PRIVACY POLICY

Last updated: 12 November 2026

This policy explains how Isca Film collects and uses your personal data when you visit this website, get in touch, or work with us. We keep it short and plain, and we only collect what we need.

WHO WE ARE

Isca Film is the data controller for this website.

Legal name: Oliver Pestell TA Isca Film
Contact for anything privacy-related: oli@isca.film

We handle your data in line with the UK GDPR and the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) for cookies and marketing.

WHAT DATA WE COLLECT

We collect different things depending on how you use the site.

  • Enquiries. If you use our contact form or email us, we collect your name, email address, organisation, phone number (if you give it) and whatever you tell us about your project.

  • Website usage data. Our site collects technical information such as your IP address, browser and device type, pages visited, how long you stayed, and roughly where you are (town or region level), through cookies and similar technologies.

  • Clients and suppliers. If we work together, we hold the contact details, contracts, invoices and correspondence needed to run the project. If you appear in a film we make, that is covered by separate consent and release forms.

We don’t knowingly collect data from children through this website, and we don’t ask for special category data (such as health or religion) through it. Please don’t include any in your messages.

HOW AND WHY WE USE YOUR DATA

UK GDPR says we need a lawful basis for every use of your data. Here are ours.

  • Replying to enquiries and quoting for work: you asked us to, or you want to enter a contract with us. Lawful basis: contract (steps before a contract) or legitimate interests.

  • Delivering projects, invoicing and keeping accounts: to fulfil our contract and meet tax and accounting rules. Lawful basis: contract; legal obligation.

  • Understanding how the site is used and improving it: to make the site work better for visitors. Lawful basis: consent (for non-essential cookies).

  • Keeping the site secure and preventing misuse: to protect our business and visitors. Lawful basis: legitimate interests.

  • Occasional follow-up with past clients and professional contacts: to maintain business relationships. Lawful basis: legitimate interests.

Where we rely on legitimate interests, we have weighed them against your rights and expect the impact on you to be minimal. You can object at any time (see Your Rights below).

If we rely on your consent, you can withdraw it whenever you like. Every marketing email includes an unsubscribe link, or you can email us. We don’t sell your data, and we don’t use it for automated decision-making or profiling that has legal or similarly significant effects on you.

COOKIES, ANALYTICS AND EMBEDDED VIDEO

Cookies are small files stored on your device. Under PECR, we only set non-essential cookies if you say yes first. You can change your mind at any time through the cookie banner or your browser settings.

  • Strictly necessary cookies keep the site working and secure, and remember your cookie choice. These don’t need consent.

  • Analytics cookies count visits and show which pages are popular, so we can improve the site. These need consent.

  • Embedded media: videos hosted on [Vimeo / YouTube] may set their own cookies when you play them. These need consent.

Our site is built and hosted on Squarespace, which provides the analytics and some of the technical cookies. Each provider’s own privacy policy explains what it does with the data.

WHO WE SHARE YOUR DATA WITH

We only share your data with people who help us run the business, and only as far as needed:

  • Website and email providers, such as Squarespace and [your email/cloud provider].

  • Analytics and video platforms, as described above.

  • Freelance crew and collaborators who work with us on a project, where they need your contact details to do the job.

  • Accountants, bookkeeping and payment services.

  • Professional advisers, and authorities such as HMRC or the police, where the law requires it.

These providers act on our instructions under their own data protection terms, or as independent controllers with their own policies. We never sell your data.

TRANSFERS OUTSIDE THE UK

Some of our providers (Squarespace, for example) are based in or process data in the United States or elsewhere outside the UK. When that happens, we make sure the transfer is protected, for example by the UK-US Data Bridge where the provider is certified, the UK International Data Transfer Agreement or Addendum, or another safeguard recognised under UK law. You can ask us for details of the safeguards in place.

HOW LONG WE KEEP YOUR DATA, AND HOW WE PROTECT IT

We keep personal data only as long as we need it for the reason we collected it.

  • Enquiries that don’t lead to work: up to 2 years, then deleted.

  • Client records, contracts and project correspondence: the duration of the work plus 6 years (for contract claims).

  • Invoices and accounting records: 6 years from the end of the financial year, as HMRC requires.

  • Newsletter subscribers: until you unsubscribe.

  • Analytics data: up to 26 months, or as set by the analytics provider.

We use sensible security measures to protect your data, including strong passwords, two-factor authentication where available, encrypted devices and reputable, secure providers. No online service is completely risk-free, but if a breach puts your rights at risk, we will tell you and the ICO as the law requires.

YOUR RIGHTS

Under UK data protection law you have the right to:

  • Be informed about how we use your data (this policy).

  • Access a copy of the personal data we hold about you.

  • Correct anything that is inaccurate or incomplete.

  • Erase your data in certain circumstances.

  • Restrict how we use your data in certain circumstances.

  • Object to us using your data based on legitimate interests, and to direct marketing at any time.

  • Data portability, meaning to receive data you gave us in a usable format, where we process it by consent or contract.

  • Withdraw consent at any time, where we rely on it.

To use any of these, email oli@isca.film. We will reply within one month, and we won’t charge a fee unless a request is clearly unfounded or excessive. We may need to check your identity first.

COMPLAINTS, OTHER WEBSITES AND CHANGES

Complaints. If you’re unhappy with how we’ve handled your data, please talk to us first at [email address] and we’ll do our best to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Other websites. This site may link to other websites, such as client sites or social media. We’re not responsible for their privacy practices, so please read their policies.

Changes. We may update this policy from time to time. The date at the top shows when it was last changed, and we’ll flag any significant changes on the site.