Data Protection & GDPR Policy

1. Introduction

Prodigy Studios Ltd is committed to protecting personal data and ensuring that all processing is carried out in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection and privacy legislation.

This policy explains how we collect, use, store, share, and protect personal data relating to employees, workers, contractors, contributors, clients, suppliers, audiences, and other individuals with whom we interact.

2. Scope

This policy applies to all employees, workers, contractors, freelancers, consultants, temporary staff, and third parties who process personal data on behalf of Prodigy Studios Ltd.

3. Types of Personal Data We Process

We may process personal data including:

• Employee, worker, and contractor information
• Contributor and source information
• Client, supplier, sponsor, and advertiser information
• Audience and customer information
• Contact details and correspondence records
• Financial and payment information
• Technical information such as IP addresses, device identifiers, website usage, and browsing data
• Any other personal data required for legitimate business purposes

4. Data Protection Principles

We process personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

5. Why We Process Personal Data

Personal data may be processed for purposes including:

• Recruitment and employment administration
• Payroll, pensions, and benefits administration
• Managing contracts and engagements
• Producing, developing, promoting, distributing, and operating media, content, productions, and related services
• Managing relationships with clients, contributors, suppliers, and business partners
• Compliance with legal and regulatory obligations
• Protecting company assets, systems, personnel, and business interests
• Maintaining records and carrying out business operations

6. Lawful Bases for Processing

We process personal data only where a lawful basis applies. These may include:

• Contractual necessity – where processing is required to perform a contract or engagement
• Legal obligation – where processing is required by law
• Legitimate interests – where processing is necessary for our legitimate business interests and does not override individual rights and freedoms
• Consent – where consent is required or appropriate
• Public interest – where processing is necessary for reasons recognised by law

7. Special Category Data

Special category data includes information relating to:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic or biometric data
• Health information
• Sex life or sexual orientation

We will process such data only where:

• Explicit consent has been obtained;
• Processing is necessary to meet employment, social security, or social protection obligations; or
• Another lawful condition under data protection law applies.

8. Criminal Offence Data

Information relating to criminal convictions or offences will only be processed where legally permitted and where an appropriate lawful basis exists.

9. Media and Journalistic Activities

Where relevant to our activities, we recognise the importance of freedom of expression, journalistic integrity, source protection, and ethical publishing standards. Personal data processed for journalistic, artistic, literary, or media purposes will be handled in accordance with applicable legal exemptions and professional standards.

10. Sharing Personal Data

We may share personal data where necessary with:

• Authorised employees and personnel
• Production, project, and collaboration teams
• Clients, broadcasters, commissioners, sponsors, and distributors
• Group companies and affiliated businesses
• Insurers, auditors, legal advisers, and professional consultants
• Service providers acting on our behalf
• Regulatory bodies, law enforcement agencies, courts, or public authorities where required by law

All recipients are expected to protect personal data appropriately and only use it for legitimate purposes.

11. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place, including approved contractual clauses or other legally recognised transfer mechanisms.

12. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, regulatory, and operational requirements.

In some circumstances, information may be retained after employment or contractual relationships end where required for legal, regulatory, evidential, or legitimate business purposes.

13. Data Accuracy

We take reasonable steps to ensure that personal data is accurate, complete, and up to date.

Individuals must notify the Company promptly of any changes to their personal information.

14. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures may include:

• Access controls
• Password protection
• Encryption where appropriate
• Secure storage systems
• Security monitoring and incident management procedures

Access to personal data is limited to those who require it for legitimate business purposes.

15. Data Breaches

Any actual or suspected personal data breach must be reported immediately to management.

Where required by law, qualifying breaches will be reported to the Information Commissioner's Office (ICO) within the applicable statutory timescales and affected individuals will be notified where necessary.

16. Individual Rights

Individuals have rights under data protection legislation, including the right to:

• Access their personal data
• Request correction of inaccurate information
• Request deletion of personal data in certain circumstances
• Restrict processing in certain circumstances
• Object to processing in certain circumstances
• Request data portability where applicable
• Withdraw consent where processing relies on consent

Requests should be submitted in writing to the Company.

17. Cookies and Website Technologies

Where applicable, our websites and digital services may use cookies and similar technologies for functionality, security, analytics, and advertising purposes.

Where required by law, consent will be obtained before placing non-essential cookies on users' devices.

18. Responsibilities

All employees, workers, contractors, and third parties who handle personal data are responsible for:

• Following this policy
• Protecting personal data appropriately
• Reporting suspected breaches promptly
• Completing any required data protection training

Management is responsible for ensuring appropriate compliance measures are maintained.

19. Privacy by Design and Compliance

Prodigy Studios Ltd seeks to embed data protection considerations into business processes, systems, projects, and services from the outset.

We may undertake reviews, audits, risk assessments, staff training, and maintain appropriate records to demonstrate compliance with applicable data protection legislation.

20. Contact Information

Questions regarding this policy or the processing of personal data should be directed to:

Prodigy Studios Ltd

Email: Carina@prodigystudios.uk

Individuals also have the right to raise concerns with the Information Commissioner's Office (ICO):

Website: https://ico.org.uk

Telephone: 0303 123 1113

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, via www.ico.org.uk or by contacting them at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or by telephone on 0303 123 1113.