GDPR Privacy Notice - May 2023

The Forest TV Productions Ltd (also trading as The Forest and Wooden Post) (“we”, “our”) are committed to both protecting and respecting your privacy. This policy sets out the types of data we collect and/or process about you, and the lawful basis that permits this.

Your rights and our obligations to you, regarding the processing of your personal data, can be found at: www.knowyourprivacyrights.org

We do not collect personal information or statistical data from website visitors. Our website may contain links to affiliates - please note these websites have their own privacy policies, for which we take no responsibility.

The personal data we do collect from contractors and clients are:

• Personal details - such as name, billing address, and delivery address
• Records of correspondence
• Contact details such as telephone number
• Bank account details

(We do not collect special category data)

This personal data will be used for the following purposes:

• To administer the booking process
• To contact you regarding any matter arising from your booking, be that over the telephone, Slack, Zoom, Meets, or email
• To provide deliverables
• To process the payment fee
• To keep a record of the booking

Only employees responsible for recruitment or administration of payment have access to your data - if it is relevant to their function.

We will not disclose your personal information to any third parties, except Venthams (Red Lion Square, London) our accountants, who have implemented appropriate technical and organisational measures to ensure the security of your data.

Processing by Microsoft Inc., Google LLC., DropBox Inc., MASV Inc., WeTransfer Inc. and Zoom Video Communications Inc. will involve the transfer of data to destinations outside the European Economic Area (“EEA”). This is done under standard contractual clauses.

Your data will be retained for up to six years within our IT systems. We will use strict procedures and security features - such as storing your data in an encrypted format on digitally and physically secure servers - to try to prevent unauthorised access. But we cannot guarantee the security of your data; any transmission is at your own risk.

CCTV is only operational when no one is expected to be on site, to detect criminal movement. Only the company director can view the footage, which is stored on an encrypted server until its automatic deletion within seventy two hours - unless an incident requires legal resolution.

In the context of supplied media, the client represents and warrants that they have obtained all necessary consents and complied with all legal and contractual obligations in respect to filming or recording contributors, or licensing audio or visual media. Any release forms will be in the name of the client, or commissioner. We agree to only use this media in accordance with the instructions of the client, and will endeavour to keep such data safe and secure - such as storing this data on offline, physically secure servers. Some footage is featured with permission in our banner showreel, but all rights remain with the original producers. Exports and relevant media are additionally stored for up to six years on the password protected service ‘ScreenLight’. Red Couch Industries Inc. (also outside the “EEA”) own and operate this web based video post production collaboration and sharing service, using third party vendors and hosting partners to provide the necessary hardware, software, networking, storage, and other technology required to run the service. Again, though we implement reasonable precautions and security measures, we cannot guarantee the security of your data; any transmission is at your own risk.

The lawful basis for processing your data is therefore either contractual, or in order to comply with a legal requirement, in the pursuit of our legitimate interests.

In accordance with GDPR principles:

• Processing is fair, lawful and transparent
• Data is collected for specific, explicit, and legitimate purposes
• Data collected is adequate, relevant, and limited to what is necessary
• Data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
• Data is not kept for longer than is necessary for its given purpose
• Data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures

At any point while we are in possession of or processing your personal data, you - the data subject - have the following rights:

• Right to Withdraw Consent
• Right of Access (to request a copy of the information we hold about you. This may be subject to a fee of £35.00 to meet our costs in providing this)
• Right of Rectification (to correct inaccurate or incomplete data)
• Right to be Forgotten (in certain circumstances, you can ask for the data we hold about you to be erased from our records)
• Right to Restriction of Processing (where certain conditions apply to have a right to restrict the processing)
• Right to Data Portability

We advise that you check this page regularly to keep up to date with any necessary changes.

Questions, concerns, or requests about this policy should be emailed to the Data Protection Compliance Officer: ask@theforest.tv. You also have the right to lodge a complaint directly with the supervisory authority, the ICO: https://ico.org.uk/concerns/