INTRODUCTION
Sandpaper Films Limited (‘we’, ‘us’, ‘our’) is an independent film and television production company based in London.
We are committed to protecting the privacy of others and complying with all relevant data protection laws and regulations. This privacy policy sets out how we collect and use information about individuals, including those who are involved in the programmes that we make.
You can contact us via info@sandpaperfilms.com if you have any questions or concerns about this privacy policy.
We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
PERSONAL INFORMATION WE COLLECT
“Personal data”, or “personal information”, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
The information we collect about you will depend on how you interact with us but may include your name, address, email address, IP address, gender, date of birth, age, phone number, passport details or other national identifier, driving licence, your national insurance or social security number and income, employment information and details about your previous roles and personal history.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together below:
Contributing to our programmes
The information will be dependent on the nature of the programme, but where relevant this could also include special category data such as medical information, political opinions, sexual orientation, and, where relevant, your criminal history. The nature of the programme and the information which we will be asking you for will be explained to you in advance. Some of this information will be collected directly from you and collected during the course of you taking part in a programme, including: (a) from forms, questionnaires and any other documentation that you (or an agent on your behalf) complete when you apply for a role or part in, or contribute to, a programme; (b) when you provide it to us in correspondence and conversations (e.g. application telephone interviews, pre-filming questionnaires and release forms); and (c) when you apply, participate or contribute to a programme.
We also collect information about you from other sources, including: (a) publicly available and accessible directories and sources; (b) social media platforms, including YouTube, Facebook, Instagram, X, and LinkedIn; (c) subscription only databases such as Lexis Nexis and Reuters; (d) tax authorities, including those that are based outside the UK and the EEA if you are subject to tax in another jurisdiction; (e) governmental and competent regulatory authorities to whom we have regulatory obligations; (f) agents, broadcasters, and production companies; (g) our insurer and insurance broker; (h) fraud prevention and detection agencies and organisations; (i) where we need to do so for regulatory purposes, crime enforcement and criminal records agencies such as the Disclosure and Barring Service and Disclosure Scotland.
Recruitment
We will collect and record various types of personal information about you from a variety of sources, but mainly directly from you. You will usually provide this information directly to us during the recruitment process and your period of engagement. This information will include: (a) your name, gender, nationality, marital status, date of birth, age, home address, telephone number, e-mail, tax information, national insurance number, and eligibility to work data; (b) qualifications, references, CV and application, interview and assessment data, vetting and verification information; (c) payment information, such as bank account details; (d) absence records, holiday dates and information related to family leave; (e) browsing history, data stored on laptops, and other information collected as a result of you using our technology, equipment and systems; and (f) equality and diversity data.
In addition, further information about you may come from: (a) interviews and assessments; (b) risk assessments, incident reports, data relating to training or training received, call sheets, contact lists, organised travel and hotel bookings, and insurance cover; (c) allegations, HR investigations, colleague and manager feedback, appraisals, performance management, flexible working processes, restructure and redundancy plans; (d) employment based litigation and complaints, civil litigation, or your involvement in incident reporting and disclosures; and (e) third parties, such as recruitment agencies, references from a previous employer, medical reports from external professionals, tax authorities, or where we employ a third party to carry out a background check.
In some circumstances, data may be collected indirectly from monitoring devices or by other means, such as building and location access control and monitoring systems, CCTV, telephone logs and recordings, and email and internet access logs.
We may also collect and process a limited amount of special category data about you, and you may also provide us with personal information relating to third parties, such as your next-of-kin and family members.
HOW AND WHY WE PROCESS YOUR PERSONAL INFORMATION
We have set out below the lawful basis on which we process your personal data.
Contract
We consider it necessary to process your personal data to perform our contracts with you in the following circumstances: (a) to meet the contractual obligations between us; (b) to perform the contract (including employment or freelance contract) between you and us. This processing also enables us to provide you with various benefits and to manage and administrate your engagement with us; (c) for compliance with legal obligations which we are subject to; (d) as part of any legally binding contract which you have entered into with us for your application, contribution and/or participation in a programme; and (e) if you are due any payment, to provide to our payments team in order for this to be paid.
Where you have entered into a contract with us to participate in our programmes, we may be entitled to show the programme whether or not you later change your mind about participation.
Legal Obligation
We process your personal data where it is necessary to do so to comply with applicable laws which apply to us as an organisation, including: (a) to verify your identity; (b) to carry out verification and anti-money laundering checks, prevent and detect fraud and carry out other legally mandated checks; and (c) if we are legally obliged to disclose your personal data.
Legitimate Interests
We consider that we have a legitimate interest in producing audio visual programming for commercial exploitation, as such, ‘onscreen’ and ‘off-screen’ contributions from individuals which are crucial to this production activity and require the processing of personal information about these individuals.
We consider that it is in our legitimate interests (or those of a third party) to process your personal information, namely: (a) to produce audio-visual programming for commercial purposes, such as processing ‘on-screen’ and ‘off-screen’ contributions from individuals. When we refer to a “programme” in this privacy policy we mean not just the finished programme but all rushes, clips and unused material; (b) for the assessment of applications for freelance or employment roles to ensure we identify the right people for our business; (c) for the retention of your details so that you may be considered for future opportunities with us; (d) to ensure you undergo training so that you can undertake your role correctly and in accordance with appropriate procedures; (e) to identify and mitigate risks to your health, safety or welfare and ensuring that where required appropriate adjustments are made to your working environment; (f) to assess your continuing involvement for the programme that you are contributing to; (g) to deal with any questions or complaints arising in relation to your participation in a programme; (h) to deal with any agents acting on your behalf; (i) to retain the programme and your personal data in it in our archive, for the purpose of repeating the programme or otherwise using it for commercial purposes; (j) to commercially make full use of either the entire programme or clips from it in the UK and around the world, for the period in which we have rights in the programme. We also keep an archive copy of the programme after our rights have expired – as a record of programming we have either made and/or broadcast; (k) to share with our professional advisors or commissioning broadcaster that we are producing the programme for and/or any co-producer that we are producing the programme with; (l) to verify your age, identity and other information as we may require for the production and exploitation of the programme we are producing; (m) in the event that we sell or buy any business or assets, in which case we may disclose your information to the prospective seller or buyer of such business or assets, along with its professional advisers; (n) to comply with applicable regulatory obligations; (o) to pass on to a competent regulator, prosecutor or competent authority or law enforcement authorities including without limitation the UK Information Commissioner and/or the Office for Communications (OFCOM) should it be requested from us; (p) to comply with our accounting and tax reporting requirements; (q) to comply with our audit requirements; (r) to protect our business against fraud, breach of confidence, theft of proprietary materials, and other financial or business crimes; (s) to monitor communications to/from us using our systems; (t) to protect the security and integrity of our IT systems; and (u) to arrange for you to attend the filming of our programmes.
We monitor communications where the law requires us to do so. We will also monitor where we are required to do so to comply with our regulatory rules and practices and, where we are permitted to do so, to protect our business and the security of our systems.
We will only process your special category data where explicit consent has been given or where such processing is necessary, for example in a medical emergency involving you or for the establishment, exercise or defence of legal claims.
We do not generally rely on obtaining your consent to process your personal data to make a programme in which you appear. This is something which we do as part of our legitimate business interests, as explained above.
DIVERSITY MONITORING
We are part of an industry-wide diversity monitoring initiative called Diamond. The Diamond project uses personal information regarding on and off-screen contributors to programmes to report on the diversity of TV production in the UK.
If you have provided us with your email address (unless you have asked us not to) we will share this with Creative Diversity Network Limited, Soundmouse and Silvermouse and you will be invited to participate in the Diamond project.
The company running the Diamond project will contact you to ask whether you are willing to contribute to the project by providing certain information regarding your diversity characteristics such as gender, ethnicity, disability, age, gender identity and sexual orientation. This information is collected, processed and stored anonymously on the Diamond system, with the relevant data being jointly controlled by the main UK broadcasters including the BBC, ITV, C4, C5, CDN and Sky. If you provide Diamond with your diversity data, they will issue you with a separate privacy notice.
Further information about Diamond can be found here: http://creativediversitynetwork.com/diamond/contributors/.
SHARING YOUR DATA
Your information will be shared within our organisation with our production, human resources, senior management, finance, technology, insurance, health and safety, and legal and business affairs teams.
It may also be shared internally and externally with our professional advisors to prepare contractual documentation or provide legal advice, and with any other teams involved in commercial exploitation such as the finance teams where a payment is required, and the health and safety and insurance teams (and their respective advisors) if their advice is required.
We may pass your information: (a) to our third-party service providers such as agents, subcontractors, and other associated organisations for the purposes of facilitating your application, entry or enquiry or nomination for the programme you are interested in taking part in; and (b) to our third-party service providers such as providers of payroll, auto-enrolment pension, onboarding/offboarding and training services, and other third parties such as our insurers, bankers, IT administrators, lawyers, auditors, investors, consultants and other professional advisors.
We implement measures to ensure that your data is kept safe and secure e.g. by storing it securely, and by keeping electronic data on secure servers and hard drives with appropriate levels of security. Although based in the UK, our business is global which means that we may need to transfer your personal information to organisations outside the European Economic Area (EEA). Where that is the case, we will ensure that adequate safeguards are taken to ensure the safety and security of your personal information and that it is processed in accordance with this privacy policy.
Please be reassured that we will not otherwise share your information further, unless: (a) we are required to do so by law, for example by a court order; (b) we are asked to by competent regulatory, prosecuting and other governmental agencies, or litigation counterparties, in any country or territory; or (c) or for the purposes of prevention of fraud or other crime.
HOW LONG DO WE KEEP YOUR INFORMATION?
We do not retain your information for longer than necessary for the purpose it was collected. We keep your personal data for as long as it is required by us for our legitimate business purposes, to perform our contractual obligations, or such longer period as is required by law or regulatory obligations which apply to us. In general we keep your information only for the period we have legal rights to exploit the programme that your information relates to, but we have included some exceptions to that rule above. We will usually delete your personal information at the end of that period.
USE OF COOKIES
Like many other websites, our website uses cookies. ‘Cookies’ are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns and do not identify you as an individual.
It is possible to switch off cookies by setting your browser preferences, however turning cookies off may result in a loss of functionality when using our website.
YOUR RIGHTS AS A DATA SUBJECT
Your rights as a data subject include:
Access to your data
You can request access to the information we hold on you and we will also tell you: (a) why we are processing it; (b) who are we sharing it with; (c) how long will we be keeping your data; and (d) the source of the information, if it was not collected directly from you.
If you are making a request for a copy of your personal data that we are processing, please be as specific as possible as this will both help us to identify the information more quickly and provide you with a copy without any undue delay.
Rectifying inaccuracies
If you feel the information we hold on you is inaccurate or incomplete, you can ask us to correct or update it.
Right to be forgotten
You can also request that we erase your information in certain circumstances, although that might not always be possible if doing so means we cannot perform our contract with you, or we have a legal obligation or legitimate interest to keep the data.
Restrict the processing
If you feel we are processing your information unlawfully or with inaccurate data, you can ask us to restrict any further processing.
Where personal information is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims unless we have your consent. Please note that even if the processing is restricted, we will continue to store the data.
Object to the processing
If you disagree with any legitimate interest or public interest we have relied upon to process your data, you can object to the processing. We will then stop processing the data unless we can demonstrate a legitimate ground that overrides your rights (e.g. exercising or defend a legal claim).
Data Portability
You can request to receive personal data that you have provided to us in a commonly used format and request that we transmit it to another data controller where feasible, or to you directly.
MAKE A COMPLAINT
We are committed to safeguarding your data and upholding your rights, but if you feel we have not done that, please contact info@sandpaperfilms.com.
Additionally, you have the right to complain to the relevant supervisory authority, which in the UK is the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.
Last updated August 2025