Privacy Policy

Pinewood Group Privacy Policy

1. Introduction

1.1. Pinewood Group is committed to protecting and respecting your privacy. This privacy policy (together with our Website Terms of Use, Cookies Policy and published privacy notices) (Privacy Policy) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us including when you use http://www.pinewoodgroup.com and any sub-domains (Website). Please read the following carefully to understand our views and practices regarding your personal data and how, why and when we will process it.

1.2. When we say we, our, us, or the Group in this policy, we primarily refer to our UK and EU-based business and companies, including Pinewood Group Limited (PGL) and its subsidiaries, including Pinewood Studios Limited (PSL), Pinewood PSB Limited (PSB) and Shepperton Studios Limited (SSL), all of whom are “controllers” of your personal data for the purposes of the Data Protection Act 2018 (Act) and the EU General Data Protection Regulation 2016/679 as retained in UK law by the European Union (Withdrawal) Act 2018 (UK GDPR) (the Act and UK GDPR together the Data Protection Legislation). PGL (company number 03889552) is registered with the Information Commissioner’s Office, or ICO, under registration number Z1411806. PSL (company number 0392619) is registered with the ICO under registration number Z5350189. PSB (company number 06300755) is registered with the ICO under registration number ZB542218. SSL (company number 02974333) is registered with the ICO under registration Z730567X. The registered office of PGL, PSL, PSB and SSL is Pinewood Studios, Pinewood Road, Iver, Buckinghamshire, SL0 0NH. Other arrangements and policies apply in relation to our international studios, subsidiaries and staff, including without limitation Pinewood Toronto Studios, which operate in accordance with applicable local law and regulations on data protection and privacy.

1.3. Our Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for such websites or policies. Please check these policies before you submit any personal data to these websites. This policy should also be read together with any privacy notice or policy that we may provide or publish on specific occasions when we are collecting or processing personal data. This policy supplements other privacy notices and policies and is not intended to override them.

1.4. We keep this policy under regular review. This policy was last updated in September 2024. Next review date: September 2025.

2. Personal Data We May Collect About You

2.1. We may collect and process the following personal data from you:

• information that you provide by filling in forms on our Website, for example, your name, and contact details. This includes information provided at the time of registering to use our Website, subscribing to news and updates, posting material or requesting products and services (including stages and facilities);
• if you sign up to newsletters or to join our audiences (for example, Pinewood Audience Club), we will ask for your name, contact details and interests and, in some cases, your
  Pinewood Group Privacy Policy (September 2024) Page 2 of 7
  age, gender, address, availability and preferred mode of transport;
• if you register your interest in becoming a supplier, we will ask you to complete a Supplier Pre-Qualification Form which asks for your name, contact details and certain information about your business;
• if you register your interest in job opportunities and job alerts (including apprenticeship opportunities) we will ask you to provide your name, contact details and, in some cases, your age, gender, address and availability;
• if you register to become an On the Lot tenant, we may ask you to provide your name and contact details and certain information about your business;
• if you register to receive press releases or news updates, we will ask you to provide your name, job title and organisation and email address;
• if you contact us, we may keep a record of that correspondence;
• details of transactions (for goods, services or information) you carry out through our Website and the fulfilment of your orders, or including payment card details;
• details of your visits to our Website including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access;
• we may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them;
• we may receive information about you from your employer if they are a client/customer, tenant or contractor of or to the Group;
• we may also ask you for information when you report a problem with our Website; and
• we also anonymise, collect, use and share aggregated data for statistical and research purposes where it does not identify you.
  It is important that the personal data we hold about you is accurate and current. Keep us informed if your personal data changes during your relationship with us.

3. Uses Made of the Personal Data and Legal Basis

3.1. We use personal data held about you for the following purposes in line with our legitimate interests to administer the Website, to interact with users when they request our products and services, or offer to provide us with products and services and to run our business:

•  to provide you with products and services (including stages and facilities) that you request from us, or information about them where you have asked to be contacted for such purposes;
• if you sign up to join our cinema or TV audience clubs, to send you tailored information and offers and to contact you in relation to any bookings – in particular, we ask for your age range as some shows have age restrictions;
• where you have registered your interest for job opportunities or in becoming a supplier, to assess your application and consider your suitability, to contact you in relation to your enquiry and to add you to our databases so we can contact you about potential auditions and jobs that may be of interest;
• if you have registered to become to an On the Lot tenant, to contact you for those purposes and to administer On the Lot;
• to ensure that content from our Website is presented in the most effective manner for you and for your computer;
• to allow you to participate in interactive features of our service, when you choose to do so;
• to notify you about changes to our service;
• for business relationship evaluation, business development and analytics purposes;
• to send out key and important studio notices (such as emergencies on site) via electronic means (email or SMS); and
• in certain circumstances, to contact you with information about goods and services which we feel may interest you by post, telephone or other electronic means (e-mail or SMS) (see the section on ‘Marketing’ below for further information).

3.2. We will also use certain personal data, for example, your name and contact details, where necessary to carry out our obligations arising from any contracts entered into between you and us including, but not limited to, ensuring the security of the premises of our studios where you access any of our premises. If you fail to provide information which we require for the contract with you, we may not be able to perform that contract.

4. IP Addresses and Cookies

4.1. When you access our Website, we may collect information about your computer including, where available, your IP address, operating system and browser type for system administration and to report aggregate information to our advertisers. This is statistical data about our Website users’ browsing actions and patterns and does not identify any individual.

4.2. For the same reason, we may obtain information about your general internet usage by using a cookie file which is stored on the hard drive of your computer. Cookies are small text files which contain information that is transferred to your computer’s hard drive. They help us to improve our Website and to deliver a better and more personalised service. They enable us to:

• estimate our audience size and Website usage patterns;
• store information about your preferences and so allow us to customise our Website according to your individual interests;
• speed up your searches; and
• recognise you when you return to our Website.

4.3. You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser setting so that it will refuse cookies, we will assume you consent to our use of cookies and other similar technologies (where consent is required) as set out in this Privacy Policy, and our system will issue cookies when you log on to our Website. Please refer to our Cookie Policy, available on our Website, for further details.

5. Marketing

5.1. We would like to provide you with information about goods and services which may be of interest to you and may contact you about these by post, telephone or other electronic means (e-mail or SMS).

5.2. If you are a corporate user, we will send marketing communications to your company e-mail address unless you have opted out. We will give you the opportunity to opt out of receiving marketing communications from us when we first contact you. Also, you can change your marketing preferences at any time by clicking on the “unsubscribe” link in any of our marketing communications or by contacting us at dataprotection@pinewoodgroup.com.

5.3.For non-corporate users, we will only send marketing communications to your personal e-mail address or SMS messages if those communications relate to goods, services or opportunities which are similar to services we have already provided to you in the past or which you have expressed an interest in, or if you have consented to us contacting you in this way.

5.4. You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your personal data) if we intend to use your personal data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your personal data. You can also exercise the right at any time by clicking on the “unsubscribe” link in any of our marketing communications or by contacting us at dataprotection@pinewoodgroup.com.

6. Where We Store Your Personal Data

6.1. All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

6.2. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

7. Disclosure of Your Information
7.1. We may disclose your personal data to any member of our Group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the Companies Act 2006 where necessary for administrative purposes. In particular, if you request services from another Group company, we may need to pass your contact details on to that Group company.

7.2. We also share your personal data with the following, who act as our processors:

• our website hosting and maintenance provider;
• service providers who provide IT, software and system administration services;
• fulfilment service providers, for example e-mail marketing platforms, event invitation service providers, payment processor and data analytics provider;
• our third party catering supplier where you sign up for their application and/or any loyalty scheme;
• our third party security supplier where you require access to Group premises or studio; and
• the third party supplier of our mail room delivery tracking application.

We have contracts with these parties which require them to keep your personal data secure.

7.3. Occasionally, we may need to disclose your personal data to third parties where necessary for the legitimate interests of business or in order to comply with legal obligations:

• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
  Pinewood Group Privacy Policy (September 2024) Page 5 of 7
• if PGL or substantially all of its assets is acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets; or
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, enforce or apply our Website terms of use or other agreements, or to protect the rights, property or safety of the Group, our customers or others.

7.4. We also process email communication traffic data in our legitimate interests for business relationship evaluation, business development and analytics purposes (namely, the “date”, “messageID”, “to”, “from” and “cc” fields of emails sent and received by us, but not the content of any emails or email calendar invitations). The system may pick up emails sent between you and our staff through the Website or otherwise for business purposes. The data is processed by a third party analytics company which provides the service.

7.5. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregated information about our Website users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregated information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to target a particular audience.

8. Overseas Transfers
8.1. The personal data we collect from you may be transferred to, and stored at, a destination outside the UK.

8.2. We have studios, business and arrangements based outside of the UK, including studios Canada and the Dominican Republic and subsidiaries in the United States of America (US). If you request services or sign up to events with any of those studios, then this may involve the transfer your personal data outside the UK. Also, some of the suppliers engaged in, among other things, the fulfilment of your order, the processing of your payment details, data analytics and the provision of support services (mentioned above) are based outside the UK,.

8.3. We will take all steps reasonably necessary to ensure that your personal data is handled securely and in accordance with this Privacy Policy and the Data Protection Legislation. These include transferring your personal data to countries that have been deemed to provide an adequate level of protection for personal data, such as using the UK’s model International Data Transfer Agreement (IDTA) which came into force in March 2022 for organisations transferring personal data outside of the UK, including to the EU and following guidance provided by the ICO, and/or complying with current law on the transfer of personal data to the US in line with the “EU-US Data Privacy Framework” and any UK extension thereto as relevant. When we use certain international service providers, we may use specific contracts approved for use which give personal data the same protection it has in the UK. If you would like further information, please contact dataprotection@pinewoodgroup.com.

8.4. Pinewood’s overseas subsidiaries and internationally based staff are subject to the requirements and safeguards prescribed by the relevant local law. This includes Pinewood’s Canadian subsidiaries responsible for Pinewood Toronto Studios. Staff at our international studios must comply with local policies relating to data privacy in their jurisdiction. The Group Legal Department review and approve all local privacy policies and derivations from this policy. Ultimate responsibility for all Group compliance with data protection and privacy law, including Group policies relating to data protection compliance, sits with the Pinewood Group Board.

9. Security and retention of personal data
9.1. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

9.2.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Please in particular see our Data Protection Policy and Privacy Notices available on the Website. If you would like further information, please contact dataprotection@pinewoodgroup.com.

10. Your Rights

10.1. In addition to the right to be informed about how we use your personal data (as set out in this Privacy Policy), you have various other rights in respect of the personal data we hold about you – these are set out in more detail below. If you wish to exercise any of these rights, please contact dataprotection@pinewoodgroup.com:

• Right to object: You can object to our processing of your personal data. Please contact us as noted above, providing details of your objection.
• Access to your personal data: You can request access to a copy of your personal data that we hold, along with information on what personal data we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision-making.
• Right to withdraw consent: If you have given us your consent to use your personal data – for example, to send you marketing e-mails – you can withdraw your consent at any time by clicking the “unsubscribe” link in any marketing e-mail which you receive or by contacting us as at the e-mail address noted above.
• Rectification: You can ask us to change or complete any inaccurate or incomplete personal data held about you.
• Erasure: You can ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.
• Portability: You can ask us to provide you or a third party with some of the personal data that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.
• Restriction: You can ask us to restrict the personal data we use about you in certain circumstances, for example, where you have asked for it to be erased or where you have objected to our use of it.
• Automated decision-making: Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. You have the right not to be subject to solely automated decisions that will create legal effects or have a similar significant impact on you, unless you have given us your consent, it is necessary for a contract between you and us or is otherwise permitted by law. You also have certain rights to challenge decisions made about you. We do not currently carry out any solely automated decision-making.
• Make a complaint: You can make a complaint about how we have used your personal data to us by contacting us as noted above, or to a supervisory authority – for the UK this is the Information Commissioner’s Office, or ICO, at https://ico.org.uk/.

10.2. Please note, some of these rights only apply in certain circumstances and we may not be able to fulfil every request. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.

11. How Long We Store Your Personal Data
11.1. We will not retain your personal data for any longer than is necessary for our purposes, including for the purposes of satisfying any legal, accounting or reporting requirements, and reference is made to our Group Data Retention Policy which applies to the retention of any personal data processed by the Group.

11.2. In general, we hold your information for 6 years after your last contact in case of complaints or legal claims.

11.3. Where we have been using your personal data to provide you with marketing, we will retain this information for 3 years. We will remove you from our marketing list if you ask us to do so. However, we may still need to keep some of your information for ongoing contractual purposes, if you continue to use our services or for legal, accounting and regulatory reporting reasons.

12. Changes to Our Privacy Policy 

This Privacy Policy will be reviewed periodically and we will update it if we make any material changes to the manner in which we process and use your personal data and updated versions will the published on our Website.

13. Contact

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to dataprotection@pinewoodgroup.com.