1. Who we are

This policy is issued by Deep Fusion Films Limited ("Deep Fusion Films", "we", "us", "our"), a company registered in England and Wales under company number 14898165, with its registered office at 15 Neptune Court, Vanguard Way, Cardiff, Wales, CF24 5PJ.

Deep Fusion Films is a production and technology company operating at the intersection of broadcast production and AI-assisted tooling. We are the data controller for the personal data described in this policy, unless stated otherwise for a specific tool.

2. Scope of this policy

This policy covers personal data processed through any Deep Fusion Films tool or system that links to it, which may include (but is not limited to):

  • Internal team and productivity tools (e.g. authentication and account management systems, password management, project and workflow tools)

  • Client- and partner-facing applications built or operated by Deep Fusion Films (e.g. project scoping tools, dispatch or logistics systems, CRM-integrated tools)

  • Websites and marketing pages operated by Deep Fusion Films

  • AI-assisted production and research tools used in our documentary and content work

Where a specific tool collects data in a way not covered here, that tool will provide additional notice at the point of collection. In all cases, this policy is the baseline that applies.

3. Data we collect

The personal data we collect depends on which Service you use, but typically includes:

CategoryExamplesAccount & identity dataName, work email address, job title, employer/organisation, username, password (stored as a salted hash, never in plain text)Contact & business dataPhone number, company address, VAT/billing details, correspondence with usUsage & technical dataIP address, browser/device type, log-in timestamps, pages visited, actions taken within a tool, error and diagnostic logsClient & project dataInformation submitted through client tools (e.g. dispatch records, project briefs, costings, scheduling data)Content dataFiles, images, documents or archival material uploaded to a tool for processing (e.g. AI-assisted analysis of production or archival material)

We do not intentionally collect special category data (e.g. health, religion, biometric data) unless a specific tool explicitly requests it for a clear, disclosed purpose.

4. How we use your data

  • To provide, operate and maintain our tools and Services

  • To authenticate users and manage access and permissions

  • To communicate with you about your account, a project, or a Service

  • To support and improve our production workflows, including AI-assisted analysis of production material

  • To manage client and partner relationships, including project scoping and delivery

  • To maintain the security, integrity and proper functioning of our systems (including detecting misuse)

  • To meet legal, tax, accounting and regulatory obligations

5. Our legal basis for processing

Under UK GDPR, we rely on one or more of the following legal bases, depending on the Service:

  • Contract — processing needed to provide a Service you or your organisation has asked for

  • Legitimate interests — for example, keeping our systems secure, improving our tools, and internal administration, balanced against your rights

  • Consent — where we ask for it explicitly, e.g. for certain cookies or optional data uses

  • Legal obligation — where we must process data to comply with the law

6. Who we share data with

We do not sell personal data. We may share data with:

  • Infrastructure and hosting providers — e.g. Google Cloud Platform, Amazon Web Services, Microsoft Azure, for hosting and running our systems

  • Software and AI service providers — e.g. Anthropic (Claude API), OpenAI (ChatGPT) and similar providers, used to power AI-assisted features within our tools

  • Business and productivity tools — e.g. GitHub, Google Workspace, HubSpot, Linear, and password/identity management systems used to run our business

  • Group companies — Deep Fusion Films is part of the John Gore Studios group; data may be shared within the group where necessary for corporate administration, subject to appropriate safeguards

  • Professional advisors and authorities — e.g. auditors, legal advisors, or regulators, where required

  • A future buyer — if we are involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction

Any third party processing data on our behalf is required to protect it under a written data processing agreement.

7. International data transfers

Some of our providers (such as cloud hosting and AI service providers) may process data outside the UK, including in the United States. Where this happens, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum, an adequacy decision, or equivalent standard contractual clauses.

8. How long we keep data

We keep personal data only for as long as necessary for the purposes it was collected, including to satisfy any legal, accounting or reporting requirements. Typical retention periods:

  • Account data — for the duration of your relationship with us, plus 12 months after account closure

  • Client/project data — for the duration of the project plus any period required by contract, insurance or law

  • Financial/billing records — typically 6 years, per UK tax requirements]

  • System and security logs — 12 months

9. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including:

  • Encryption of passwords and sensitive credentials at rest and in transit

  • Role-based access control, so staff only see the data they need for their role

  • Isolated database environments and access limits between services

  • Regular review of access permissions and account security

No system is completely secure, but we work to keep data appropriately protected and will notify affected individuals and, where required, the ICO, in the event of a serious data breach.

10. Cookies and similar technologies

Our websites and web-based tools may use cookies or similar technologies for essential functionality (such as keeping you logged in), and — where consented to — for analytics. You can control cookies through your browser settings; disabling essential cookies may affect how a tool works.

11. Your rights

Under UK GDPR, you have the right to:

  • Request access to the personal data we hold about you

  • Request correction of inaccurate data

  • Request deletion of your data, in certain circumstances

  • Object to or restrict certain processing

  • Request a copy of your data in a portable format

  • Withdraw consent, where processing is based on consent

  • Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled

To exercise any of these rights, contact us using the details below.

12. Children's privacy

Our Services are intended for business, professional and adult use and are not directed at children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time to reflect changes to our tools, legal requirements, or business structure. The "last updated" date at the top of this page will always reflect the current version.

14. How to contact us

If you have any questions about this policy or how we handle your data, contact us at:
Deep Fusion Films Limited
15 Neptune Court, Vanguard Way, Cardiff, Wales, CF24 5PJ
Email: privacy@deepfusionfilms.com