Privacy Policy

PRIVACY POLICY

CRITICAL PRODUCTIONS LTD customer privacy notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Email: contact@critical-productions.com

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

  • Names and contact details
  • Addresses
  • Occupation
  • Transaction data (including details about payments to and from you and details of products and services you have purchased)
  • Usage data (including information about how you interact with and use our website, products and services)
  • Video recordings
  • Audio recordings
  • Records of meetings and decisions
  • Photographs
  • Transcripts and captions

We collect or use the following personal information for research or archiving purposes:

  • Names and contact details
  • Photographs
  • Transcripts and captions

We collect or use the following personal information to comply with legal requirements:

  • Name
  • Contact information
  • Client account information
  • Health and safety information
  • Financial transaction records
  • Invoices

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Purchase or service history
  • Customer or client accounts and records
  • Correspondence

This may include enquiries from potential clients, collaborators, freelancers, suppliers or other people who contact us.

Children

Our website and services are intended for a general/professional audience and are not directed at children.

However, our website and public content may be accessed by people under 18.

We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at contact@critical-productions.com and we will take steps to delete it.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request or raise a concern about how we use your personal information, please contact us using the contact details at the top of this privacy notice. You can also use our data protection request and complaint form.

Where you have signed a release form or contributor agreement, we may have contractual or legitimate interests in continuing to use and retain the relevant content and records. However, you still have data protection rights. If you ask us to remove, restrict or amend content or records relating to you, we will review the request and respond in line with UK data protection law, our contractual rights, the release form and any legal or archive reasons for retaining the material.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    •  delivering and improving our media production services, including documentaries, podcasts, photography, interviews, events and social media content;
    • managing projects, contributors, logistics and editorial processes efficiently and fairly;
    • maintaining the security and integrity of our website, systems and production workflows; and
    • responding to queries and resolving issues relating to our services.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for research or archiving purposes:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • maintaining an archive of our productions and related materials for continuity, editorial reference and historical record;
    • preserving media content, project files and supporting materials for legitimate business and archive purposes;
    • maintaining the security and integrity of archived content and backups; and
    • responding to requests or issues relating to archived or previously published material

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information to comply with legal requirements:

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • responding to enquiries, complaints and claims efficiently and fairly;
    • keeping an appropriate record of communications and outcomes;
    • protecting our organisation in the event of disputes or claims; and
    • improving our services and internal processes based on feedback and issues raised.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you
  • Publicly available sources
  • Third parties:
    • clients, commissioners, partner organisations and collaborators who provide project, contributor, speaker or interviewee details; and
    • existing recordings, footage, photographs or related metadata supplied to us for editing, incorporation or repurposing as part of a production.

How long we keep information

We keep personal information only for as long as necessary for the purposes set out in this notice.

  • Enquiries and contact form submissions: We normally keep enquiry details and correspondence for up to 24 months after our last substantive contact. We may keep them longer where the enquiry develops into a project, contract, complaint, claim or other business record, or where longer retention is needed to protect our legal position.
  • Client contracts, invoices and financial transaction records: We keep these for as long as required for accounting, tax and company law purposes, typically 6 years after the end of the relevant financial period.
  • Release forms and contributor records: We keep these for as long as the relevant content remains in use and for an appropriate period afterwards, because they record the permissions and terms under which the contribution was collected and used. We may retain them for longer where necessary to protect our legal position or respond to questions about the relevant content.
  • Project files, photographs, audio, video and transcripts/captions: We keep working and archive copies for as long as necessary for project delivery, editing, backup, reference and archive purposes.
  • Published content: Films, podcasts, interviews, social media outputs and other published materials may be retained indefinitely as part of our archive unless removal is necessary, for example where we agree to remove content or determine it should no longer remain available. If you ask us to remove or restrict use of published content that identifies you, we will review the request. We may not always be able to remove content where we have a lawful reason to keep using or retaining it, for example where the content has already been published, where we need to retain release forms or records to protect our legal position, or where continued archive use is justified. We will explain our decision when we respond.
  • Website analytics: Website analytics and cookie-related information are retained in line with the settings and retention periods of the relevant analytics and cookie tools.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with

Data processors

Dropbox (cloud storage provider)

This data processor does the following activities for us: Dropbox is used to store and back up recordings (speaker/presenter video/audio) for editing and long-term archive/backup purposes. Access is restricted to the minimum necessary staff involved in recording/organisation.

Google Analytics (website analytics service via Google Site Kit)

This data processor does the following activities for us: website analytics to understand how visitors use our website (e.g., page views and interactions) where visitors have consented to analytics cookies. We do not use Google Analytics for advertising features or ads personalisation.

Ninja Forms (website form plugin)

This processor supports website forms used for enquiries or data protection requests. Form submissions may include names, contact details and the content of the request. We use this to receive and manage enquiries, complaints and data protection rights requests.

Public publishing and distribution platforms

We publish some content publicly on third-party platforms. These platforms process personal information according to their own terms and privacy policies (for example, platform usage analytics and device identifiers for delivering content).

Apple Podcasts (podcast distribution platform)

This data processor does the following activities for us: Apple Podcasts distributes podcast episodes and provides listenership reporting (typically aggregated).

Instagram (social media/video/photo hosting platform)

This data processor does the following activities for us: Instagram is used to publish photographs, videos and other media content and may provide engagement analytics and public interactions.

LinkedIn (social media platform)

This data processor does the following activities for us: LinkedIn is used to publish professional updates, media content and project communications and may provide engagement analytics and public interactions.

Spotify (Spotify for Podcasters) (podcast hosting/distribution platform)

This data processor does the following activities for us: Spotify hosts and distributes podcast episodes and provides podcast delivery and analytics (typically aggregated).

TikTok (social media/video/photo hosting platform)

This data processor does the following activities for us: TikTok is used to publish short-form video content and may provide engagement analytics and public interactions.

YouTube / Google (video and podcast hosting/distribution platform)

This data processor does the following activities for us: YouTube hosts our videos and recorded podcast videos and supports embedding videos on our website.

Others we share personal information with

  • Professional or legal advisors
  • Organisations we’re legally obliged to share personal information with
  • Publicly on our website, social media or other marketing and information media

Sharing information outside the UK

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Organisation name: Apple (Apple Podcasts)

  • Category of recipient: Podcast distribution platform / directory
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

Organisation name: Meta (Instagram)

  • Category of recipient: Social media platform
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

Organisation name: LinkedIn

  • Category of recipient: Social media platform
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: “Adequacy regulations” (UK data bridge) based on active UK Extension DPF evidence.

Organisation name: Spotify (Spotify for Podcasters)

  • Category of recipient: Podcast hosting / distribution platform
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

Organisation name: TikTok

  • Category of recipient: Social media platform
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

Organisation name: Google LLC (YouTube)

  • Category of recipient: Video hosting / distribution platform
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

Sharing of personal information outside of the UK by our data processors

Where necessary, our data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Organisation name: Dropbox

  • Category of recipient: Cloud storage provider
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

Organisation name: Google (Google Analytics)

  • Category of recipient: Website analytics service provider
  • Country the personal information is sent to: United States
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs).

How to complain

If you have any concerns about our use of your personal data, or if you want to exercise your data protection rights, you can contact us by emailing contact@critical-productions.com. You can also use our data protection request and complaint form.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Cookies Policy

Our Cookie Policy can be found seperately.

Last updated

29th July 2026