrypting information where appropriate, and requiring recipients to delete or return personal data when it is no longer required.

In limited circumstances, where an appropriate safeguard cannot reasonably be used, we may rely on a specific exception permitted by data-protection law. We will do so only where the legal requirements for that exception are satisfied and the transfer is necessary and proportionate. We do not rely on these exceptions for regular or systematic transfers.

International distribution of a completed programme may result in a contributor’s image, voice or other information included in that programme being made available worldwide. This is distinct from transferring the underlying casting, welfare, employment or production records, which remain subject to the protections described above.

You may contact us using the details in section 1 if you would like further information about the countries to which your personal data may be transferred or the safeguards used to protect it.

8. How long we keep personal data

We keep personal data only for as long as we need it. Our retention periods are:

Category/ Retention period

Website enquiry and contact form data

24 months after our last meaningful contact, unless the correspondence becomes part of another relevant record

Website analytics information

For the period stated in our Cookie Policy and the settings of the relevant analytics service

Crew and freelancer engagement records

Six years after the engagement ends

Unsuccessful applications for crew or freelance work

12 months after the recruitment or engagement decision

Payroll and tax records

Six years after the end of the financial year to which the records relate, or longer where required by law

Right to work documentation

For the duration of the engagement and two years after it ends

Contributor release forms and consents

For as long as the programme or associated material may be used, distributed, licensed or otherwise exploited, and for an appropriate period afterwards to establish or defend legal rights

Contributor duty of care and welfare records

Normally until the child reaches the age of 21, or longer where required for safeguarding, regulatory or legal reasons

Unbroadcast rushes containing identifiable individuals

For as long as reasonably required for editing, compliance, re-versioning, distribution, archiving or the establishment or defence of legal claims. Continued retention will be reviewed at least every six years

Health and dietary information collected for travel and insurance

3 Months after the production concludes

Business contact details

Reviewed after 24 months without meaningful contact and deleted when they are no longer relevant to an active or reasonably anticipated business relationship

When a retention period expires, we securely delete or anonymise the relevant personal data unless we are required or permitted to keep it for longer. Anonymised information that can no longer identify an individual may be retained for research, reporting, statistical or business purposes.

We may retain particular records for longer where this is necessary because of an ongoing production, contractual commitment, safeguarding matter, complaint, investigation, litigation or legal hold. Where this happens, access will be restricted and the continued need for retention will be reviewed.

9. How we keep personal data secure

We maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, destruction, misuse, disclosure or unauthorised access.

These measures include:

Limiting access to personal data to members of our team and authorised suppliers who need it for their work.
Using password-protected accounts, access controls and multi-factor authentication where available.
Storing electronic records using reputable cloud-storage, media-management and communications providers with appropriate security measures.
Protecting personal data during transmission and using encryption where appropriate.
Keeping contributor agreements, release forms, casting information and welfare records in secure locations with access restricted to authorised personnel.
Storing rushes and other recorded material on secure production or post-production systems and limiting access to authorised production personnel and technical suppliers.
Taking reasonable precautions to protect equipment and recorded material used or carried on location, including maintaining appropriate physical control of devices and storage media and transferring material to secure storage as soon as reasonably practicable.
Applying appropriate confidentiality and data-protection requirements to crew, freelancers, contractors and suppliers who handle personal data.
Providing relevant data-protection and information-security guidance or training to people working on our productions.
Reviewing access to personal data and securely deleting or anonymising information when it is no longer required.

Although no system can be guaranteed to be completely secure, we regularly consider the nature and sensitivity of the personal data we hold, the risks associated with its use and the measures reasonably available to protect it.

We have a procedure for identifying, containing, investigating, recording and responding to personal data breaches. Where required by law, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of a reportable breach. Where a breach is likely to result in a high risk to an individual’s rights and freedoms, we will also notify the affected individual without undue delay.

10. Your rights

Under data protection law you have the right to:

Be informed about how we use your personal data, which is the purpose of this notice.
Request a copy of the personal data we hold about you.
Ask us to correct personal data that is inaccurate or incomplete.
Ask us to delete personal data in certain circumstances.
Ask us to restrict how we use your personal data in certain circumstances.
Object to our use of your personal data where we rely on legitimate interests, and to object to direct marketing at any time.
Request that we transfer your personal data to you or another organisation, where the processing is based on consent or a contract and is carried out by automated means.
Withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To exercise any of these rights, contact us at info@aokmediahouse.com . We will respond within one month. There is normally no charge.

Some of these rights are qualified rather than absolute, and may be limited where we are processing personal data for journalism, where we have a legal obligation to keep records, or where the rights of other people are affected. We will explain if that applies to a request you make.

11. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put it right. We will acknowledge your complaint within 30 days. We will investigate it without undue delay, keep you informed where appropriate and tell you the outcome as soon as reasonably practicable.

You also have the right to complain to the Information Commissioner’s Office, which is the UK regulator for data protection. The ICO can be contacted at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

You may contact the Information Commissioner’s Office at any time, although we would appreciate the opportunity to address your concerns first.

12. Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a website.

We use strictly necessary cookies to operate our website, maintain its security and remember choices relating to cookie settings. These cookies are required for the website to function and cannot normally be disabled through our cookie banner.

We may also use optional analytics cookies to understand how visitors use our website, including which pages are visited and how visitors move around the site. This information helps us assess and improve the website’s content and performance.

Where consent is required, optional cookies will not be placed on your device unless you accept them through our cookie banner. You can reject optional cookies or change your preferences at any time by using the cookie settings available on our website. Withdrawing your consent will not affect the lawfulness of any processing carried out before it was withdrawn.

We do not use cookies for advertising or direct-marketing purposes.

Further information about the cookies used on our website, including their providers, purposes and duration, is available through our cookie settings tool or in our separate Cookie Policy.

13. Changes to this notice

We may update this privacy notice from time to time to reflect changes to our activities, how we use personal data, the services and technologies we use, or applicable legal and regulatory requirements.

The “Last updated” date at the top of this notice shows when it was most recently revised.

Where we make a significant change that may materially affect how we use your personal data or your data-protection rights, we will take reasonable steps to bring the change to your attention. This may include publishing a prominent notice on our website or contacting you directly where appropriate.