Version 20261113-150908-545453 · Published 13 November 2026
Who is responsible
Nicholas Lymberis T/As Firedrake Studios is the controller of the personal information described here. Contact enquiries@firedrake-studios.co.uk for privacy enquiries and requests.
26 Tennyson Close
Woodbridge
IP12 4LB
United Kingdom
What we collect and why
Contact and production enquiries: your name, email, optional company/phone and the message, production, dates and equipment or crew requirements you provide. We use these to answer, prepare quotes, check suitability/availability and organise requested work. We rely on contract or steps you request before a contract where you are personally a party to it. For business contacts acting for a company and general enquiries, we rely on our legitimate interests in responding and conducting our production business.
Crew applications and network: contact details, approximate working area, professional roles, skills, experience, availability, equipment, links and any optional photo you submit. New applications are processed under our legitimate interests in assessing professional suitability, maintaining a relevant local network and discussing suitable productions with people who ask to work with us. We balance these interests against your rights through private defaults, optional phone/photo, limited information, review and retention controls and a way to object. Applications and suitability decisions are reviewed by people, not made solely by an automated system.
Older crew records: where we originally relied on consent for storage or contact, that basis is preserved. You can withdraw it; we do not silently replace it with a different basis for the same purpose.
Optional public profiles: we rely on your separate consent. Approval alone does not publish a profile. An approved public profile may show your professional name (or submitted name if no professional name is supplied), town/county, roles, skills, bio, credits, equipment, professional links and photo. Email, phone and private application notes are excluded. Public pages can be viewed, indexed or copied by others; professional links may themselves identify or let people contact you. You can apply without agreeing to publication.
Please provide only necessary professional information. Do not send home addresses, identity documents, health information, trade-union membership, criminal records or other sensitive personal information through these forms. Phone and profile photo are optional. Do not submit another person's contact or private information without authority. Information needed later for a particular contract will be requested separately.
We use local rules to screen website submissions for abuse, duplicate messages and unsolicited sales pitches. Suspected submissions remain available for human review rather than being automatically deleted. Screening does not authenticate a sender or decide crew suitability. Submissions may be forwarded to our Google Workspace studio mailbox with the details needed to reply; private photos remain in protected website storage. Replies sent through Gmail are held in that mailbox and are not automatically synchronised into the website. Staff may also track quotes and bookings against an enquiry.
Your choice and your right to object
You can object to processing based on legitimate interests, including crew-network contact, at any time. Use your privacy area or email us. Network objections, restrictions and deletion requests submitted there immediately hide matching profiles and pause network contact while we review the request. We will explain any justified exception or necessary continued retention.
Withdraw optional public-profile consent at any time in your privacy area, or contact us. This immediately removes your profile and photo from public access through this website. Withdrawal does not affect processing that was lawful before withdrawal. Copies already held by search engines or other people may take longer to disappear; tell us if you need help. Withdrawing publication consent does not itself end private network participation.
Who receives information
Only authorised studio staff and service providers supporting the website, email, hosting and backups receive private information as needed. We may share necessary professional information with a producer or crew professional to progress a production you have requested; we do not publish personal contact details in the directory. Relevant contract, accounting or professional advisers and authorities may receive information where necessary and lawful. We do not sell personal information or use crew applications for unrelated promotional mailing.
Website hosting: DigitalOcean, London, United Kingdom.
Business email: Google Workspace. Google and its subprocessors may process information internationally, including in the United States, under the applicable Workspace data-processing terms.
International transfers
Our website server is in London, United Kingdom. Our hosting and email providers operate internationally, so their processing or support may involve access outside the UK. For restricted transfers, we require an applicable UK adequacy arrangement or approved contractual safeguards, including the UK Addendum where applicable, under our providers' data-processing terms. Contact us for the applicable safeguards and how to obtain a copy.
Ask us for details or a copy of the applicable transfer safeguards.
How long we keep information
- Closed contact, hire and production enquiries: 365 days after closure. Unconverted contact/new enquiries are normally disposed of after 365 days; future shoots and active productions require review.
- Submissions confirmed by staff as junk or unsolicited promotion: normally up to 30 days after review, unless needed for an open request, a booking or a justified hold. Human review can release a wrongly classified submission.
- Unsuccessful or inactive crew applications: 365 days after submission or the last documented review. We review active approved crew records at least every 365 days for relevance, accuracy and continued need.
- Retired newsletter signup records are no longer used for mailings. They are reviewed for deletion and retained only with a continuing justification, with routine disposal no later than 365 days after signup unless a documented exception applies.
- Consent evidence is retained while we rely on it or need to demonstrate how we dealt with a withdrawal, subject to the underlying record's justified retention.
- Closed privacy requests: 730 days after completion. Minimised accountability records: 730 days.
- Routine security/access logs: up to 30 days; routine backups: up to 30 days before expiry.
Booking records and linked enquiries are reviewed after closure for any continuing contract, tax, accounting or dispute purpose; they are not disposed of as unconverted enquiries. Where a contract, legal duty, dispute or other specific justification requires longer retention, we limit what is kept, document the reason and review it. Rights-request handling is processed to meet our data-protection obligations; proportionate security and accountability records support our legitimate interests in protecting information and demonstrating proper handling. Deletion from live systems may precede backup expiry: backup copies are put beyond ordinary use and any restoration must reapply deletions. The same retention rules apply to relevant mailbox copies. We do not keep information indefinitely just in case.
Security, cookies and links
We restrict access to private records, protect form submissions and separate private crew photos from public media. Internet transmission and public publication still carry risks. Technical security records may include connection details such as IP addresses; short-lived keyed identifiers are used to limit abuse without storing raw addresses in the rate-limit database.
The website uses essential security and session cookies to protect forms, administer the site and keep your verified privacy session. It does not currently set advertising or analytics cookies. External professional links take you to other providers whose privacy practices apply there. We will update this information and obtain any required permission before introducing optional tracking.
Access, corrections, deletion and other rights
You may request access, correction, erasure, restriction, objection or portability where the relevant right applies. Rights and exceptions depend on the purpose and lawful basis. Use your privacy area or email enquiries@firedrake-studios.co.uk. You can also contact us if you cannot receive a verification code or no longer control the original email address; we will use proportionate identity checks. We normally respond within one month and will explain any lawful extension or need for clarification. Requests are normally free.
Complaints
Please contact us first if you have concerns so we can investigate. Raise a privacy complaint through your privacy area or by email. We acknowledge complaints within 30 days, investigate appropriately, keep you informed and explain the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO), the UK data-protection regulator.