Privacy Policy of LumenFrame Studio Ltd
1. Introduction and company information
This Privacy Policy explains how LumenFrame Studio Ltd (“we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data when you visit our website, contact us, make enquiries, book or use our green-screen studio services, engage with our productions, or otherwise interact with us.
LumenFrame Studio Ltd is the data controller for the personal data described in this Privacy Policy, unless we state otherwise.
Company details:
LumenFrame Studio Ltd
Unit 4, Riverside House, 21 Havelock Road, Harlow, CM20 2BY, United Kingdom
Email: [email protected]
Phone: +44 20 7946 8372
This Privacy Policy is intended to provide clear information about our data handling practices in connection with our green-screen studio business, including studio bookings, production support, technical services, client communications, invoicing, and related website and marketing activities.
2. Data collection and processing
We may collect and process the following categories of personal data:
- Identity data: name, title, job title, company name, and, where applicable, identification details required for access control or contractual purposes.
- Contact data: email address, telephone number, postal address, billing address, and communication preferences.
- Booking and service data: studio reservation details, shoot dates, production requirements, technical specifications, cast and crew details you provide, and related correspondence.
- Financial and transaction data: payment status, invoice details, bank details where necessary, and records of payments made to or from us.
- Technical data: IP address, browser type, device identifiers, operating system, website interaction data, log files, and cookies or similar technologies.
- Usage data: information about how you use our website, services, and communications.
- Visual and audio data: photographs, video recordings, and audio recordings captured during studio sessions, security monitoring, or for production-related purposes where applicable.
- Marketing data: your preferences in receiving marketing from us and your communication choices.
- Special category data: only where strictly necessary and where permitted by law, for example if you voluntarily provide information that may reveal health or accessibility requirements relevant to a studio booking or safe site access.
We collect personal data directly from you, from your employer or organisation, from booking and payment systems, from our website, from CCTV or access-control systems where used, and from third parties such as production partners, suppliers, or professional advisors.
We process personal data in a manner that is lawful, fair, transparent, and limited to what is necessary for the stated purposes.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and provide quotations;
- to manage bookings, studio access, production logistics, and related services;
- to communicate with clients, suppliers, crew, talent, and other contacts;
- to issue invoices, process payments, and manage accounting and tax obligations;
- to maintain business records and administer contracts;
- to operate, maintain, secure, and improve our website, systems, and services;
- to monitor and protect our premises, staff, clients, visitors, assets, and confidential production materials;
- to comply with legal and regulatory obligations;
- to send service-related notices and, where permitted, marketing communications;
- to handle complaints, claims, disputes, and legal proceedings;
- to analyse service performance and improve customer experience; and
- to support health and safety, accessibility, and on-site operational requirements for studio productions.
4. Legal basis for processing
We process personal data only where we have a lawful basis to do so. Depending on the context, the legal basis may include:
- Contract: where processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.
- Legal obligation: where processing is necessary for compliance with applicable laws, including tax, accounting, health and safety, and regulatory requirements.
- Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests. This may include business administration, service improvement, fraud prevention, network and information security, and direct B2B communications.
- Consent: where you have given clear consent, for example for certain marketing communications or specific optional processing activities. You may withdraw consent at any time.
- Vital interests: in rare cases where processing is necessary to protect someone’s life.
- Public task or official authority: where applicable under law.
Where we process special category data, we will do so only where permitted by law and subject to an additional lawful condition, such as explicit consent or necessity for employment, health and safety, or legal claims.
5. Data sharing and third parties
We may share personal data with the following categories of recipients, where necessary and appropriate:
- Service providers: IT hosting providers, cloud storage providers, website analytics providers, email and communication platforms, customer relationship tools, payment processors, accounting providers, and security providers.
- Professional advisors: lawyers, accountants, auditors, insurers, consultants, and similar advisers.
- Studio and production partners: freelancers, contractors, crew, equipment suppliers, and production support providers assisting with your project or our operations.
- Authorities and regulators: law enforcement, courts, tax authorities, and other public bodies where disclosure is required or permitted by law.
- Business transferees: prospective buyers, investors, merger partners, or successors in the event of a reorganisation, sale, or transfer of our business or assets.
We require third parties that process personal data on our behalf to do so only under appropriate contractual terms and with suitable safeguards.
6. Data transfer to third countries
Your personal data may be transferred to and processed in countries outside the United Kingdom and, where relevant, outside the European Economic Area. This may occur where our service providers or business partners operate internationally.
Where such transfers take place, we will implement appropriate safeguards as required by applicable law. These safeguards may include adequacy regulations, standard contractual clauses, international data transfer agreements, supplementary measures, and other lawful transfer mechanisms.
If you would like more information about the safeguards used for international transfers, you may contact us using the details set out below.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, contractual, security, and operational requirements.
Retention periods vary depending on the type of data and the purpose of processing. In general:
- enquiry and correspondence data are kept for as long as needed to manage the enquiry and a reasonable follow-up period;
- contract, booking, and invoicing records are kept for the period required by applicable legal and financial obligations;
- website and technical logs are kept for a limited period necessary for security, troubleshooting, and analytics;
- marketing data are kept until you unsubscribe, object, or the data become outdated; and
- visual recordings and access-control data are kept only for as long as needed for the relevant security, production, or operational purpose.
Where personal data are no longer needed, we will securely delete, anonymise, or archive them in accordance with our retention practices and legal obligations.
8. User rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: obtain confirmation of whether we process your personal data and receive a copy of that data.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your personal data in certain circumstances.
- Restriction: request restriction of processing in certain circumstances.
- Data portability: receive certain data in a structured, commonly used, machine-readable format and request transfer to another controller where technically feasible.
- Objection: object to processing based on legitimate interests or to direct marketing at any time.
We may need to verify your identity before responding to a request. We will respond within a reasonable time and in accordance with applicable legal requirements. Some rights may not apply in all situations, and we may refuse requests where lawful grounds exist.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
You can withdraw consent by contacting us using the details below or by using any unsubscribe or preference-management mechanism we provide. If you withdraw consent, we may no longer be able to provide certain optional services or communications.
10. Right to complain
If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve the issue.
You also have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction where you live, work, or where you believe a data protection issue has occurred. If you are in the United Kingdom, this may be the Information Commissioner’s Office (ICO).
11. Data security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
These measures may include:
- access controls and role-based permissions;
- password protection and, where appropriate, multi-factor authentication;
- secure storage and encryption where suitable;
- network and endpoint security measures;
- staff confidentiality obligations and training;
- physical security measures at our premises;
- backups and disaster recovery arrangements; and
- procedures for assessing and responding to security incidents.
No system can be guaranteed to be completely secure. However, we strive to protect your data using measures proportionate to the risks associated with our business activities.
12. Contact information
If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact:
LumenFrame Studio Ltd
Unit 4, Riverside House, 21 Havelock Road, Harlow, CM20 2BY, United Kingdom
Email: [email protected]
Phone: +44 20 7946 8372
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, operational needs, or technology. Any updated version will be posted on our website with a revised effective date or other appropriate indication of the update.
We encourage you to review this Privacy Policy periodically so that you remain informed about how LumenFrame Studio Ltd handles personal data.