GDPR Statement

Name of company
David French T/A Devonia Media

Registered office

13 Shute Park, Malborough, Devon TQ7 3SU

Data Protection
Under the Data Protection Act 2018 and GDPR (General Data Protection Regulation), we have a duty to protect any personal information we collect.
Personal data collected will only be used for the purpose of reporting on project success and will not be disclosed to any external organisations (except partners) without your permission. The information will be anonymised for reporting purposes.

Customer Privacy Notice
David French T/A Devonia Media is a media production company providing filming, editing and production services. Devonia Media is committed to respecting your right to privacy and to processing your personal information in a lawful, fair, and transparent way. As a Data Controller, all personal data we hold about you will be processed in line with the General Data Protection Regulations (‘GDPR’) and data protection laws.
 
The following summarises:

• How we use personal data
• What personal data we need
• Why we need it
• How we use it
• Who we might share it with
• How long we will keep it for

It also sets out the rights you have regarding any of the personal data held by Devonia Media. From time to time we may update this Notice. Any updates will be posted on our website.

What is personal data?
Personal data is any information relating directly or indirectly to a living individual. This information includes things such as a name, an identification number, location data, online identifier or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
 
What personal data do we process?
We only collect personal data for specific, clear and legitimate purposes and we will not process it for purposes that differ from those we have notified you about. We will limit our use of your personal data to what is needed, relevant to, and necessary for the purposes we have identified. Access to your personal data is given only to those who need to process it for the purposes identified. We will ensure that we keep your personal data accurate and up to date and will not store it for longer than is necessary.
 
The types of personal data we collect includes (but are not limited to):

• Name
• Address
• Phone number(s)
• Email address(es)
• Other identifiers (for example social media usernames)
• Images (still and moving)
• Location data

 
We collect this information directly from you. For example, when you:

• Interact with our website and social media platforms
• Become a customer
• Make an enquiry through our website(s)
• Purchase services or products from us
• Raise a complaint or request

We also collect information indirectly when filming; for example we may film personally identifiable characteristics of individuals at identifiable locations, such as faces, or vehicle number plates.

Why do we process personal data?
Our processing of your personal data is necessary for us to provide services to you, maintain our relationship with you and to fulfil our legal obligations. We use personal data for the following reasons:

• Managing enquiries
• Managing our suppliers and contractors
• Improving customer experience
• The management and governance of our businesses
• Fulfilling our legal obligations

How do we process your personal data?
The GDPR gives companies several lawful reasons to collect and process personal data.
Below are the lawful reasons we rely upon and the types of processing activities that relate to each:

Performance of a Contract: In some circumstances it is necessary to process your personal data in order to fulfil our contractual obligations with you. Without this information we would not be able to provide a service to you. For example, contacting you as a new or existing client.

Legal Obligation: In some circumstances it is necessary to process your personal data so we can comply with our legal obligations. Without this information we would not be able to fulfil our legal obligations to you, the authorities, or regulatory and statutory bodies. For example:

• Supplier/subcontractor compliance
• Preparation of legal matters
• Administering public liability claims
• Providing support to and protection of customers, for example administering safeguarding procedures

 
Legitimate Interest: There are situations where processing your personal data is necessary to pursue our legitimate interests as a business. We must balance our interests as a business with yours as an individual, so that our legitimate interests do not override your interests, rights or freedoms. For example:

• Receiving and recording enquiries from the public, customers and suppliers and administration
• Recording calls for monitoring, training, complaint, and auditing purposes
• Supplier and subcontractor checks and administration
• Generating records while carrying out our business activities, including notes, meeting minutes and associated documentation, general correspondence
• Organising, planning, and administering events
• Sending customers and stakeholders information about Devonia Media services via email, text, social media, and letter
• Carrying out audits, quality assurance and maintaining databases
• Investigating, monitoring, and reporting issues and reportable events
• Managing complaints and enquiries
• Tendering and procurement processes
• Risk assessment and social value monitoring
• Business continuity and emergency
• Analysing traffic to our website

Filming in Public Areas

Where personally identifiable information is collected in pictures or video filmed in public areas, where no specific permission is needed to record the public, we are happy to remove personally identifiable information upon request, or will do so automatically if we have an indication that it would be in the subject’s interests to do so.
 
Consent: In some situations, we will ask you for your consent to collect and process your personal data, for example:

• When you interact with us via our website and social media, for example Twitter and Facebook
• Through cookies when interacting with our website
• Requests from customers
• Taking images or video footage in non-public areas, such as private properties, businesses or schools
• Recording third party permissions

 
Vital Interests: Occasionally, we may need to process your personal data when it is necessary to protect your life, for example, in an emergency where you cannot give consent.

Who we share your personal data with
In order to provide you with a service and to fulfil our business objectives and obligations, there are many situations where it is necessary to share your personal data with third parties. In such circumstances we will share your data with the following categories of organisations/individuals:

• ICT service providers and software companies, such as Microsoft, Hubspot and hosted and in-house providers and Google

How long will we keep your personal data?
We will keep your personal data for a minimum of 5 years or as long as necessary and for the purpose for which it was collected. When it is no longer necessary to keep your personal data or Devonia Media ceases to exist, we will delete it.

Security and Sharing your personal data outside the 'EEA'
We ensure that appropriate security measures are in place when handling your personal data. Occasionally, we may share your data with third party suppliers outside of the European Economic Area (‘EEA’), for example we use Hubspot which has servers in the USA. In such circumstances, we ensure that your personal data will receive the same protection as if it were being shared within the EEA by ensuring that our contracts contain a requirement for suppliers to adhere to the same strict data privacy requirements as us.

Your data rights
You have the following rights over your personal data:
The right to request:

• Access to your personal data free of charge unless the request is unfounded or excessive.
• Correction of your personal data if it is inaccurate or incomplete
• To have your personal data deleted or removed where there is no good reason for processing to continue
• Processing of your data to be restricted, subject to certain criteria
• Your data is moved, copied or transferred to another platform, subject to certain criteria

If you make such a request, we will respond to it within one month of your request. In some circumstances we may require an extension to this time period and will notify you of the reasons for this. If we refuse your request, we will inform you of the reason(s) and of your right to complain to the Information Commissioner’s Office (see details below) within one month of your request.
 
You also have the following rights:

• To object to us processing your personal data where we have relied upon legitimate interests to process, subject to certain criteria
• Not to be subject to a decision made on the basis of automated profiling, if that decision produces legal or a similarly significant effect on you, subject to certain criteria

The right to withdraw your consent:
Where you have given consent for us to process your personal data, you have the right to withdraw your consent at any time. Please contact us at the email or phone number below. Please note that once processed video material or imagery has been passed onto clients or entered the public domain, its distribution and use may be outside our control.

Direct Marketing
You have the right to object to us processing your personal data for direct marketing purposes. If you would like to stop receiving our marketing communications, please contact us at the email or phone number below.

Checking identity
In order to protect confidentiality, we may ask you to verify your identity before responding to any request made under this privacy notice. If a third party makes a request on your behalf, we require proof that you have given your permission for them to act on your behalf.

Contacting the Information commissioner's office (ICO)
If you are unhappy with the way we have handled your personal data or our response to a request you have made to us, you have the right to complain to the Information Commissioner’s Office:
 
Information Commissioner's Office details:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 1113
casework@ico.org.uk
www.ico.org.uk/concerns

Drone-specific data concerns

Devonia Media follows the informal Code of Practice relating to drones as suggested by the Information Commisioner's Office, and also the relevant sections of the CCTV Code of Practice as it relates to UAS (Unmanned Aerial Surveillance vehicles, or drones.)

2-way communications between our drones and controllers is via encrypted connections. Cards within drones are unable to be encrypted and hence data could be recovered in the event of loss of the drone; this is unavoidable yet improbable, as in the event of loss of a drone, it would likely either be destroyed or recovered immediately.

Once data is removed from drone cards it is stored and backed up on encrypted computer systems, and the data is wiped from cards.

Prior to edited drone footage being made publicly available, sensitive information (such as personally identifiable information) is removed where deemed necessary (see main GDPR statement above for passages relevant to imagery captured in public spaces, and private spaces).

Audio is not captured by our drones.