Privacy notice

Review draft — 2 October 2026. Not yet the operative notice. The controller, privacy contact, delivery provider and retention periods are owner-approved; the landlord’s CCTV notice, supplier arrangements and actual operational controls still require checks. Do not treat a written procedure as evidence that deletion or supplier checks have occurred.

Who is responsible

NORTH DEAN TRADING LTD, trading as North Dean Mill Studios, is responsible for the studio's booking, enquiry and operational personal information. Company number 15054395. Registered office: 128 City Road, London, United Kingdom, EC1V 2NX.

Contact hello@ndms.uk or write to North Dean Mill Studios, North Dean Mill, Stainland Road, Greetland, Halifax, HX4 8LS. Imran handles privacy requests. This contact role does not imply a formally appointed data protection officer. No ICO registration number is claimed unless confirmed.

Information we use

Depending on how you interact with us, we may use:

• Contact and booking information: name, email, telephone number, company where supplied, selected service/set/pod, session date/time, attendee count, project description and requirements.
• Enquiry and correspondence information, including messages you send and our replies.
• Talent & Crew applications: professional name, roles, biography, general region, skills, experience, credits, equipment, availability, travel preference and optional public professional links. We keep the response email, 18-or-over confirmation, publication permission and moderation history private. Approved images and portfolio material can be added after review. We do not request a home address, telephone number or date of birth for directory profiles.
• Contract and transaction information: the approved quote, package/inclusions, booking status, payment references, amounts, balances, refunds and related audit records. Stripe receives payment details through its checkout; we do not store full card numbers or card security codes in the website database.
• Technical/security information needed to operate and protect the site, such as server request logs and authentication records; browser cookie choices where used.
• Recordings, images, voices, supplied production assets and delivery details where you purchase production/editing services. The booking database is not described as a media archive.
• Script Library submissions: professional writer name, title, format, genre, logline, synopsis and an optional public text extract. The response email, adult/rights/publication confirmations, staff review notes and optional full PDF manuscript remain private. Full manuscripts are encrypted in private submission storage and are not public website assets.
• Limited accessibility or other sensitive information you voluntarily ask us to consider. Please tell us only what is needed for an adjustment, rather than unnecessary medical detail. We will explain the relevant purpose, access and additional legal condition before collecting sensitive information where required.

We normally receive information from you, the person organising your booking or your interactions with our services. If an organiser supplies other participants' details, they should make this notice available and share only what is needed. We will provide any additional information required when we receive data indirectly.

Why we use it

Necessary booking/transaction messages are operational, not permission to send promotional newsletters. If optional marketing is introduced, we will explain it separately and provide a straightforward way to stop it. No marketing list is implied by submitting an enquiry.

Talent & Crew directory

The directory is a community platform, not a talent agency. Creating a basic profile is free. Profiles require human approval before becoming visible; an application does not guarantee publication, work, employment, representation or endorsement. Initial applications are limited to adults aged 18 or over, without collecting a date of birth.

Published professional details, approved images and links can be viewed by website visitors and may be indexed or copied when the public website launches. The applicant’s response email, account information, age confirmation and moderation records are not public. Never put personal contact details or a home address in your biography, credits or images. Contact initially goes through North Dean at hello@ndms.uk. We do not automatically disclose a member’s private email to an enquirer. An introduction requires an appropriate check with the member first.

Professional showreels and social websites are external links, not automatically loaded video embeds. Their providers process information under their own notices if you follow a link. We record the wording/version and time of publication permission. Ask to correct, unpublish or remove your profile, or raise a concern, through hello@ndms.uk. Directory permission does not authorise promotional emails or use of your footage for marketing.

Current review stage: website profile submissions remain closed. New retention and moderation procedures must be operationally checked before opening them.

Script Library

Writers can request a free, moderated listing containing a synopsis and optional extract. We use private submission details to review the request, correspond with the writer and manage safety/rights concerns. Publication of the professional listing and chosen extract is based on the writer’s specific permission. We record that permission separately from any future agreement to share the full script.

The writer retains their rights. The optional full manuscript is restricted to authorised staff, is not publicly downloadable and is never automatically forwarded to interested readers. Requests go through hello@ndms.uk; obtain the writer’s separate agreement before sharing their full script or private contact details. Publishing a synopsis or extract does not authorise adaptation, production or marketing use. Public text may be indexed or copied after public launch. Staff downloads create separate working copies that must be protected and deleted appropriately.

Script submission is initially adult-only (18+ confirmation, no date of birth). Do not include other people’s unnecessary private information, confidential material or content you lack permission to share. Ask to correct or remove a listing, withdraw publication permission or report a concern through hello@ndms.uk. Submissions remain closed during the current review stage.

Before opening submissions: finalise manuscript retention and verify actual moderation, removal, download/storage and supplier controls. No automatic deletion or automatic full-script delivery is claimed.

Who receives information

Authorised studio staff receive the information needed to manage the booking or production. We use service providers for website hosting, booking storage/authentication, payment processing and messages:

• Fasthosts for the website VPS and business email services.
• Supabase for the booking database and staff authentication; the configured database project is in London.
• Stripe for payment processing and related fraud/payment administration; Stripe may also act as a controller for its own regulated/compliance purposes, as its privacy information explains.
• Resend for transactional emails and delivery records.
• Cloudflare Turnstile protects enquiry forms from automated abuse. Cloudflare processes security signals such as IP address, browser information and the website origin to distinguish visitors from bots. We send the verification token to Cloudflare for validation; enquiry messages are stored by NDMS rather than sent as part of this check. See Cloudflare’s Turnstile privacy information.
• Google Drive is the owner-selected provider for private customer recording storage and delivery, with separate restricted project folders. The actual Google account/company processing agreement and transfer safeguards must be verified before customer-media use. Any external editor and their access still require confirmation.

We may share relevant records with advisers, insurers or authorities when necessary for legal obligations or claims. We do not grant every provider access to all customer information. Processor agreements, staff confidentiality and actual permissions must be checked before claiming a specific safeguard. We do not sell your contact information under the proposed policy.

International processing

A London database location does not mean every supplier's support, telemetry, email or subprocessor activity remains in the UK. Some providers may process information internationally. Before transfers requiring safeguards take place, the controller must check the relevant lawful mechanism, contracts and any required assessment. On request, we will explain applicable safeguards and how to obtain relevant information.

Before publication: verify the actual account/subprocessor arrangements and insert the specific applicable safeguards. Supabase, Resend and Stripe's published documents are sources to review, not evidence that all account-specific checks are complete.

How long we keep information

The owner approved the periods below and staff review before deletion. Written review/delivery procedures are prepared; actual system/provider cleanup and residual backup handling still need operational verification. Required accounting retention remains subject to applicable statutory exceptions:

Relevant information may need to be retained for an active dispute, legal hold or binding obligation. Access should be restricted and continued need reviewed. Deletion includes working copies and an appropriate backup lifecycle; this notice does not claim immediate erasure from every backup. Website/database recovery archives expire on the VPS after 14 days. Separately held recovery copies require an expiry review, and deleted records must be removed again before any restored data becomes accessible. Customer production media is not currently included in those website backups. Google provider retention/deletion handling must be verified separately.

Your choices and rights

Depending on the circumstances, you can ask to access, correct, erase, restrict or receive a portable copy of your personal information, and object to processing based on legitimate interests. You can withdraw optional consent without affecting the lawfulness of earlier use. Some records must be retained to meet an obligation or deal with a claim; we will explain any applicable limitation.

Contact hello@ndms.uk. We may need proportionate information to verify your identity. We will handle requests within the applicable legal time limits and explain any lawful extension. You can raise a privacy complaint with us and with the Information Commissioner's Office at ico.org.uk/make-a-complaint. You do not lose that right by contacting us first.

The site uses human approval for bookings. It is not described as making solely automated decisions with legal or similarly significant effects. Availability checks and payment-provider fraud checks may support the process, but staff remain responsible for booking approval.

Cookies, recordings and CCTV

See the cookie policy for browser storage and preferences. Optional analytics or advertising is not required to book.

We do not infer publicity permission from participating in a recording. We will ask separately for permission before using customer footage for our own marketing; the optional release records the specific material and intended use. Where a customer controls the production's purpose and publication, ask that customer how they use participant data; our responsibilities as a service provider still apply.

Confirmed coverage and management: the landlord manages CCTV outside the premises; there is no CCTV inside the studio floor. Before publication: obtain the landlord's responsible-controller name, notice and contact details for CCTV enquiries. That notice should explain coverage, purpose, audio status, retention and access arrangements. NDMS does not set a retention period for the landlord's system. Confirm any NDMS access to or receipt of footage separately and describe that processing if applicable. Session cameras used to make the customer's recording are separate from security CCTV.

We will date this notice and explain material changes. If the controller changes in future, update notices, supplier accounts/contracts and any relevant customer arrangements before representing the new company as responsible.