Last updated: [ DATE ]

This policy explains what personal information AltarSeal Media Limited collects, why we collect it, what we do with it, and the rights you have. We have tried to write it in plain English. If anything is unclear, ask us — we would rather explain it than have you guess.

1. Who we are

AltarSeal Media Limited is the controller of the personal data described in this policy. We are registered in [ England and Wales ] under company number [ NUMBER ], at [ REGISTERED ADDRESS ].

[ ICO registration number: [ NUMBER ], if registered. ]

For anything about this policy or your data, contact [ PRIVACY CONTACT EMAIL ] or write to us at the address above.

2. The information we collect

When you enquire or book

Your name, email address, telephone number, organisation, role, and whatever you tell us about your project — including timescales and budget if you choose to share them. If you book a consultation we also collect your answers to the pre-call questions.

When you become a client

Everything above, plus billing details, correspondence, project files, and the names and contact details of the people at your organisation we work with.

When you apply to work with us

Your application, CV, portfolio links, and our notes from any conversation. If you are offered a role, we collect what we need to employ or engage you.

When you use our website

Pages you visited, roughly where you were, what device and browser you used, and how you arrived. Some of this involves cookies — see section 11.

When you subscribe or take a free course

Your name and email address, and which courses you started or completed.

When we film or photograph an event

Images, video and audio recordings of people present. This is dealt with separately in section 6 because it works differently from everything above.

When you refer someone to us

Your details, and the details of the person you referred. Where you give us someone else’s contact details, we will tell that person who suggested it when we first make contact.

3. Why we use it, and our lawful basis

Under UK data protection law we need a lawful basis for every use of personal data. Ours are:

 

What we do	Lawful basis
Reply to your enquiry and prepare a quotation	Steps taken at your request before entering a contract
Deliver the services you have commissioned	Performance of our contract with you
Invoice you and keep accounting records	Legal obligation, and our legitimate interest in running the business
Keep records of projects and correspondence	Legitimate interests — managing the relationship and defending claims
Send marketing emails you have asked for	Your consent, which you can withdraw at any time
Improve the website and understand how it is used	Consent, for any non-essential cookies
Consider you for a role	Steps taken before a contract, and legitimate interests in recruitment
Film and photograph events	See section 6 — usually legitimate interests or consent, agreed case by case
Keep records we are legally required to keep	Legal obligation

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us to explain that assessment, and you can object — see section 10.

4. When we share information

We do not sell personal data, and we do not share it for anyone else’s marketing. We do share it with:

1. Our team and vetted freelancers, where they need it to do the work
2. Service providers who process data on our behalf — [ LIST: email and productivity, CRM, accounting, cloud storage, file transfer, scheduling, website hosting, form handling, email marketing, payments ]
3. Our accountants and professional advisers
4. Anyone we are required to share it with by law

 

Every processor is bound by a written contract requiring them to protect the data and use it only on our instructions.

5. Where your information is held

[ Where all processing is within the UK or EEA, say so. Where any provider is outside — many common tools are — say which, and state the safeguard relied on: UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. This section cannot be completed until the supplier list at item 2 exists. ]

6. Photography, filming and recording at events

This is the section that matters most, and the one your adviser should look at first.

When we film or photograph a service, conference or event, we record images of people who have not filled in a form and may not have chosen to be there — including, in most church settings, children. We take that seriously, and we do not leave it to chance.

 

What we agree with you before we attend

5. How people will be told that filming is taking place — signage, an announcement, or wording on the ticket or booking
6. How someone can opt out, and where they can sit or stand to be outside shot
7. How children are handled, and what your safeguarding policy requires
8. Whether any individual must not be filmed at all — people at risk, people under protection orders, or anyone who has asked
9. What the material will be used for, and whether it may appear in our portfolio

 

Who is responsible for what

At your event, in your venue, you are responsible for informing the people present and for obtaining any consents your own policy requires. We are responsible for following what has been agreed, for respecting opt-outs, and for handling the material securely afterwards.

Where you do not have a media and photography policy, tell us — we will help you put one in place. It is a common gap, and it is far easier to fix before an event than after one.

 

Children

We will not publish an image that identifies a child without the consent arrangements you have in place. We follow your safeguarding policy while at your premises. Where a child’s image appears in material we hold but may not publish, we hold it securely and do not use it.

 

If you appear in something we filmed

If you were recorded at an event we covered and you would like the material removed or not used, contact [ PRIVACY CONTACT ]. Tell us the event, the date, and enough to identify yourself in the material. We will remove it from anything we control. Where the material has already been published by the event organiser or broadcast live, we will tell you who else to contact.

7. How long we keep things

[ CONFIRM every period, and make sure the systems actually do it. A published retention period you do not keep to is worse than none. These must match the Terms of Supply and the FAQ. ]

 

Information	Kept for
Enquiries that do not become projects	[ 24 months ] from last contact
Client records and correspondence	[ Duration of the relationship, plus 6 years ]
Invoices and accounting records	[ 6 years, as tax law requires ]
Project files and raw material	[ PERIOD — must match the Terms of Supply ]
Job applications, unsuccessful	[ 12 months, then deleted ]
Marketing subscribers	Until you unsubscribe, then a suppression record only
Website analytics	[ PERIOD per the analytics configuration ]

8. Keeping it safe

10. Data is encrypted in transit, and at rest where our providers support it
11. Access is limited to people who need it for their work
12. Accounts use multi-factor authentication
13. Freelancers are bound by confidentiality and data protection terms
14. Devices used for client work are encrypted and password-protected
15. We review who has access when someone joins or leaves

 

No system is completely secure. If a breach occurs that is likely to risk your rights, we will tell the ICO within 72 hours and tell you without undue delay.

9. Marketing

We send occasional emails with resources and updates, and only to people who asked for them. Every email has an unsubscribe link that works immediately. Unsubscribing does not affect emails about a project you have commissioned — those are part of delivering the work.

10. Your rights

You have the right to:

16. be told what we hold about you, and get a copy
17. have inaccurate information corrected
18. ask us to delete information, where there is no good reason for us to keep it
19. ask us to restrict how we use it while a question is resolved
20. object to processing based on legitimate interests, including profiling
21. object to direct marketing at any time
22. receive data you gave us in a portable format
23. withdraw consent, where consent is the basis we relied on

 

Contact [ PRIVACY CONTACT ]. We will respond within one month. There is no charge. We may ask you to confirm your identity first, which protects you rather than us.

Some information we must keep — invoices in particular — even where you ask us to delete it. We will tell you if that applies and explain why.

11. Cookies

[ COMPLETE ONCE THE BUILD IS KNOWN. List each cookie or category, what it does, whether it is essential, and how long it lasts. ]

Essential cookies make the site work and do not need consent. Everything else — analytics, embedded video, maps, the booking widget, social embeds — needs your consent before it loads, and must not fire until you have given it.

You can change your choices at any time using the cookie settings link in the footer.

A consent banner that sets analytics cookies before the visitor answers is the single most common compliance failure on small business websites, and it is usually caused by the tag being installed above the consent tool rather than by any deliberate decision. Ask the developer to demonstrate that nothing non-essential fires before consent.

12. Other websites

Our site links to others — clients’ websites, social platforms, course providers. We are not responsible for their privacy practices, and their policies apply once you leave us.

13. Changes

We update this policy from time to time. The date at the top shows when it last changed. Where a change materially affects how we use your information, we will tell you.

14. Complaints

If you are unhappy with how we have handled your information, tell us first at [ PRIVACY CONTACT ] — we would like the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.