Photography, Audio and Video Privacy Notice

Introduction

Revell Research Systems Limited (the Company, we, us, our) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal information.

This notice relates to the personal data that is processed by us when you are photographed, filmed or recorded for work commissioned by us. The resulting photography, audio or video may contain personal data. Audio and video may also be broadcast live or at a later date.

We may commission photography, recording or filming for use in internal or external communications, promotional activities, business administration, training, archival and historical purposes.

These commissions may be general in nature or cover specific events, such as networking, receptions, lunches, dinners, public relations activities, training events and prize giving ceremonies that we organise or that we are invited to. They may take place in public or private spaces. We may also be commissioned to photograph, record or film activities by our clients.

Photographs, audio recordings and video recordings that identify, or could reasonably be used to identify, an individual constitute personal data under data protection legislation. However, it is not always simple to decide whether such content contains personal data as it depends on whether an individual can be identified. Clearly, there is a difference between a portrait and a stadium crowd. The more people in the photograph, audio or video recording segment the less likely individuals will be identifiable and the less likely that data protection legislation will apply.

Staff, associates, client personnel and members of the public may appear in photography, audio and video recordings.

We may use resulting photography, audio and video in a variety of online and offline media, including print, web and social media. It is possible for people to share posts from social media or save images from our websites and social media accounts and re-use them.

Some events, activities or presentations may be broadcast live using online streaming platforms, social media services or similar technologies. Where this occurs, individuals appearing in the broadcast may be viewed by audiences in real time both within and outside the United Kingdom.

Once a live broadcast has taken place, it may not be possible to prevent third parties from recording, copying, sharing, retransmitting or otherwise retaining the content. Although we may remove recordings or cease publication of material under our control where appropriate, we cannot guarantee the removal of copies created or retained by third parties.

We may record information relating to your organisation as a prospective or existing business contact. Where such information does not relate to an identifiable individual, it may fall outside the scope of data protection legislation.

In some circumstances photographs, audio recordings or video recordings may incidentally reveal special category personal data, for example information about a person's health, disability, racial or ethnic origin, religious beliefs or trade union membership. Such information is not normally collected intentionally but may arise naturally from the content captured. Where such information is processed, we will do so in accordance with applicable data protection legislation and implement appropriate safeguards.

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police and law enforcement agencies
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• General public
• Agents acting on our behalf
• Service providers (including associates)
• Professional advisers
• Website hosting, cloud and technology service providers
• Social media, streaming and content platform operators
• Photography, audio, video, publishing and media production providers
• Marketing, communications and public relations service providers
• Event organisers and venue operators
• Regulators and supervisory authorities
• Insurers and insurance advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We collect and process this information in connection with our business activities, client engagements, communications, promotion, training, research, administration and the preservation of our corporate history. We may commission photography, audio and video recordings to support marketing activities, web development, archiving, health and safety, security, identity checks, learning, professional development, research and training.

We may process this data for the purpose of the proper administration of our business and in communicating with you as well as maintaining backups.

We may share data with the courts and associated professionals in establishing, exercising or defending your, another's or our legal rights. We may share data in reporting crime to or when co-operating with the police and law enforcement agencies.

What is the legal basis for processing?

Our lawful bases are Contract and Legitimate Interests.

• contract - the Company processes personal data in performing a contract with staff, associates or clients involving photography, audio or video.
• legitimate interests - the Company has legitimate interests in using photography, audio and video recordings for marketing, archival, health and safety, security, identity checks, learning, professional development, research and training as well as in protecting and asserting our, your or another's legal rights; and in properly administering its business and backing up data.

Before relying upon legitimate interests, we consider the nature of the processing, the reasonable expectations of affected individuals and the potential impact upon their rights and freedoms. We balance our legitimate interests against those rights and freedoms and only rely upon legitimate interests where we consider the processing to be necessary and proportionate.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

You may object to the processing of your personal data where the lawful basis is legitimate interests. We will consider your request carefully, but we may not always be able to comply with it. For example, photography, audio or video may already have been incorporated into printed materials, published content or archival records that cannot reasonably be amended or withdrawn. Once material has been published, shared, redistributed, archived, downloaded or copied by third parties it may not be possible to remove all copies.

If you wish to object during an event after your details have been captured please ask our staff to delete the data. They will consider the request and, where reasonably practicable, delete the material unless there is a legitimate and overriding reason to retain it. If you wish to object after the event but before the material is used then please contact us. We may be able to edit the material to remove you or render you unidentifiable.

How are we collecting this information?

We capture your personal data in the photograph, audio or video recording we make.

If you might or do feature, or otherwise prominently appear, in a photograph or recording then we may also ask you to provide basic details about yourself, including how we might contact you in the future.

We will make reasonable efforts to inform people that photography, recording, filming or live broadcasting is taking place at a venue. We will publish notices to advise people that photography, recording, filming or live broadcasting is taking place (for example, as notices at the venue, on our website, by email and at the time of booking, where applicable).

If the lawful basis is legitimate interests then people have the right not to appear in an identifiable way in photography, audio or video. Please contact us to let us know if you do not want to be photographed, recorded or filmed. Regrettably, if there is no reasonable way to avoid including the individual, they may need to choose not to attend the event.

You have the legal right to object to the processing of your personal data when the legal basis is legitimate interests. We will consider your request but we are not obligated to grant it. You can avoid being featured by acting on event signage to place yourself in photography or recording free zones, choosing to stand out of shot or leaving the whole area when the shoot or recording starts. You can also decide not to attend. You can ask the photographer or recording team not to include you. Where reasonably practicable, our photographers and recording staff will take account of individuals who indicate that they do not wish to appear in identifiable photography, audio or video recordings and will seek to avoid including them where possible. We may provide indicators (coloured stickers or lanyards) at some events to wear so you are not included against your wishes.

Where the lawful basis is contract, you must appear in the photography or recording in order to fulfil the contract. For example, staff and associates may need to have their photograph taken and displayed on our websites, intranet or Company identity cards.

What information are we collecting?

We typically collect the following personal information when you are in a photograph, audio or video recording:-

• your name and preferred style of address
• job title
• organisation
• email address
• telephone number
• other contact details
• date, time and duration of capture
• the content itself, including any embedded personal data and, in limited circumstances, special category personal data that may be apparent from photographic, audio or video content

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

Will your personal data be transferred outside the United Kingdom?

Photography, audio and video recordings may be published using websites, social media platforms and other channels that are accessible worldwide. As a result, personal data contained within published material may be viewed, accessed or processed outside the United Kingdom.

Where we transfer personal data internationally as part of our own processing activities, we will ensure that appropriate safeguards recognised by the UK General Data Protection Regulation (UK GDPR) are in place before the transfer occurs.

These safeguards may include transfers to countries recognised as providing an adequate level of protection for personal data or the use of approved contractual arrangements between the parties involved in the transfer.

How long is your information kept?

We will only keep your information for as long as necessary. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

We retain photography, audio and video recordings and associated personal data for as long as they continue to be required for the purposes for which they were captured, including publication, archival, legal, regulatory, administrative, training and business purposes. We may retain certain recordings and images indefinitely where they form part of our historical archives or published materials.

How secure is your information?

We take appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

You are responsible for keeping your personal details up-to-date. Please advise the Company of any changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information