GDPR Statement

FILMD is committed to protecting the rights and freedoms of individuals whose personal data we process. This GDPR Statement sets out how we comply with the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation (where applicable) and the Data Protection Act 2018.

It should be read alongside our Privacy Policy and Cookie Policy, which provide further detail on our processing activities.

Controller

FILMD Services Ltd (company no. 13836541), registered office: 5 Ribblesdale Place, Preston, Lancashire, United Kingdom, PR1 8BZ, is the Data Controller for personal data processed in connection with the Service.

Contact

For any data protection enquiries, contact: privacy@filmd.co.uk.

We process personal data in line with the GDPR's core principles:

• •Lawfulness, fairness and transparency: we tell you what we do with your data and only process it where we have a lawful basis.
• •Purpose limitation: we collect data for specified, explicit and legitimate purposes.
• •Data minimisation: we only collect what we need to deliver the Service.
• •Accuracy: we take reasonable steps to keep personal data accurate and up to date.
• •Storage limitation: we retain personal data only for as long as necessary.
• •Integrity and confidentiality: we use appropriate technical and organisational measures to keep data secure.
• •Accountability: we maintain records and governance to demonstrate compliance.

Depending on the activity, we rely on one or more of the following lawful bases under Article 6 UK GDPR:

• •Contract: to provide the Service, manage your account, deliver Membership benefits and process payments.
• •Legitimate Interests: to operate, secure and improve the platform, prevent fraud and abuse, and enable networking features (balanced against your rights and freedoms).
• •Consent: for optional marketing communications, certain cookies and any special category data you choose to provide.
• •Legal Obligation: to comply with applicable laws, including tax, accounting and lawful requests from authorities.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Subject to certain conditions, you have the following rights:

• •Right of access: obtain a copy of the personal data we hold about you.
• •Right to rectification: ask us to correct inaccurate or incomplete data.
• •Right to erasure ("right to be forgotten"): ask us to delete your personal data where there is no good reason to keep processing it.
• •Right to restrict processing: ask us to suspend processing in certain circumstances.
• •Right to data portability: receive your personal data in a structured, commonly used, machine-readable format.
• •Right to object: object to processing based on legitimate interests, and to direct marketing at any time.
• •Rights in relation to automated decision-making: not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• •Right to withdraw consent: where processing is based on consent.

You can exercise your rights by emailing privacy@filmd.co.uk. We may need to verify your identity before responding.

We will respond to valid requests within one month. In complex cases or where we receive multiple requests from you, we may extend this period by up to two further months and will let you know if we do.

There is normally no fee for handling a request. We may charge a reasonable fee or refuse a request that is manifestly unfounded, repetitive or excessive.

We hope to resolve any concerns you raise directly. If you are not satisfied, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or, where applicable, your local EU/EEA supervisory authority.

ICO: https://ico.org.uk/ · Helpline: 0303 123 1113.

Some of our service providers may process personal data outside the United Kingdom or European Economic Area. Where we transfer personal data internationally, we use appropriate safeguards such as UK adequacy regulations, EU adequacy decisions, or Standard Contractual Clauses with the UK International Data Transfer Addendum where required.

You may request further information about transfers and safeguards by contacting privacy@filmd.co.uk.

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include access controls, encryption in transit, secure hosting, monitoring and staff training.

No system can be guaranteed to be 100% secure. We continuously review and improve our security posture in line with industry best practice.

We maintain procedures to detect, investigate and respond to suspected personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO within 72 hours of becoming aware of it, where feasible.

Where a breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals without undue delay.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting or reporting requirements. Specific retention periods depend on the nature of the data and the context of processing.

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us so we can take appropriate action.

We may update this GDPR Statement from time to time to reflect changes in our practices, services or legal obligations. Where changes are material, we will take reasonable steps to notify users.

For any GDPR or data protection enquiry, contact: privacy@filmd.co.uk.