Privacy Policy & Data Protection
Statement
Two Friends Films Ltd
Last Updated: March 2026
Two Friends Films Ltd (“we”, “us”, “our”) is the Data Controller in relation to personal data collected during the production of our films.
We are committed to handling all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy explains how we collect, use, store and protect personal data in connection with our Care Story Films, Legacy Films and related projects.
1. What Personal Data We Collect
Depending on the nature of the project, we may collect:
• Video and audio recordings of participants
• Photographic images
• Names and contact details (where relevant)
• Signed consent forms
• Limited production-related communications
Because filmed content may reveal information about health, age or care needs, this may constitute “special category data” under UK GDPR.
We do not collect more information than is necessary for the purpose of the commissioned project.
2. How We Use Personal Data
We process personal data for the following purposes:
• To produce commissioned films (Care Story Films and Legacy Films)
• To provide training and enrichment resources within care settings (where agreed)
• For publicity or marketing purposes only where explicit consent has been given
• To manage our contractual and administrative obligations
We do not sell personal data.
We do not share footage or personal data with third parties unless required for secure post-production services or where explicit consent has been provided.
3. Legal Basis for Processing
We process personal data under the following lawful bases:
Consent (Article 6(1)(a) UK GDPR)
For participation in filmed projects and for any publicity or promotional use.
Legitimate Interests (Article 6(1)(f) UK GDPR)
Where films are commissioned for internal staff training or enrichment purposes within care settings, provided this processing is proportionate and does not override participants’ rights.
Explicit Consent for Special Category Data (Article 9(2)(a) UK GDPR)
Where filmed content may reveal health information, age or other special category data.
Where an individual lacks capacity to consent, we work in accordance with the Mental Capacity Act 2005. Consent will be obtained from an authorised representative or a decision made in the individual’s best interests in consultation with the appropriate decision-maker.
Participation is always voluntary.
Consent may be withdrawn at any time, subject to practical and contractual limitations where material has already been incorporated into training or private films delivered to families.
4. Data Storage & Security
We take appropriate technical and organisational measures to protect personal data.
• Footage and associated data are stored on encrypted devices or secure, encrypted storage systems.
• Access is restricted to authorised personnel involved in production and editing.
• Strong password protection and access controls are applied.
• Footage is not published or shared publicly without explicit consent.
Where third-party service providers (such as secure editing or storage platforms) are used, we ensure appropriate data protection safeguards are in place.
5. Retention and Deletion
We retain personal data only for as long as is necessary for the purpose for which it was
collected.
Legacy Films (Family-Commissions)
For Legacy Films commissioned by families:
• Edited films are delivered to the commissioning family.
• Raw footage (“rushes”) may be provided to the commissioning family on request.
• We typically retain project materials for up to 12 months following delivery to allow for corrections, re-exports or agreed amendments.
After this period, raw footage and associated files will be securely deleted unless otherwise agreed in writing.
Families are responsible for securely storing their own copies once delivery has been completed.
Care Story Films (Organisational Programmes)
For Care Story Films commissioned by care homes or organisations:
• Edited films are securely delivered to the commissioning organisation.
• Raw footage and project materials may be retained for up to 24 months, unless otherwise agreed contractually.
Retention allows for reasonable administrative, training or technical requirements.
After the retention period, footage will be securely deleted or anonymised unless continued retention has been formally agreed.
Secure Deletion - ehere deletion takes place, digital files are permanently removed from active systems and backups in accordance with secure data-handling practices.
6. Participants’ Rights
Under UK GDPR, individuals (or their authorised representatives) have the right to:
• Request access to their personal data
• Request correction of inaccurate information
• Request erasure of data (subject to retention policies and contractual obligations)
• Withdraw consent where consent is the legal basis
• Restrict or object to processing where applicable
• Lodge a complaint with the Information Commissioner’s Office (ICO) ICO website: www.ico.org.uk
We encourage you to contact us first so we can try to resolve any concerns.
7. Data Breaches
In the unlikely event of a personal data breach, we will:
• Assess the risk to individuals
• Take immediate steps to mitigate harm
• Report to the ICO within 72 hours where legally required
• Inform affected individuals where appropriate
8. Contact Details
For all data protection enquiries, including requests relating to personal data, please contact:
Data Protection Lead
Two Friends Films Ltd
Email: esther@twofriendsfilms.co.uk
Telephone: 07738 966264