Studio Visitor Privacy Notice

Thank you for visiting the Studios. This notice explains how we collect, use and protect your personal data in accordance with applicable data protection laws when you visit our sites.

For further information or to exercise your data protection rights, please email dataprotection@pinewoodgroup.com, use the ‘Contact Us’ page on our website or write to the Group Legal Department at our registered office address.

Introduction

When we say we, our, us, or the Group in this notice, we are referring to Pinewood Group Limited (PGL) and its subsidiaries, including Pinewood Studios Limited (PSL), Pinewood PSB Limited (PSB) and Shepperton Studios Limited (SSL), all of whom are ‘controllers’ of your personal data for the purposes of the Data Protection Act 2018 (DPA), the retained European Union law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), the Data (Use and Access) Act 2025 (DUA), and other applicable data protection and privacy laws as may be updated or replaced from time to time (together the Data Laws). PSL (company number 0392619) is the owner of Pinewood Studios and is registered with the Information Commissioner’s Office (ICO) under registration number Z5350189. PSB (company number 06300755) is registered with the ICO under registration number ZB542218. SSL (company number 02974333) is the owner of Shepperton Studios and is registered with the ICO under registration Z730567X. The registered office of PGL, PSL, PSB and SSL is Pinewood Studios, Pinewood Road, Iver, Buckinghamshire, SL0 0NH.

Personal Data We May Collect About You

We collect and process the following categories of personal data from you directly, before and during your visit to our sites, in accordance with the Data Laws:

• your name and contact details (such as email address, and telephone number);
• your organisation, job title, and professional contact information;
• your photograph for the purpose of creating your security ID pass (if applicable);
• car details (such as make, model, and registration number);
• personal data you provide as part of our feedback surveys or when you sign up to news alerts; and
• when you register at reception, we will ask to see your photographic ID, but we will not take or store any copy of it.

We also collect the following categories of personal data indirectly:

• information about your movements on site, which is tracked when you use your security ID pass around the sites;
• images of you collected through CCTV and other information obtained through electronic means such as security access fobs, card records, and footage from security body-worn cameras;
• information about you provided by your employer if they are a client, tenant, or contractor of the Group and require you to have access to our sites; and
• we may also notify you in other ways from time to time about the processing of your personal data, as required by law.

Uses Made of the Personal Data and Legal Basis

We use this information for the following purposes: relying on our legitimate interests in ensuring the operation and security of our premises and property, safeguarding the interests of third-party businesses based at our sites, and for enforcing and protecting the rights of our Group, at all times in accordance with applicable Data Laws:

• to log you into our visitor check-in system;
• to produce and manage security access passes;
• to produce confidentiality agreements, which we may ask you to sign;
• to make contact with you whilst you are on-site, including emergency notifications; and
• to send you studio notices and site information via electronic means, including email or SMS.

In addition to the normal ways we use your data as part of the operation of our sites, we may use electronic means (such as email or SMS) to contact you to request feedback on your experience of working at and visiting our studios. Participation in feedback surveys is entirely voluntary and responses can be given anonymously. If you do not wish to receive invitations to complete feedback surveys, you can opt out by clicking the ‘unsubscribe’ link provided or by emailing dataprotection@pinewoodgroup.com. Where we anonymise your data in respect of feedback surveys, it will no longer be considered personal data under applicable Data Laws.

We also process email communication traffic data in our legitimate interests for business relationship evaluation, business development and analytics purposes (namely, the “date”, “messageID”, “to”, “from” and “cc” fields of emails sent and received by us, but not the content of any emails or email calendar invitations). The system may process emails sent between you and our staff in connection with your visit or other business purposes.

Less commonly, we may need to process your personal data in emergency situations when it is in your vital interests or those of another person.

The Data Laws require specific conditions to be met to ensure that the processing of your personal data is lawful. The legal basis we rely on will be determined by the specific purposes and context of the processing. In most cases, the relevant conditions are pursuant to Article 6(1)(f) UK GDPR – Legitimate Interests – where the processing is necessary for our legitimate interests as data controller in maintaining the workplace and managing business continuity. Where other legal bases apply, we will inform you as required by law.

Disclosure of Your Information

We may disclose your personal data to any member of our Group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the Companies Act 2006 where necessary for our legitimate interests in administrative purposes.

We will also share your personal data with sub-contractors and suppliers where necessary – for example, providers of our visitor check in and access control systems, security, cleaning and catering contractors, the operator of our mail room delivery tracking app and our data analytics provider. We have contracts with these third parties requiring them to keep your personal data secure and to process it only in accordance with our instructions and applicable Data Laws. We may also (where applicable) share your personal data with your employer if they are a client, tenant or contractor to the Group.

For security reasons and in our legitimate interests and those of relevant third parties, if you attempt to access restricted areas, we may need to inform the third parties occupying those areas.

Rarely, we may need to disclose your personal data to third parties where necessary for the legitimate interests of business (for example, if we were selling our business or in connection with legal proceedings), to comply with legal obligations or for the purposes of preventing crime and other unlawful acts.

Overseas Transfers

We may need to transfer your information outside the UK to service providers, agents, subcontractors and regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the UK or the European Economic Area (EEA), such as the United States of America (US). In particular, email communication traffic data may be processed by our data analytics provider in the US. Where we do so, we will ensure appropriate safeguards are in place as required by applicable law.

We will take all steps reasonably necessary to ensure that your personal data is handled securely, in accordance with this notice and applicable data protection legislation, and that adequate safeguards are in place. This may include using the UK’s International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs), or other mechanisms approved by the ICO for transferring personal data outside of the UK, including to the EU and US following current guidance provided by the ICO. If you would like further information, please contact dataprotection@pinewoodgroup.com.

How We Will Keep Your Information Secure

We will take all steps reasonably necessary to ensure that your personal data is handled securely and in accordance with this notice and the Data Laws. We have produced clear instructions and developed clear reporting lines in relation to the processing of personal data. Please see the Group’s Privacy Policy at https://pinewoodgroup.com/legal for additional information.

Your Rights

In addition to the right to be informed about how we use your personal data (as set out in this notice), you have various other rights in respect of the personal data we hold about you. These include the right to object to how we use your personal data, the right to access the personal data we hold about you, the right to correct inaccuracies, the right to request deletion or restriction of your personal data, and the right to request that some of your personal data be provided to someone else. To make enquiries or for further information about exercising any of your rights, please see the Group’s Privacy Policy at https://pinewoodgroup.com/legal or contact dataprotection@pinewoodgroup.com.

You can make a complaint to us by emailing dataprotection@pinewoodgroup.com, using the Contact Us form on our Group Website at https://pinewoodgroup.com/contact/, or by contacting the data protection supervisory authority – in the UK, this is the ICO, at https://ico.org.uk/.

We will comply with all legal requirements in relation to complaints, including those under the DUA and any subsequent amendments. We will endeavour to provide you with an acknowledgement within 30 days of receiving your complaint and to investigate the complaint without undue delay. We may need to contact you to request additional information, keep you updated on progress, and provide information relating to the outcome. If you are unhappy with the outcome, you can raise your complaint with the ICO.

How Long We Store Your Personal Data

In general, we hold your information for the later of (i) one year after it was collected; or (ii) 12 months after your last visit, unless we need to keep it longer in order to deal with any ongoing action, legal requirement, or complaints, in accordance with applicable Data Laws.

We will hold confidentiality forms signed by you for 6 years, or as otherwise required by law.

Data from CCTV cameras and other footage will not be retained indefinitely but will be permanently deleted once there is no reason to retain the recorded information. The retention period for CCTV images will vary according to the purpose for which they are being recorded. Fo bnbr example, where images are being recorded for crime prevention purposes, data will be kept only as long as necessary for incidents to come to light. In all other cases, recorded images will be kept for no longer than 30 days, unless required by law or for ongoing investigations.

Changes to this Notice

This notice will be reviewed periodically and updated if we make any material changes to the manner in which we process and use your personal data, or as required by law. If we make material changes, we will contact you to let you know about the change.

Next Review Date: October 2027.

For further information about how we process personal data as a business, please see our Privacy Policy available at https://pinewoodgroup.com/legal/privacy-policy.