GDPR Privacy Notice – Talent/Creators

PP113 Privacy Notice

 

Data Controller (“the Company”)

 

Clive Holmes Limited (trading as CHS)

The Island

41 Mill Road

Christchurch 

Dorset

BH23 2JY

Tel:  01202 473423

Email: [email protected]

Data Controller’s representative Chris Southgate – Managing Director

Data Compliance Manager Jane Watton 

 

Definitions

In this privacy notice, the following words and phrases have the following meanings:

“Data subject” means a living identified or identifiable Individual about whom CHS holds personal data.

“Individual” is any: 

• Talent/Creator, 17 years of age or under, or who are still in compulsory education, (with parent/legal guardian consent)
• Talent/Creator, over the age of 18 years

“Personal data” is any information relating to an Individual who can be identified (directly or indirectly) either from the data alone or by any other reference.

“Processing” is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.

“Special categories of personal data” means personal data revealing:

• racial origin
• ethnic origin
• political opinions
• religious beliefs
• philosophical beliefs
• trade union membership
• genetic data
• biometric data
• data concerning the physical or mental health of a data subject 
• data concerning a data subject’s sex life or sexual orientation.

“Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes.

“Criminal records personal data” means personal data relating to criminal convictions and offences and personal data relating to criminal allegations and proceedings.

“Data protection legislation” means the EU General Data Protection Regulation (GDPR), the Data Protection Act 2018 and any other applicable primary or secondary legislation as may be in force in the UK from time to time.

“Content” means all photographs, images, digital images, videos, creative content 

 

Introduction

CHS collects and processes personal data, relating to you, in order to manage our working relationship.  This information may be held by us electronically, on paper or on other materials. 

CHS is committed to being clear and transparent about how it handles your personal data, to protecting the confidentiality, security and integrity of the personal data and to meeting its data protection obligations under the General Data Protection Regulation (“GDPR) and the Data Protection Act 2018.

The purpose of this privacy notice is to make you aware of how and why we will collect and use your personal data both during and after your working relationship with us. We are required under the GDPR to notify you of the information contained in this privacy notice.

This privacy notice applies to all Individuals, as detailed above.  It is non-contractual and does not form part of any agreement or other contract to provide services.  CHS will review this privacy notice at regular intervals and we reserve the right to update or amend it at any time.

CHS has appointed a Data Compliance Manager to oversee compliance with this privacy notice. If you have any questions about this privacy notice or about how we handle your personal data they can be contacted as follows:

Jane Watton email : [email protected]

CHS Tel:  01202 473423

The Island

41 Mill Road

Christchurch

Dorset

BH23 2JY

 

Data protection principles

Under the data protection legislation, there are six data protection principles that CHS must comply with. These provide that the personal data we hold about you must be:

1. Processed lawfully, fairly and in a transparent manner. (Lawfulness, Fairness and Transparency)
2. Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes. (Purpose Limitation)
3. Adequate, relevant and limited to what is necessary in relation to those purposes. (Data Minimisation)
4. Accurate and, where necessary, kept up to date. (Accuracy)
5. Kept in a form which permits your identification for no longer than is necessary for those purposes. (Storage Limitations)
6. Processed in a way that ensures appropriate security of the data. (Integrity and Confidentiality)

CHS is responsible for, and must be able to demonstrate compliance with these data protection principles. This is called the principle of accountability.

 

What types of personal data do we collect about you?

Personal data is any information about any person from which that person can be directly or indirectly identified. It does not include anonymised data, i.e. where all identifying particulars have been removed. 

CHS collects, uses and processes a range of personal data about you from a number of sources, depending on your relationship or contract with us.  This includes but is not limited to:

• your contact details, including your name, telephone number, mobile telephone, number, personal email address
• your emergency contact details
• your next of kin
• your date of birth
• your gender
• the start and end dates of your engagement or contract
• the terms and conditions of your engagement including your working hours, Talent/Creatorl Release form (the Agreement), call sheets, or engagement terms
• work biography including work history, both with previous employers, agencies, other third parties and with CHS
• your bank account details
• health and safety audits including risk assessments, incident reports, accident book entries, first aid records
• VAT number
• Company/self employment information 
• Company/self employment/business contact details including email address, address, landline telephone number, mobile telephone numbers.
• hire/contract start and end dates
• records of your registration with any applicable regulatory authority, your regulated status and any regulatory references.
• photographs, images, digital images, videos  (Content)
• licences for child talent, council licences
• travel and hotel bookings
• business/personal insurance cover
• for individuals engaged by outsourced service providers we may receive data directly from the relevant agency or service provider

 

How do we collect your personal data?

CHS may collect personal data about Individuals in a variety of ways.

We will also collect additional personal data throughout the period of your working relationship with us. This may be collected in the course of your work-related activities. Whilst some of the personal data you provide to us is mandatory and/or is a statutory or contractual requirement, some of it you may be asked to provide to us on a voluntary basis. We will inform you whether you are required to provide certain personal data to us or if you have a choice in this.

Your personal data may be stored in different places, including in our HR management system, financial accounts files, location shoot files, client job files, and in other IT systems, such as the e-mail system.

 

Why and how do we use your personal data?

We will only use your personal data when the law allows us to. These are known as the legal bases for processing. We will use your personal data in one or more of the following circumstances:

(1) where we need to do so to perform the contract or agreement we have entered into with you

(2) where we need to comply with a legal obligation

(3) where it is necessary to pursue our legitimate interests (or those of a third party), and your interests or fundamental rights and freedoms do not override our interests.

We may also occasionally use your personal data where we need to protect your vital interests (or someone else’s vital interests).

We need all the types of personal data listed under “What types of personal data do we collect about you?” primarily to enable us to perform our contract or agreement with you:

(1) to enable us to comply with our legal obligations 

(2) where it is necessary to pursue our legitimate interests (or those of a third party), and your interests or fundamental rights and freedoms do not override our interests.

(3) Our legitimate interests include: 

(i) performing or exercising our obligations or rights under the direct relationship that exists between CHS and you as an Individual

(ii) performing effective internal administration and ensuring the smooth running of the business

(iii) ensuring the security and effective operation of our systems and network

(iv) protecting our confidential information

(v) conducting due diligence

We believe that you have a reasonable expectation, as our Talent/Creator, that we will process your personal data. 

We have indicated, by using (1), (2) or (3) next to each type of personal data listed above, what lawful basis we are relying on to process that particular type of personal data.

The purposes for which we are processing, or will process, your personal data are detailed below. These include but are not limited to:

• enabling us to maintain accurate and up-to-date records
• maintaining records and contact details (including details of whom to contact in the event of an emergency)
• assessing your suitability for engagement 
• complying with statutory and/or regulatory requirements and obligations, e.g. checking your right to work in the UK
• complying with the duty to make reasonable adjustments for disabled persons and with other disability discrimination obligations
• engaging in and maintaining a working business relationship and/or contract 
• maintaining an accurate record of your engagement terms
• administering the contract we have entered into with you
• conducting standard pre-contract due diligence
• ensuring compliance with your statutory and contractual rights
• managing, planning and organising work
• enabling effective workforce management
• ascertaining your fitness to work
• meeting our obligations under health and safety laws
• making decisions about continued engagement
• providing references on request 
• preventing fraud
• ensuring network and information security and preventing unauthorised access and modifications to systems
• ensuring effective HR, personnel management and business administration, including accounting and auditing
• ensuring adherence to our rules, policies and procedures
• monitoring equal opportunities
• enabling us to establish, exercise or defend possible legal claims
• ensuring VAT requirements are met
• ensuring local education authority requirements are met

Please note that we may process your personal data without your consent, in compliance with these rules, where this is required or permitted by law.

 

What if you fail to provide personal data?

If you fail to provide certain personal data when requested or required, we may not be able to perform the contract we have entered into with you, or we may be prevented from complying with our legal obligations. You may also be unable to exercise your statutory or contractual rights.

 

Why and how do we use your sensitive personal data?

We will only collect and use your sensitive personal data, which includes special categories of personal data when the law additionally allows us to.

Some special categories of personal data i.e. information about your health or medical conditions, is also processed so that we can perform or exercise our obligations or rights under employment law or social security law and in line with our data protection policy.

The purposes for which we are processing, or will process, these special categories of your personal data, includes but is not limited to:

• assessing your suitability for engagement
• complying with statutory and/or regulatory requirements and obligations
• complying with the duty to make reasonable adjustments for disabled persons and with other disability discrimination obligations
• administering the contract or agreement we have entered into with you
• ensuring compliance with your statutory and contractual rights
• ascertaining your fitness to work
• managing, planning and organising work
• enabling effective workforce management
• meeting our obligations under health and safety laws
• making decisions about continued engagement
• ensuring effective HR, personnel management and business administration
• ensuring adherence to our rules, policies and procedures
• monitoring equal opportunities

Where we processes other special categories of personal data, i.e. information about your racial or ethnic origin, religious or philosophical beliefs and sexual orientation, this is done only for the purpose of equal opportunities monitoring and in line with our data protection policy. Personal data that we use for these purposes is either anonymised or is collected with your explicit written consent, which can be withdrawn at any time. It is entirely your choice whether to provide such personal data.

We may also occasionally use your special categories of personal data where it is needed for the establishment, exercise or defence of legal claims.

 

Change of purpose

We will only use your personal data for the purposes for which we collected it. If we need to use your personal data for a purpose other than that for which it was collected, we will provide you, prior to that further processing, with information about the new purpose, we will explain the legal basis which allows us to process your personal data for the new purpose and we will provide you with any relevant further information. We may also issue a new privacy notice to you.

 

Who has access to your personal data?

Your personal data may be shared internally within CHS, including with members of the HR department, financial accounts department, project managers and IT staff if access to your personal data is necessary for the performance of their roles.

CHS may also share your personal data with third-party service providers (and their designated agents), these include but are not limited to:

• external organisations for the purposes of conducting reference and background checks
• benefits providers and benefits administration, including insurers
• external auditors
• local authorities
• professional advisers, such as lawyers and accountants

We may also need to share your personal data with a regulator or to otherwise comply with the law.

We may share your personal data with third parties where it is necessary to administer the contract we have entered into with you, where we need to comply with a legal obligation, or where it is necessary for our legitimate interests (or those of a third party).

 

How does CHS protect your personal data?

CHS has put in place measures to protect the security of your personal data. It has internal policies, procedures and controls in place to try and prevent your personal data from being accidentally lost or destroyed, altered, disclosed or used or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees or consultants and other third parties who have a business need to know in order to perform their job duties and responsibilities. You can obtain further information about these measures from our Data Compliance Manager.

Where your personal data is shared with third-party service providers, we require all third parties to take appropriate technical and organisational security measures to protect your personal data and to treat it subject to a duty of confidentiality and in accordance with data protection law. We only allow them to process your personal data for specified purposes and in accordance with our written instructions and we do not allow them to use your personal data for their own purposes.

CHS has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of a suspected breach where we are legally required to do so.

 

For how long does CHS keep your personal data?

CHS will only retain your personal data for as long as is necessary to fulfil the legitimate business purposes for which it was collected and processed, including for the purposes of satisfying any legal, tax, health and safety, reporting or accounting requirements.

 

Retention – Talent/Creators

CHS will generally hold personal data, including any special categories of personal data belonging to talent/creators for the duration of our business relationship with them, however, all Content held by CHS is signed for by Talent and Creators as in perpetuity, or for the agreed term, therefore selected personal data may be held by CHS in perpetuity.

Once your engagement has been terminated we will generally hold your personal data for one year after the termination of your engagement, but this is subject to: 

(a) any minimum statutory or other legal, tax, health and safety, reporting or accounting requirements for particular data or records, and 

(b) the retention of some types of personal data for up to six years to protect against legal risk, e.g. if they could be relevant to a possible legal claim in a County Court or High Court, and

(c ) any Content which has been signed for by the Talent/Creator as in-perpetuity and any data required to support the Content.

Overall, this means that we will “thin” the file of personal data that we hold one year after the termination of the business relationship, so that we only continue to retain personal data for a longer period if it is strictly necessary.

 

Your rights in connection with your personal data

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes, e.g. you change your home address, during your working relationship with us so that our records can be updated. CHS cannot be held responsible for any errors in your personal data in this regard unless you have notified us of the relevant change.

As a data subject, you have a number of statutory rights. Subject to certain conditions, and in certain circumstances, you have the right to:

• request access to your personal data – this is usually known as making a data subject access request and it enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it
• request rectification of your personal data – this enables you to have any inaccurate or incomplete personal data we hold about you corrected
• request the erasure of your personal data – this enables you to ask us to delete or remove your personal data where there is no compelling reason for its continued processing, e.g. it is no longer necessary in relation to the purpose for which it was originally collected
• restrict the processing of your personal data – this enables you to ask us to suspend the processing of your personal data, e.g. if you contest its accuracy and so want us to verify its accuracy
• object to the processing of your personal data– this enables you to ask us to stop processing your personal data where we are relying on the legitimate interests of the business as our legal basis for processing and there is something relating to your particular situation which makes you decide to object to processing on this ground
• data portability – this gives you the right to request the transfer of your personal data to another party so that you can reuse it across different services for your own purposes.

If you wish to exercise any of these rights, please contact our Data Compliance Manager to request a Data Subject Access Request Form (DSAR).

We may need to request specific information from you in order to verify your identity and check your right to access the personal data or to exercise any of your other rights. This is a security measure to ensure that your personal data is not disclosed to any person who has no right to receive it.

In the limited circumstances where you have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. This will not, however, affect the lawfulness of processing based on your consent before its withdrawal. If you wish to withdraw your consent, please contact our Data Compliance Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data for the purpose you originally agreed to, unless we have another legal basis for processing.

If you believe that CHS has not complied with your data protection rights, you have the right to make a complaint to the Information Commissioner’s Office (ICO) at any time. The ICO is the UK supervisory authority for data protection issues.

 

Transferring personal data outside the European Economic Area

CHS will not transfer your personal data to countries outside the European Economic Area.

 

Automated decision making

Automated decision making occurs when an electronic system uses your personal data to make a decision without human intervention.

CHS does not carry out any automated processing and does not take any decisions based solely on automated decision-making, including profiling.  However, we will notify you in writing if this position changes.

 

Changes to this privacy notice

CHS reserves the right to update or amend this privacy notice at any time, including where we intend to further process your personal data for a purpose other than that for which the personal data was collected or where we intend to process new types of personal data. We will issue you with a new privacy notice when we make significant updates or amendments. We may also notify you about the processing of your personal data in other ways.

CHS’ GDPR Data Protection Policy (PP110) is available upon request.

 

Contact

If you have any questions about this privacy notice or how we handle your personal data, please put your request in an email, and send it to our Data Compliance Manager as follows: 

Jane Watton email: [email protected]

CHS Tel:  01202 473423

The Island

41 Mill Road

Christchurch

Dorset

BH23 2JY

 

Author: Jane Watton
Issue date: 19.02.2019                  
Version: V4.0
Next review date: 18.08.2023