GDPR Compliance Statement

1. Introduction

ArtOnFilm LTD ("we", "our", "us") is committed to ensuring full compliance with the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). This statement outlines how we process personal data in accordance with these regulations.

Data Controller:
ArtOnFilm LTD
12 Acorn Business Park
Northarbour Road, Portsmouth
England, PO6 3TH
Company Number: [TBC]

2. GDPR Principles

We process personal data in accordance with the following GDPR principles:

• Lawfulness, fairness and transparency - We process data lawfully, fairly and in a transparent manner
• Purpose limitation - We collect data for specified, explicit and legitimate purposes only
• Data minimisation - We only collect data that is adequate, relevant and limited to what is necessary
• Accuracy - We ensure personal data is accurate and kept up to date
• Storage limitation - We keep data only for as long as necessary for the purposes
• Integrity and confidentiality - We process data securely with appropriate technical and organisational measures
• Accountability - We are responsible for and can demonstrate compliance with these principles

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: You have given clear consent for us to process your personal data
• Contract: Processing is necessary for a contract we have with you
• Legal obligation: Processing is necessary to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests

Data Subject Rights

Under GDPR, you have the following rights:

• Right to be informed: About the collection and use of your personal data
• Right of access: To request copies of your personal data
• Right to rectification: To request correction of inaccurate data
• Right to erasure: To request deletion of your personal data
• Right to restrict processing: To request limiting the processing of your data
• Right to data portability: To request transfer of your data
• Right to object: To object to the processing of your data
• Rights related to automated decision making: Including profiling

5. Data Transfers Outside the UK/EEA

Where we transfer personal data outside the United Kingdom or European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions confirming equivalent protection in the destination country
• Binding Corporate Rules where applicable
• Other appropriate safeguards as required by UK GDPR and EU GDPR

6. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means.

7. Data Protection Impact Assessments

Where our processing activities are likely to result in a high risk to individuals' rights and freedoms, we conduct Data Protection Impact Assessments (DPIAs) before commencing such processing. This helps us identify and minimise data protection risks.

8. Data Breaches

In the event of a personal data breach, we have procedures in place to deal with it promptly. Where required by law, we will notify the relevant supervisory authority (ICO in the UK) within 72 hours of becoming aware of the breach. We will also notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

9. Staff Training and Awareness

We ensure that all staff members who handle personal data receive appropriate training on data protection principles and GDPR compliance. Regular awareness sessions are conducted to maintain high standards of data protection across our organisation.

10. Third-Party Processors

Where we engage third-party processors to handle personal data on our behalf, we ensure that appropriate data processing agreements are in place that comply with GDPR requirements. We conduct due diligence on all processors to ensure they provide sufficient guarantees to implement appropriate technical and organisational measures.

11. Supervisory Authority

Our lead supervisory authority is the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF

Tel: 0303 123 1113
Website: www.ico.org.uk

12. Contact Us

For questions regarding GDPR compliance or to exercise your rights, please contact us:

ArtOnFilm LTD
12 Acorn Business Park
Northarbour Road, Portsmouth
England, PO6 3TH

Email: justart@artonfilm.uk