Privacy Policy

Full Corporate Privacy Policy

Last Reviewed & Documented: 2026

At Gold Wala, we hold information protected by the UK General Data Protection Regulation (UK GDPR), the European Union General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018. This includes personal data about our employees and staff, clients, suppliers, customers, contributors, and other individuals, held for a variety of business purposes.

Everyone working for us has a legal obligation to ensure that we comply with these requirements and follow the safeguards we have implemented in order to best protect all the Personal Data we hold.

This policy sets out how the Company seeks to protect personal data and individuals' rights and obligations. This policy should be read in addition to our policies relating to staff use of the internet and email (‘Use of Company Computers, Laptops and Mobile Phones’, found in the Gold Wala Company Handbook).

The individuals responsible for this policy, data protection compliance, and our internal complaints-handling framework are Faraz Osman & Jess De Santis.

This policy is regarded as a living document that will be reviewed regularly and amended at any time to ensure ongoing compliance with current UK and EU data protection legislation, including the Data (Use and Access) Act.

1. Core Business Purposes for Data Processing

We collect and process personal data to:

• Provide services to our customers and maintain an accurate list of them.
• Undertake research for our media production business.
• Recruit, support, manage, and pay our staff.
• Manage our on-air talent, contributors, and contestants.
• Maintain our business accounts and financial records.
• Market and promote our goods, services, and productions.
• Respond to enquiries, feedback, and formal complaints.
• Maintain the security and safety of our property, premises, and IT systems.
• Ensure a safe, open, diverse, and tolerant working environment.

2. Key Definitions

• Personal Data: Data relating to a living individual who can be identified directly from that data, or from that data in conjunction with other readily available information (such as name, address, images, telephone numbers, personal email addresses, date of birth, bank and payroll details, next of kin, passport particulars, and online identifiers such as IP addresses). It also includes educational background, skills, marital status, nationality, job title, references, attendance records, and performance history.
• Special Category Data: Highly sensitive personal data revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health matters, sexual orientation or sex life, and genetic or biometric data.
• Criminal Records Data: Information about an individual's criminal convictions, offences, or related allegations and legal proceedings.
• Processing: Any operation performed on data, including collecting, recording, storing, amending, disclosing, retrieving, or destroying it.

3. The 7 Core Data Protection Principles

Anyone processing personal data on behalf of Gold Wala must strictly adhere to the seven core principles of modern data protection:

1. Lawfulness, Fairness, and Transparency: Data must be processed fairly, lawfully, and in a transparent manner in relation to the data subject.
2. Purpose Limitation: Data must be collected only for specified, explicit, and legitimate business or legal purposes, and not processed for unconnected reasons unless agreed.
3. Data Minimisation: Data must be adequate, relevant, and limited to what is strictly necessary for the specified purpose.
4. Accuracy: Data must be accurate and kept up to date; reasonable steps must be taken to ensure inaccurate data is erased or rectified without delay.
5. Storage Limitation: Data must not be kept in an identifiable form for longer than is necessary for its original purpose.
6. Integrity and Confidentiality (Security): Data must be processed securely using appropriate technical and organisational measures to protect against unauthorised or unlawful processing, accidental loss, destruction, or damage.
7. Accountability: Gold Wala must not only comply with the principles above but must explicitly be able to demonstrate that compliance through structural records, logs, and policies.

4. Lawful Bases for Processing Data

Processing of personal data is only lawful if at least one of these legal conditions is met:

• Contract: Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
• Legal Obligation: Processing is necessary for compliance with a legal or statutory obligation.
• Vital Interests: Processing is necessary to protect someone's life or immediate safety.
• Public Task: Processing is necessary for the performance of a task carried out in the public interest.
• Legitimate Interests: Processing is necessary for the legitimate business interests of Gold Wala or a third party, except where overridden by the rights and freedoms of the individual.
• Recognised Legitimate Interests: Under current UK law, processing required for high-priority public activities—including the prevention, detection, and investigation of crime, and immediate safeguarding of children or vulnerable adults—is structurally recognised as a legitimate interest without requiring a balancing test.
• Consent: If no other condition applies, processing is lawful if the data subject has given clear, explicit, and freely given consent. Consent must be specific, and individuals have the right to withdraw it at any time, at which point processing must stop.

5. Security Principles & Storing Data Securely

All staff, freelancers, and crew must strictly follow these principles to maintain security integrity:

General Information Security

• Clean Desk Policy: Do not leave physical files containing personal data lying around on your desk when unattended unless you work in a securely locked office space. Files containing special category or financial data must always be locked away or password-protected.
• Physical Destruction: Printed papers containing personal information, call sheets, or talent details must be shredded immediately when no longer required.
• Secure Communications: Never share highly sensitive or special category data via raw email attachments or unencrypted channels. Always utilise secure, password-protected cloud-sharing links with set expiration dates via pre-approved secure cloud servers.
• Email Hygiene: Emails containing personal data of others must never be sent from or to your personal email accounts. Only use your official Gold Wala company email account.
• Password & Access Controls: Password-protect all devices and corporate accounts, update passwords regularly, and enforce Multi-Factor Authentication (MFA/2FA) across all email accounts, cloud storage, and production management platforms. Restrict data access strictly to those who have explicit authorisation and a business need to know.
• Device & Software Health: Ensure antivirus, anti-malware software, and operating systems are kept up to date on all devices used for company business. Exercise caution when opening unrecognised emails, attachments, or links.
• Cloud & Backups: Data must be backed up regularly to the central company servers. All external cloud services used to store company or production data must be pre-approved by the data protection officers.
• Screen Privacy: Position computer screens away from windows or public view to prevent accidental disclosure of personal data to visitors or guests.
• Portable Devices: Do not take computers, laptops, or encrypted memory sticks off the premises without permission. If permitted, they must possess a high level of encryption. Any loss or theft of a device must be reported immediately to a manager and the data protection officers.

Remote, Home, and On-Location Working

• Public Wi-Fi Restrictions: Public Wi-Fi networks must not be used to access personal data unless for business-critical reasons pre-agreed by the Data Protection officers. If permission to use a public Wi-Fi network to access personal data is granted, then a secure Virtual Private Network (VPN) must be used.
• Domestic Privacy: When working from home, ensure corporate screens are locked when away from your workspace. Household members must not be permitted to use or view company devices containing personal data.
• On-Set Data Hygiene: Physical documentation on location sets (such as call sheets and physical release forms) must be kept secure in production folders, never left visible in public production vehicles or hotel rooms, and securely disposed of immediately after use. Digital data collected on set (such as casting clips on mobile devices) must be deleted from personal local galleries once securely uploaded to company servers.

6. Production, Archive, & Contributor Data Management

Data Collection & Transparency

• Only collect data that is strictly necessary for the production (for example, avoid collecting sensitive medical or personal history unless relevant to the specific editorial requirements of the programme).
• Conducting background checks via social media or web searches must be editorially justified and documented.
• When collecting data, provide contributors with a formal, written Privacy Notice explaining who we are, why we need the data, how it will be shared, the nature of the contribution, and the likelihood of future broadcasts or repeats.

Data Retention & Media Exemptions

• Unsuccessful Applicants: Personal data and application forms for unsuccessful casting applicants must be securely deleted or destroyed after 12 months.
• Broadcasted Material & Core Talent Records: Content that has been broadcast, alongside core contributor data, release forms, and rushes, may be retained indefinitely. This processing is legally protected under the Journalistic, Artistic, and Literary Exemptions (the Media Exemptions) within UK and EU data protection laws, safeguarding our archive against retrospective deletion requests that would disrupt broadcast distribution or contract terms.
• On Production Close-Down: A senior member of the production staff must review all data assets to determine what can be legitimately retained for legal, financial, or archiving purposes, and ensure all non-essential data is securely destroyed.

Consents & Legal Authorities

• Verbal Releases: Written release notes must be obtained before or after filming. Where impossible, a verbal release to camera must be obtained, date/time stamped, and archived.
• Minors: Valid parental or legal guardian consent must be obtained for all individuals under 18. This must come from the parent/guardian with sole custody, or both parents/guardians if joint custody is held.
• Police Requests: If a request for data or production rushes is received from law enforcement, do not disclose information immediately. Alert the Executive Producer and data protection officers straight away to consult with our commissioning broadcaster, ensuring there are verified legal grounds before making any disclosure.

7. Artificial Intelligence (AI) & Automated Governance

• AI Tool Safeguards: Staff and crew are strictly forbidden from uploading personal data, special category data, or raw contributor footage/transcripts into unapproved public AI tools (such as free versions of transcription or analysis bots).
• Vendor Compliance: Any AI or automated software utilised by Gold Wala must operate under a secure, corporate-enterprise agreement guaranteeing that vendor models will not use our data or personal data inputs for machine learning training.
• Human Oversight: Gold Wala does not utilise automated decision-making software for final casting choices or employee recruitment. Human review and oversight are mandatory for all final processing assessments.

8. Human Resources (HR) & Staff Data

Gold Wala collects and processes personal data regarding job applicants, employees, workers, freelancers, contractors, crew, volunteers, interns, apprentices, and former employees. Data is stored securely within individual personnel files (digital or physical) and within secure HR and payroll systems.

Purposes and Legal Bases for Staff Data

We process this data under the legal basis of fulfilling our statutory obligations under employment, social security, and social protection law, as well as the performance of employment contracts. We do not rely on "consent" for regular operational employee data. Processing functions include:

• Facilitating recruitment and checking right-to-work documentation.
• Managing payroll, salaries, pensions, and statutory tax obligations to HMRC.
• Absence management, tracking contractual sick pay, and keeping statutory accident logs.
• Processing statutory payments (such as Maternity Pay and Statutory Sick Pay).
• Performance management, training, and references.
• Contacting next of kin in an emergency.
• Ensuring a safe, adjusted, and non-discriminatory working environment.

Data Verification

Staff will be asked on an annual basis to check the accuracy of their records. Please notify your Production Manager immediately if your personal details (address, bank details, next of kin) change. At the end of your engagement or employment, you must return all company equipment and securely delete all company and personal data relating to Gold Wala from any personal devices.

Sharing HR Data

We share staff data with authorised third-party data processors (such as HR providers, payroll bureaus, IT consultants, banks, pension providers, external accountants, and insurance brokers). Before appointing any processor, we carry out due diligence to ensure they implement strict technical and organisational security measures.

9. International Data Transfers

Personal data held by Gold Wala will generally not be transferred to countries or territories outside of the UK or the European Economic Area (EEA) unless that jurisdiction ensures an adequate level of protection, or specific legal safeguards are put in place.

Where modern business tools, cloud systems, or international co-productions require data to cross these boundaries, Gold Wala ensures protection via approved UK Adequacy Regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

10. Digital Governance: Website Visitors & Cookies

When individuals visit our website (goldwala.com), we automatically collect standard, non-invasive technical data (such as IP addresses, browser types, and page interactions) to ensure site security, stability, and performance optimisation.

Non-essential analytics or tracking cookies will not be deployed without active, explicit user consent via our website's upcoming cookie consent interface. Visitors can manage or revoke cookie preferences at any time via their web browser settings.

11. Workplace & Digital Monitoring

Any tracking or logging of company IT networks, corporate email traffic, or corporate device usage is conducted transparently, proportionately, and solely for security or systems-maintenance purposes.

Gold Wala does not deploy continuous, invasive digital tracking tools (such as keystroke loggers or automated webcam tracking) on employees or freelancers, particularly within home-working environments where a high expectation of personal privacy exists. All operational monitoring aligns strictly with current ICO Worker Monitoring Guidelines.

12. Individual Rights & Subject Access Requests (SARs)

Individuals have a comprehensive set of statutory rights regarding their personal data, including the right to rectify inaccurate data, stop or restrict processing, or request total erasure of data that is no longer legally required to be held.

Subject Access Requests (SARs)

Individuals are entitled to request access to the information held about them at any time.

• No Charges: SARs are processed entirely free of charge to the data subject.
• Format: Data subjects have the right to receive a copy of their data in a structured, commonly used electronic format, or request data portability directly to another system.
• Timeframe: Requests must be responded to within one calendar month of receipt.
• Complexity Extension: For highly complex or numerous requests, Gold Wala may extend this response window by up to two additional months, provided we notify the individual within the first month explaining the reasons for the extension.
• Exemptions: If a request is manifestly unfounded or excessive, Gold Wala is not obliged to comply, or may alternatively charge a reasonable administrative fee based on processing costs. We will request valid proof of identity before releasing sensitive files.

All data rights requests must be forwarded immediately to Faraz Osman or Jess De Santis via info@goldwala.com.

13. Data Protection Complaints Procedure

Gold Wala is committed to resolving data issues transparently and efficiently. In accordance with current UK data governance standards, individuals have a statutory right to lodge an internal data protection complaint directly with us before escalating issues externally.

• How to Complain: Formal complaints regarding how data has been handled or processed must be sent to Faraz Osman and Jess De Santis at info@goldwala.com.
• Acknowledgment: Gold Wala will formally acknowledge receipt of any internal data protection complaint within 30 days.
• Investigation: The complaint will be investigated thoroughly without undue delay. A final, written determination outlining our findings and any remedial action taken will be provided to the complainant.
• Escalation: If the individual remains unsatisfied with our internal response or resolution, they retain the full legal right to escalate their complaint directly to the regulatory authority: The Information Commissioner’s Office (ICO).

14. Data Breach Management & Log

A personal data breach refers to any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

• Internal Reporting: Staff must report any suspected data breach, loss of a physical file, or device theft immediately to their manager and directly to Faraz Osman or Jess De Santis.
• The Internal Breach Register: Gold Wala maintains a centralised, confidential Data Breach Register. Every single data incident or near-miss—regardless of scale or severity—must be documented within this log, capturing the facts, the impact, and the corrective actions implemented.
• ICO Notification: If an assessment shows a data breach is likely to result in a risk to the rights and freedoms of any individual, Gold Wala will formally notify the ICO within 72 hours of discovering the breach.
• Data Subject Notification: In situations where a breach causes a high risk to an individual (such as leaked financial data or highly sensitive medical details), Gold Wala will inform the affected data subjects directly and without undue delay so they can take protective steps.