-
Contents
- Introduction
- Security
- Data that we hold
- Contacting and Engaging with Nutopia
- Why do we process data?
- What data is processed ?
- If you fail to provide personal data?
- What are the lawful bases for processing?
- What are the lawful bases we rely on for processing?
- Direct marketing
- How long we hold the data for?
- Sharing personal data
- Locations of processing
- Your legal rights
- No fee usually required
- What we need from you
- Time limit to respond
- Complaints
- Data Controller and contact information
- Changes to our privacy statement and your duty to inform us of changes
2 Introduction
Nutopia Limited (“we”, “us”, “our”, “Nutopia”) is an independent television production company based in London, producing quality programmes and other content for worldwide distribution. We are a company incorporated in England under company number 03371279 and our registered office is at Summit House, 170 Finchley Road, London NW3 6BP. Our main office is at 1st Floor, Kirkman House, 12-14 Whitfield Street, London W1T 2RF.
We are committed to protecting and respecting the personal data that we hold. This privacy statement describes why and how we collect, store, transfer and use personal data and provides information about individuals’ rights. It applies to personal data obtained by or provided to us, by individuals themselves or by others or from other sources. We may store, transfer and use personal data provided to us for the purposes described in this privacy statement or as made clear before collecting personal data.
Personal data is any information about an individual from which that person can be identified. When collecting and using personal data, our policy is to be transparent about why and how we collect, process, store and transfer personal data.
We process personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose are set out in the relevant sections below.
We do not knowingly collect personal data relating to children. In the event that we do need to process children’s personal data – for example, where a child is involved in a production – we will take appropriate steps in compliance with the UK GDPR. This includes, but is not limited to, providing an age appropriate children’s privacy statement that is understandable to both children and their parents or guardians.
The personal data that is obtained by or provided to us is either provided:
-
- Directly by the individual concerned or by a third party acting on behalf of an individual;
-
- Obtained from a publicly available source (e.g. press articles, social media profiles, online searches);
-
- From your previous employment; and/or
-
- By suppliers or service providers.
Where we receive personal data that relates to an individual from a third party acting on behalf of an individual, we request that this third party informs the individual of the necessary information regarding the use of their data. Where necessary, reference may be made to this privacy statement.
3 Security
We take the security of all the data we hold seriously. We have implemented appropriate security measures and safeguards to ensure that your personal data is kept safe and secure including the following:
-
- Staff receive training on data protection, confidentiality and security, which is refreshed periodically to ensure continued awareness and compliance;
-
- We have a framework of policies and procedures, which ensure we regularly review the appropriateness of the measures we have in place to keep the data we hold secure;
-
- We limit access to your personal data to those employees, agents, contractors and other third parties who have a legitimate business need to know. All such persons are bound by a duty of confidentiality; and
-
- All information you provide to us is stored in a secure way.
The transmission of information via the internet is not completely 100% secure and although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted by this means; any transmission is at your own risk. Once we have received your information, we will use our procedures and security measures to try to prevent unauthorised access.
4 Data that we hold
4.1 Contacting and engaging with Nutopia
The exact data we process will depend on the nature of our interaction with you.
Where we engage with individuals, we request that individuals only provide the personal data that is necessary for the purposes of our engagement.
4.1.1 Why do we process data?
We may process personal data for various purposes, including:
- Responding to queries from members of the public;
- Considering the suitability of individuals to take part in our programmes and in connection with contributions they then make to our programmes;
- As part of and in connection with our programme-making and other activities including producing, exhibiting, exploiting, distributing, publicising, advertising and promoting our programmes by any media (now known or hereafter invented) throughout the world;
- Operating and managing our business effectively and lawfully; and
- Making payments to individuals.
4.1.2 What data is processed ?
We may collect, use, store and transfer different kinds of personal data about you which is typically grouped as follows:
- Identity data includes first name, last name, previous names, username or similar identifier, marital status, title, date of birth and gender.
- Contact data includes billing address, delivery address, email address and telephone numbers.
- Financial data includes bank account and payment card details.
- Transaction data includes details about payments to and from you.
- Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
In certain circumstances, our collection of the different categories of data set out above may include the collection of Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). We also may collect Criminal Convictions and Offences Data.
4.1.3 If you fail to provide personal data?
Where we need to collect personal data by law, or under the terms of a contract with you, and you fail to provide that data when requested, we may not be able to provide your contribution to a programme or assess your suitability as a prospective employee or contributor.
4.1.4 What are the lawful bases for processing?
The law requires us to have a lawful basis for collecting and using your personal data. We rely on one or more of the following lawful bases:
- Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
- Legitimate interests: Where it is necessary for our legitimate interests as a production company (or those of a third party) and your interests and fundamental rights do not override those interests. These legitimate interests include our interests in supporting the development, delivery, and enhancement of our film and television productions and ensuring appropriate standards and compliance with policies, practices or procedures.
- Legal obligation: Where we need to comply with a legal obligation to which we are subject.
- Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose.
- Where processing of “special category data” is necessary in the context of legal claims or where another legal ground other than explicit consent is available to us under relevant data protection legislation.
- Where our production services require us to process “special category data” and where we have obtained your explicit consent to do so. If we seek and obtain your consent, you may withdraw it at any time.
4.1.5 What are the lawful bases we rely on for processing?
The personal data that is processed by Nutopia – including how we intend to use it and the lawful bases for that processing – includes the following:
- Members of the Public (who contact us by phone, e-mail or otherwise in writing, or online):
- your name, contact details and handwriting – to correspond with you and for administrative purposes (with such processing being necessary for the purposes of our legitimate interests).
- Prospective Employees, Contractors and Contributors:
- your name, contact details and handwriting – to correspond with you and for administrative purposes (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it);
- your image and the other information in your passport, driving licence and other official documents – to verify your identity and to ensure compliance with relevant laws (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it);
- information about your work history, qualifications and experiences – to assess your suitability to work with us or take part in our programmes and / or to comply with contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests);
- information about your personal, home and family life – to assess your suitability to work with us or take part in our programmes and / or to comply with our contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests);
- information about you on social media and the internet including images of you and other information – to verify your identity and to assess your suitability to work with us or take part in our programmes (with such processing being necessary for the purposes of our legitimate interests);
- information about your physical and mental health – to assess your suitability to work with us or take part in our programmes and / or to comply with contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it – and undertaken with your explicit consent or on the basis that your personal data has been made public by you);
- information about any criminal convictions or cautions you have or any criminal activity or proceedings you have been involved in – to assess your suitability to work with us or take part in our programmes and / or to comply with contractual and regulatory obligations (with such processing being necessary for the purposes of our legitimate interests and / or for the performance of our contract with you or steps taken prior to entering into it – and undertaken with your explicit consent or on the basis that your personal data has been made public by you);
- your financial details including your bank details – to pay or reimburse pre-approved costs or expenses (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you or steps taken prior to entering into it); and
- your age, gender, gender identity, ethnicity, disability and sexual orientation – for diversity analysis monitoring (with such processing being necessary for the purposes of our legitimate interests and undertaken with your explicit consent).
-
- information contained in footage filmed for our programmes or provided to us including a very wide range of personal information about you including:
-
- your image, your age; date of birth; handwriting; information about your personal, home and family life and your work history, qualifications and experiences (with such processing being necessary for the purposes of our legitimate interests and for the performance of our contract with you);
-
- information about your racial and ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, health, sex life or sexual orientation (so called Special Category Data) (with such processing being necessary for the purposes of our legitimate interests and/or the performance of our contract with you and undertaken with your explicit consent, or on the basis that your personal data has been made public by you, and / or in connection with public interest journalism); and
-
- information about any criminal convictions or cautions you have or any criminal activity or proceedings you have been involved in (so called Criminal Convictions and Offences Data) (with such processing being necessary for the purposes of our legitimate interests and/or the performance of our contract with you and undertaken with your explicit consent, or on the basis that your personal data has been made public by you, and / or in connection with public interest journalism).
We need the information in such footage for editorial reasons and for the production of our programmes, for contractual reasons and obligations we have to third parties, and / or to comply with our obligations to you pursuant to our contract with you.
If we intend to process your personal information with your consent, we will seek your explicit consent. If we seek and obtain your consent, you may withdraw it at any time.
We will only process your personal data for our legitimate interests where our legitimate interests do not override your own legitimate rights and interests.
Following the exploitation of our programmes, any information about you in them will have been manifestly made public by you and we may also continue to process it on that basis.
4.1.6 Direct marketing
We strive to provide you with choices regarding certain personal data uses, particularly around marketing. We may use your name and contact information to form a view on what we think you may want or need, or what may be of interest to you. You will receive marketing communications from us if you have requested information from us, for example, if you as a prospective contributor or contributor has indicated that you would like to contribute in other programmes we produce.
You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.
4.1.7 How long do we hold data for?
We retain personal data for as long as is considered necessary for the purpose(s) for which it was collected. For those participating in our programmes, we are likely to retain your personal data for as long as is necessary in order to produce, exhibit, exploit, distribute, advertise, publicise and promote the programme in accordance with our legitimate interests and legal obligations. There may also be occasions which will require data to be kept for longer, however this will typically be for legal and contractual purposes. Personal data that is no longer required will be deleted/destroyed.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
For more information on how long we store your personal data, please contact us.
5 Sharing personal data
We will only share personal data with others when we are legally permitted to do so. When we share data with others, we put contractual arrangements and security mechanisms in place to protect the data and to comply with our data protection, confidentiality and security standards. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Your personal information is processed by our employees and staff and we use third parties to support us in providing our services including as follows:
- Contracting / Commissioning parties involved in our business activities e.g. broadcasters, sales agents, distributors, financiers;
- Production partners involved in our business activities e.g. post production houses, co-producers;
- Insurance companies / Health and Safety advisors / IT services / Legal advisors / Accountancy services who are providing services to us; and
- Others – we may share your data on with other third parties on an ad-hoc basis, however as and when this happens, we will inform you.
We may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights e.g. Ofcom and other broadcasting regulators, the police or other regulatory bodies.
We may share Special Categories of Personal Data and/or Criminal Convictions and Offences Data about you with members of the production team, and with the parties set out above, and (to the extent you provide such information as part of your contribution to a programme and the same is incorporated in a programme and/or we include details of your biography background and past experiences in a programme) with the public on transmission of the programme in which you appear.
6 Locations of processing
Although based in the UK, our business is global which means that the data that we collect from you may be transferred to and stored at a destination outside the United Kingdom (“UK”). Where that is the case, we will ensure that we comply with the UK GDPR making sure adequate safeguards are in place to ensure the safety and security of your personal data and that it is processed in accordance with this privacy statement. Adequate safeguards that we will implement include one or more of the following:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
- Where we use certain service providers located outside the UK, we use standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, such as the International Data Transfer Agreement or The International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers. To discuss these contractual safeguards further, please contact us at Data.protection@nutopia.com.
If you would like further details on the specific mechanism we use when transferring your personal information out of the UK, please contact our data protection manager.
7 Your Legal Rights
You have certain rights over the personal data we process including the following:
- You may request access to your personal data held by us as a data controller (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- You may request that we rectify any inaccurate personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- You may request that we erase your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.
- You may object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the lawful basis for that particular use of your data. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which overrides your right to object.
- Where we process personal data based on consent, you may withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
- You may request the transfer of your personal data under the right to data portability. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- You may request information about any automated data processing that we may undertake.
If you make a request, we shall respond to you without undue delay and in any event within one month. If you wish to exercise any of these rights, please send an email to our data protection manager at Data.protection@nutopia.com.
Please note that most of these rights are not absolute and are limited to certain defined circumstances. Accordingly, we may not be able to comply with any such request.
7.1.1 No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
7.1.2 What we need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
7.1.3 Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
8 Complaints
We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to Data.protection@nutopia.com. We will look into and respond to any complaints we receive.
You also have the right to lodge a complaint at any time with the UK data protection regulator, the Information Commissioner’s Office (“ICO”) whose address is at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. For further information on your rights and how to complain to the ICO, please refer to the ICO website: https://ico.org.uk/concerns.
9 Data Controller and contact information
The data controller, Nutopia, is responsible for your personal data.
We have appointed a data protection manager who is responsible for overseeing questions in relation to this privacy statement. If you have any questions about this privacy statement or how and why we collect, process, store and transfer personal data, please contact us using the following details below:
- Email address: Data.protection@nutopia.com
- Postal address: Nutopia Limited, 1st Floor, Kirkman House, 12-14 Whitfield Street, London, W1T 2RF
- Tel: +442072993430
10 Changes to our privacy statement and your duty to inform us of changes
We keep this privacy statement under regular review and may update or amend this privacy statement from time to time. Updates to this privacy statement will appear on this website. This privacy statement was last updated on 30 September 2025.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.
