1. Who we are

Niltoni Studios Ltd is the data controller for the personal data described in this policy.

**Niltoni Studios Ltd**

Registered in England and Wales, company number 15030310

Registered office: 20 Wenlock Road, London, N1 7GU

Studio and operational address: Niltoni Studios, 5 Carliol Square, Newcastle upon Tyne, NE1 6UF

Email: filipe@niltoni.com

Telephone: 0191 468 2946

ICO registration number: **ZB734651**

Niltoni Studios Ltd is part of the Niltoni group of companies. Where a booking is contracted through Niltoni Creative Ltd (company number 14981594), that company is the controller for the personal data it collects in connection with that engagement, and it applies this policy.

This policy explains what personal data we collect, why we collect it, what we do with it, how long we keep it, and what rights you have. It applies to visitors to www.NiltoniStudios.com, to clients and enquirers, to people who attend the Studio, and to newsletter subscribers.

2. The personal data we collect

**If you enquire or make a booking**, we collect your name, email address, telephone number, business or trading name where applicable, billing address, the details of your booking, your correspondence with us, and your payment records. Where you tell us about specific requirements — access needs, the nature of your shoot, who will attend — we collect that too.

**If you subscribe to our newsletter**, we collect your email address and the record of your consent.

**If you visit the Website**, we collect technical data including your IP address, browser type, device information, the pages you view and how you reached the site. See section 8 on cookies.

**If you visit the Studio**, you may be recorded on CCTV covering the entrance and common parts of the building. We do not operate CCTV within the Studio itself. Where the building's system is operated by the building's management rather than by us, they are the controller of that footage and their own notices apply.

**If you contact us**, we keep a record of the correspondence.

We do not deliberately collect special category data. Where you volunteer health or accessibility information so that we can accommodate you, we use it only for that purpose and delete it once the booking is complete.

3. Why we use it, and our lawful basis

Take and manage bookings, issue confirmations and invoices, take payment
Why: To provide the studio hire you have asked for
Lawful basis: Performance of a contract, or steps taken at your request before entering one

​

Respond to enquiries
Why: To answer you
Lawful basis: Legitimate interests – responding to people who contact us

​

Keep accounting and tax records
Why: Because we must
Lawful basis: Legal obligation

​

Verify age and identity where required under our terms
Why: To meet our safeguarding and legal responsibilities
Lawful basis: Legal obligation, and legitimate interests in the safe operation of the Studio

​

Review CCTV footage of the building's common parts, where we hold or are given access to it
Why: Security of the premises, our equipment and the people in it
Lawful basis: Legitimate interests

​

Send our newsletter
Why: To keep you informed about the Studio
Lawful basis: Consent

​

Send occasional service emails to past clients about availability and rates
Why: Legitimate interests – marketing to existing customers about similar services, with an opt-out in every message
Lawful basis: Legitimate interests

​

Website analytics
Why: To understand how the site is used and improve it
Lawful basis: Consent, via our cookie banner

​

Establish, exercise or defend legal claims
Why: To protect our position
Lawful basis: Legitimate interests

​

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and we have concluded that they are not. You may object at any time — see section 7.

4. Who we share it with

We share personal data only where necessary, and only with:

- **our website and email platform providers**, who host the Website and process form submissions and mailing lists on our behalf;

- **our bank and payment providers**, to receive and reconcile payment;

- **our accountants and bookkeepers**, to maintain our financial records;

- **other companies in the Niltoni group**, where they are involved in delivering your booking or in providing shared administrative support;

- **our professional advisers and insurers**, where we need advice or need to notify a claim;

- **the police or other authorities**, where we are required to disclose information by law or where disclosure is necessary to prevent or investigate crime.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Our website is built on the Wix platform and our newsletter is operated through it. Wix acts as our processor and may transfer data outside the United Kingdom. Where personal data is transferred outside the UK, it is protected by an adequacy decision or by the International Data Transfer Agreement or Addendum approved by the UK government.

5. How long we keep it

Enquiries that do not become bookings
Retention: 12 months from last contact

​

Booking records and correspondence
Retention: 6 years from the end of the booking, to cover the limitation period for contract claims

​

Accounting and tax records
Retention: 6 years from the end of the accounting period, as required by the Companies Act 2006 and HMRC

​

Newsletter subscriptions
Retention: Until you unsubscribe, and then a suppression record indefinitely so that we do not contact you again

​

CCTV footage, where we hold it
Retention: 30 days, unless retained for a specific incident or investigation

​

Website analytics
Retention: As set out in our cookie banner

​

We delete or anonymise personal data once these periods expire.

6. How we protect it

We keep personal data on password-protected systems with access limited to those who need it. Our platform providers apply encryption in transit and at rest. Paper records, where they exist, are kept securely at the Studio. No system is completely secure, but we take reasonable and proportionate measures given the nature of the data we hold.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and, where the risk is high, tell you directly.

7. Your rights

Under the UK GDPR you have the right to:

- **be told** what we do with your data — this policy;

- **access** the personal data we hold about you;

- **have inaccurate data corrected**;

- **have data erased**, where we no longer have a good reason to keep it;

- **restrict** how we use it while a query is resolved;

- **object** to processing based on legitimate interests, and to direct marketing at any time and without exception;

- **portability** — receive data you gave us in a machine-readable form;

- **withdraw consent** at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email **filipe@niltoni.com**. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.

To unsubscribe from our newsletter, use the unsubscribe link in any message or email us.

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at **ico.org.uk/make-a-complaint**, by telephone on **0303 123 1113**, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

8. Cookies

Our Website uses cookies and similar technologies.

- **Strictly necessary cookies** make the site work — page navigation, form submission, security. These do not require consent.

- **Analytics cookies** tell us how the site is used. We set these only with your consent.

- **Marketing cookies**, where used, support advertising and social media features. We set these only with your consent.

You can change or withdraw your cookie preferences at any time using the cookie settings on the Website, and you can block or delete cookies through your browser settings, though parts of the site may then not work properly.

9. Photography, film and models

If you hire the Studio, **you** are the controller of any personal data you collect there, including images of identifiable people, model releases and crew details. You are responsible for your own compliance with data protection law in respect of that material. We are not a joint controller of it and we do not process it on your behalf.

We may photograph or film the Studio for our own marketing, but we will not publish any image that identifies you, your crew, your models, your set or your work without your prior written consent, and we will stop if you ask us to.

10. Children

Our services are directed at adults. We do not knowingly collect personal data from anyone under 18 through the Website. Where a person under 18 attends the Studio, we deal with their parent, guardian or the responsible adult accompanying them, and we collect only what we need for safety and safeguarding purposes.

11. Changes to this policy

We may update this policy. The current version is always published at www.niltonistudios.com/privacy, with the date it took effect. Where changes are significant, we will tell subscribers and current clients directly.

---

**Niltoni Studios Ltd**, Niltoni Studios, 5 Carliol Square, Newcastle upon Tyne, NE1 6UF

filipe@niltoni.com · 0191 468 2946