Surge Films CIC
Privacy Notice

This privacy notice tells you what to expect us to do with your personal information.


Contact details

Email hello@surgefilms.co.uk


What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details

  • Addresses

  • Date of birth

  • Purchase or account history

  • Payment details (including card or bank information for transfers and direct debits)

  • Credit reference information

  • Health information (including dietary requirements, allergies and health conditions)

  • Health and safety information

  • Account information

  • Photographs or video recordings

  • Call recordings

  • Records of meetings and decisions

  • Identification documents

  • Information relating to compliments or complaints

  • Information relating to sponsorship

We also collect or use the following special category information to provide services and goods, including delivery. This information is subject to additional protection due to its sensitive nature:

  • Trade union membership

We collect or use the following information for the operation of customer accounts and guarantees:

  • Names and contact details

  • Addresses

  • Payment details (including card or bank information for transfers and direct debits)

  • Purchase history

  • Account information, including registration details

  • Information used for security purposes

  • Marketing preferences

We also collect or use the following special category information for the operation of customer accounts and guarantees. 

This information is subject to additional protection due to its sensitive nature:

  • Trade union membership

We collect or use the following information to comply with legal requirements:

  • Name

  • Contact information

  • Identification documents

  • Financial transaction information

  • Criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)

  • Any other personal information required to comply with legal obligations

  • Health and safety information

  • Safeguarding information

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

  • Racial or ethnic origin

  • Trade union membership

  • Health information

We collect or use the following information for recruitment purposes:

  • Contact details (eg name, address, telephone number or personal email address)

  • Date of birth

  • National Insurance number

  • Copies of passports or other photo ID

  • Employment history (eg job application, employment references or secondary employment)

  • Education history (eg qualifications)

  • Right to work information

  • Details of any criminal convictions (eg Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)

  • Security clearance details (eg basic checks and higher security clearance)

We also collect or use the following special category information for recruitment purposes. This information is subject to additional protection due to its sensitive nature:

  • Racial or ethnic origin

  • Trade union membership

  • Health information

  • Sexual orientation information


Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.


Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • 1. The Legitimate Interest Our primary interest is the promotion of social cohesion, skills development, and community storytelling through the medium of film.

    As a Community Interest Company, we process personal data to:

    1. Produce professional film content: This includes managing cast, crew, and contributors to fulfill our creative and commercial mandates.

    2. Deliver social benefit programs: We run workshops and educational schemes that require tracking participant progress, safety, and engagement.

    3. Evidence our impact: To maintain our CIC status and secure funding, we must demonstrate the social "value add" our programs provide to the community.


  • 2. Necessity of Processing Processing this information is necessary because:

    1. Operational Safety: We cannot run film sets or youth workshops safely without knowing who is on-site (emergency contacts, medical requirements).

    2. Contractual Integrity: To license and distribute film projects, we must have a clear record of image rights and talent releases.

    3. Accountability: Without basic demographic and feedback data, we cannot objectively measure if our programs are reaching underserved communities or fulfilling our social mission.


  • 3. The Balancing Test (Benefits vs. Risks) We have weighed our interests against the individual’s rights and believe the benefits favor the individual and the wider community for the following reasons:

    1. Benefits to the Individual: Participants receive professional training, networking opportunities, and a platform for their voices. Contributors are protected by clear legal frameworks regarding how their image is used.

    2. Benefits to Society: Our processing enables the creation of cultural artifacts that reflect community identity and provide tangible career pathways in the creative industries.

    3. Risk Mitigation: We minimize risk by practicing data minimization (only asking for what we truly need) and ensuring that sensitive data (like health info for workshops) is siloed and deleted immediately after the program ends.

    4. Expectation of Privacy: We believe individuals engaging with a film production or a social program would reasonably expect their data to be processed for these specific logistical and promotional purposes.

    Note: We do not prioritize our commercial interests over individual privacy. Our status as a CIC ensures that any data-driven "profit" or "insight" is reinvested back into the community we serve.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:


    1. Benefits to the Individual (The Participant\/Talent)
      We process information to provide direct value to the people we work with. Skill Development: By tracking progress in our film programs, we can tailor mentorship and provide certifications or references for future employment. Safety & Inclusion: Collecting accessibility or dietary needs ensures a safe, supportive environment on set or in the classroom. Career Exposure: Using "talent data" (images\/names) in our films gives participants a platform, credit for their work, and a portfolio to jumpstart their creative careers.

    2. Benefits to Our Organisation (The CIC) As a social enterprise, our data needs are tied to our survival and growth. Impact Reporting: We must prove to regulators (like the CIC Regulator) and social investors that we are actually achieving our "community interest" goals. This requires high-level data on who we are helping. Project Delivery: Film production is legally complex. We need record-keeping to manage intellectual property, licensing, and distribution rights so our films can actually be seen.

    3. 3. Benefits to Others (The Community & Funders) The "Relevant Third Party" in our case is often the community or our grant-givers. Evidence of Value: Funders require anonymized data to ensure public money is being spent effectively on social good. Community Representation: By analyzing demographic data, we ensure our films aren\'t just one-sided, but truly represent the diversity of the community we serve.

    4. 4. Why the Benefits Outweigh the Risks We ensure that our "need to know" never overrides the individual\'s "right to privacy" through three specific safeguards: Proportionality: We don’t ask for a life history if we only need an email address. We collect the minimum amount of data required to run the program or shoot the film. No "Surprise" Processing: We are transparent. A participant will never find their data being sold to a third-party marketing firm; it stays within the ecosystem of the film project or the educational program. Low Impact: Most of the information we hold is "professional" or "educational" in nature, which carries a lower risk of harm than financial or deep medical data.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for legal requirements are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • When you are recruiting for a Community Interest Company (CIC) that blends commercial film production with social benefit programs, your lawful bases for processing candidate data are typically twofold: Legitimate Interest and Contractual Necessity. Here is how you can explain these to your candidates, ensuring the focus remains on the "win-win-win" for the applicant, your CIC, and the wider community.

    1. Legitimate Interest This is your most flexible basis. It applies because the recruitment process is a routine business activity where the candidate’s interests align with yours. Why it benefits the Person (Candidate) Career Opportunity: By processing their CV and portfolio, you are giving the candidate a chance to secure paid work or a place on a social film program. Professional Networking: Even if they aren\'t right for this role, keeping their details (with their knowledge) allows you to contact them for future productions or workshops that match their niche skills. Why it benefits our Organisation (The CIC) Effective Sourcing: We need to identify the best creative and technical talent to ensure our film productions meet professional standards and satisfy our commercial clients. Mission Alignment: As a CIC, we have a "legitimate interest" in finding candidates who not only have technical film skills but also share our social values, ensuring our programs remain impactful for the community. Why it benefits Someone Else (The Community\/Funders) Social Impact: Our funders and the community benefit when we hire effectively, as it leads to higher-quality films and more robust social programs that serve the local area. Fair Representation: Processing demographic data (usually anonymized) helps us ensure our recruitment is reaching a diverse pool of talent, benefiting the industry at large. The Balancing Test: We believe the risk to the candidate is low because they have voluntarily shared their data to find work. We mitigate risk by only keeping what is necessary and deleting unsuccessful applications after [e.g., 6 or 12] months.

    2. Contractual Necessity This applies at the later stages of recruitment. Pre-contractual Steps: Once you move a candidate to the interview or "shortlist" stage, you are taking steps to enter into an employment or freelance contract. Necessary Data: At this point, you must process their details (bank info for expenses, references, right-to-work documents) to fulfill the legal requirements of an eventual contract.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.


Where we get personal information from

  • Directly from you

  • Schools, colleges, universities or other educational organisations

  • Suppliers and service providers


How long do we keep information

1. Core Principles

This retention schedule follows GDPR principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, storage limitation, and integrity and confidentiality.

Personal data will be securely deleted, anonymised, or archived once the retention period expires unless a legal obligation requires longer retention.

2. Data Retention Schedule

A. Film Production & Business Operations

  • Client contact details (names, emails, phone numbers)
    Lawful basis: Contract / Legitimate Interest
    Retention: For the duration of the contract plus 6 years
    Reason: Legal claims, audits, and business continuity

  • Contracts and agreements (clients, suppliers, licensing)
    Lawful basis: Legal obligation
    Retention: 6 years after contract end
    Reason: UK limitation periods

  • Financial records (invoices, receipts, expenses, bank records)
    Lawful basis: Legal obligation
    Retention: 6 years plus the current financial year
    Reason: HMRC requirements

  • Insurance documents (public liability, employer’s liability)
    Lawful basis: Legal obligation
    Retention: 6 years after policy expiry
    Reason: Claims and compliance

  • Business emails and correspondence (project-related)
    Lawful basis: Legitimate Interest
    Retention: Up to 6 years, reviewed periodically
    Reason: Project records and dispute resolution

B. Education Programmes (Young People Aged 13+)

  • Participant registration data (name, age, contact details)
    Lawful basis: Consent / Public Task
    Retention: Programme duration plus 1 year
    Reason: Administration, reporting, and follow-up

  • Parent or guardian contact details (email, phone number)
    Lawful basis: Consent / Legal obligation
    Retention: Programme duration plus 1 year
    Reason: Safeguarding and emergency contact

  • Consent forms (participation, media, data processing)
    Lawful basis: Legal obligation
    Retention: Until the participant turns 25
    Reason: Safeguarding best practice

  • Attendance records (sign-in sheets, session logs)
    Lawful basis: Legitimate Interest
    Retention: 3 years
    Reason: Monitoring, evaluation, and funder reporting

  • Education outcomes and feedback (assessments, evaluations)
    Lawful basis: Legitimate Interest
    Retention: 3 years, then anonymised
    Reason: Impact reporting and programme improvement

C. Safeguarding & Welfare (High Sensitivity)

  • Safeguarding incident records (incident reports, disclosures)
    Lawful basis: Legal obligation / Vital Interests
    Retention: Until the individual turns 25 or 7 years after last contact, whichever is longer
    Reason: Safeguarding and legal accountability
    Access: Strictly limited to authorised safeguarding leads

  • Risk assessments (workshops, locations, participant activities)
    Lawful basis: Legal obligation
    Retention: 3 years
    Reason: Health, safety, and safeguarding compliance

  • DBS records for staff and volunteers (reference numbers only)
    Lawful basis: Legal obligation
    Retention: 6 months
    Reason: DBS code of practice (do not retain full certificates)

D. Marketing, Media & Publicity

  • Marketing contact details (mailing lists, newsletters)
    Lawful basis: Consent
    Retention: Until consent is withdrawn or after 2 years of inactivity
    Reason: GDPR consent requirements

  • Film footage featuring identifiable individuals (raw footage and finished films)
    Lawful basis: Consent / Legitimate Interest
    Retention: As long as the content is actively used or distributed
    Reason: Creative and archival purposes

  • Photographs and video of young people (promotional or behind-the-scenes)
    Lawful basis: Explicit consent
    Retention: For the duration of the consent or project lifespan
    Reason: Consent may be withdrawn at any time

  • Social media interactions (comments, messages)
    Lawful basis: Legitimate Interest
    Retention: In line with platform controls or up to 2 years
    Reason: Engagement and moderation records

E. Staff, Freelancers & Volunteers

  • Staff employment records (contracts, right-to-work checks)
    Lawful basis: Legal obligation
    Retention: 6 years after employment ends
    Reason: Employment law and HMRC compliance

  • Freelancer and contractor records (contracts, invoices)
    Lawful basis: Contract / Legal obligation
    Retention: 6 years
    Reason: Financial and legal audit

  • Training records (safeguarding, health and safety)
    Lawful basis: Legal obligation
    Retention: 3 years
    Reason: Compliance evidence

  • Emergency contact details (next of kin)
    Lawful basis: Legitimate Interest
    Retention: Duration of engagement only
    Reason: Welfare and safety

3. Deletion & Review Process

  • Retention periods are reviewed annually

  • Secure deletion methods are used (digital wiping and confidential shredding)

  • Data is anonymised where possible for reporting and funding purposes

  • Access to personal data is restricted based on role and safeguarding responsibility

4. Data Subject Rights

Individuals have the right to access their data, request corrections, request deletion where legally permitted, and restrict or object to processing.

All requests will be responded to within one calendar month.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with

Others we share personal information with

  • Insurance companies

  • Organisations we need to share information with for safeguarding reasons

  • Professional or legal advisors

  • Financial or fraud investigation authorities

  • Relevant regulatory authorities

  • External auditors or inspectors

  • Warranty and guarantee providers

  • Professional consultants

  • Organisations we’re legally obliged to share personal information with

  • Emergency services

  • Suppliers and service providers


How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint


Last updated

01.02.2026



Let’s build something 
extraordinary together.

Start a Project