Privacy Policy & Data Protection Statement
Two Friends Films Ltd
Last Updated: March 2026
Two Friends Films Ltd (“we”, “us”, “our”) is the Data Controller in relation to personal data collected during the production of our films.
We are committed to handling all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy explains how we collect, use, store and protect personal data in connection with our website, contact forms, Care Insight Films, Legacy Films and related projects.
Website Enquiries, Contact Forms and Cookies
When you visit our website, complete a contact form, email us or phone us, we may collect your name, email address, phone number, organisation, role and any information you choose to include in your enquiry.
We use this information to respond to your enquiry, discuss our services, arrange calls or meetings, prepare quotes or proposals, and keep appropriate business records.
Please avoid including detailed medical, care, family or sensitive personal information in an initial website enquiry unless it is necessary. If we need more detailed information later, we will discuss this with you directly and handle it carefully.
Our lawful basis for using enquiry information is usually legitimate interests, contract or steps before a contract, or consent where consent is specifically requested.
Our website is built using Squarespace. Squarespace and any connected services may process limited technical information when you visit the site, such as your IP address, browser type, device information, pages visited and cookie preferences.
We may use website analytics to understand how visitors use the site and to improve our website. Where analytics or other non-essential cookies are used, these should only be set where you have accepted them through our cookie banner.
Essential cookies are used to make the website work properly and keep it secure. Non-essential cookies may be used for analytics or performance purposes, depending on your cookie choices.
We do not sell personal information. We only share personal information where necessary to run our website, respond to enquiries, provide our services, use secure business systems, meet legal or accounting obligations, or work with trusted service providers acting on our behalf.
General website enquiries that do not lead to work are usually kept for up to 24 months, unless we need to keep them for longer for legal, accounting or legitimate business reasons.
1. What Personal Data We Collect
Depending on the nature of the project, we may collect:
Website enquiry information, such as names, email addresses, phone numbers, organisation details and messages sent through our contact form
• Video and audio recordings of participants
• Photographic images
• Names and contact details (where relevant)
• Signed consent forms
• Limited production-related communications
Because filmed content may reveal information about health, age or care needs, this may constitute “special category data” under UK GDPR.
We do not collect more information than is necessary for the purpose of the commissioned project.
2. How We Use Personal Data
We process personal data for the following purposes:
To respond to website, email and telephone enquiries
• To produce commissioned films (Care Story Films and Legacy Films)
• To provide training and enrichment resources within care settings (where agreed)
• For publicity or marketing purposes only where explicit consent has been given
• To manage our contractual and administrative obligations
We do not sell personal data. We only share footage or personal data where necessary to provide our services, run our website and business systems, use secure post-production, storage or delivery platforms, meet legal or accounting obligations, or where explicit consent has been provided.
3. Legal Basis for Processing
We process personal data under the following lawful bases:
Consent (Article 6(1)(a) UK GDPR)
For participation in filmed projects and for any publicity or promotional use.
Legitimate Interests (Article 6(1)(f) UK GDPR)
Where films are commissioned for internal staff training or enrichment purposes within care settings, provided this processing is proportionate and does not override participants’ rights.
Explicit Consent for Special Category Data (Article 9(2)(a) UK GDPR)
Where filmed content may reveal health information, age or other special category data.
Where an individual lacks capacity to consent, we work in accordance with the Mental Capacity Act 2005. Consent will be obtained from an authorised representative or a decision made in the individual’s best interests in consultation with the appropriate decision-maker.
Participation is always voluntary.
Consent may be withdrawn at any time, subject to practical and contractual limitations where material has already been incorporated into training or private films delivered to families.
4. Data Storage & Security
We take appropriate technical and organisational measures to protect personal data.
• Footage and associated data are stored on encrypted devices or secure, encrypted storage systems.
• Access is restricted to authorised personnel involved in production and editing.
• Strong password protection and access controls are applied.
• Footage is not published or shared publicly without explicit consent.
Where third-party service providers (such as secure editing or storage platforms) are used, we ensure appropriate data protection safeguards are in place.
5. Retention and Deletion
We retain personal data only for as long as is necessary for the purpose for which it was
collected.
Legacy Films (Family-Commissions)
For Legacy Films commissioned by families:
• Edited films are delivered to the commissioning family.
• Raw footage (“rushes”) may be provided to the commissioning family on request.
• We typically retain project materials for up to 12 months following delivery to allow for corrections, re-exports or agreed amendments.
After this period, raw footage and associated files will be securely deleted unless otherwise agreed in writing.
Families are responsible for securely storing their own copies once delivery has been completed.
Care Insight Films (Organisational Programmes)
For Care Insight Films commissioned by care homes or organisations:
• Edited films are securely delivered to the commissioning organisation.
• Raw footage and project materials may be retained for up to 24 months, unless otherwise agreed contractually.
Retention allows for reasonable administrative, training or technical requirements.
After the retention period, footage will be securely deleted or anonymised unless continued retention has been formally agreed.
Secure Deletion - where deletion takes place, digital files are permanently removed from active systems and backups in accordance with secure data-handling practices.
6. Participants’ Rights
Under UK GDPR, individuals (or their authorised representatives) have the right to:
• Request access to their personal data
• Request correction of inaccurate information
• Request erasure of data (subject to retention policies and contractual obligations)
• Withdraw consent where consent is the legal basis
• Restrict or object to processing where applicable
• Lodge a complaint with the Information Commissioner’s Office (ICO) ICO website: www.ico.org.uk
We encourage you to contact us first so we can try to resolve any concerns.
7. Data Breaches
In the unlikely event of a personal data breach, we will:
• Assess the risk to individuals
• Take immediate steps to mitigate harm
• Report to the ICO within 72 hours where legally required
• Inform affected individuals where appropriate
8. Contact Details
For all data protection enquiries, including requests relating to personal data, please contact:
Data Protection Lead
Two Friends Films Ltd
Email: esther@twofriendsfilms.co.uk
Telephone: 07738 966264