Privacy Policy

Orlux Creative LLP is the controller of the personal data described in this policy. We are a limited liability partnership registered in England and Wales under company number OC459189, with our registered office at 7 Farriers Way, Great Notley, Braintree, Essex, CM77 7XJ, United Kingdom.

We are registered with the Information Commissioner’s Office (ICO) under registration number ZC208192.

For anything to do with your data, email lucas@orluxcreative.com.

We only collect what we need. Depending on how you deal with us, this may include:

• Enquiries: your name, email address, phone number, company name and anything you tell us when you email us or book a call. Calls are booked through Calendly, which collects your name, email address and the time you choose on our behalf.
• Clients: contact and billing details, contract records, the content and materials you send us, and access details for any accounts you ask us to manage.
• People we film: images, video and voice recordings of people who appear in footage we capture.
• Website visitors: technical information our hosting provider records automatically, such as IP address, browser type and the pages requested, which is used to keep the site secure and running.

We do not use analytics or advertising tracking on this website at present.

Under UK data protection law we must have a lawful basis for using your data. We use it to:

• reply to your enquiry and prepare a proposal, because you have asked us to (steps before entering a contract);
• deliver the services we have agreed with you, manage the project and invoice you (performance of a contract);
• keep accounting and tax records (legal obligation);
• keep our website and systems secure, and run and improve our business (legitimate interests);
• send you occasional news about our work, only where you have agreed or are an existing client, and you can opt out at any time (consent or legitimate interests).

When we film on behalf of a client, the client usually decides why and how footage is used, so they are the controller and we act as their processor, following their instructions. Clients are responsible for letting people know that filming will take place, for example at an event.

Where we film for our own purposes, such as our portfolio or social channels, we are the controller and will ask for consent where it is needed. If you appear in footage we control and would like it removed, email us and we will deal with your request promptly.

We never sell your personal data. We only share it where needed with:

• service providers who help us run the business, such as email, call scheduling (Calendly), file storage, project management, accounting and website hosting providers;
• social media and advertising platforms, when we run accounts or campaigns on your behalf;
• freelancers or crew working on your project, under a duty of confidentiality;
• our professional advisers, such as accountants and solicitors;
• the police, HMRC or other authorities where the law requires it.

Some of our service providers store data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

• Enquiries that do not lead to a project: up to 12 months after our last contact.
• Client contracts, invoices and financial records: six years from the end of the financial year they relate to, as required for tax purposes.
• Footage and project files: for as long as set out in your agreement, or as long as needed to support the work we delivered.
• Account access details: removed or handed back when our work on those accounts ends.

We use appropriate technical and organisational measures to protect your data, including access controls, secure passwords and two-factor authentication where available. Only people who need your data to do their job can access it.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to restrict or stop using your data, or object to how we use it;
• ask for your data in a format you can take elsewhere;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email lucas@orluxcreative.com. There is usually no charge and we will respond within one month.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.