Your rights and how we use personal information.
The British Film Institute (the “BFI”, “we”) is a registered charity (number 287780), Royal Charter Body, National Lottery distributor and non-departmental public body funded by the department of Digital, Culture, Media and Sport.
The BFI is committed to respecting and protecting your personal information.
This policy seeks to inform you about:
- how and why we collect, process and store your personal information
- your Rights
This policy applies to all the BFI’s activities, services, products and platforms.
The BFI is the Data Controller and Richard Brousson is the Data Protection Officer under the UK’s Data Protection Act 2018 and the EU’s General Data Protection Regulation 2016.
All questions and complaints about the BFI’s use and handling of personal information should be addressed to firstname.lastname@example.org.
You also have the right of complaint to the UK’s Supervisory Authority for Data – the Information Commissioners Office (the “ICO”). See ico.org.uk/make-a-complaint.
Information about personal data relating to volunteering, working for or applying to work for the BFI can be found here: BFI Privacy Notice: Workforce and Recruitment
Information we may collect about you
We may collect and process the following information about you:
Information you give us
- Your prefix and name, billing and delivery address, postcode, email address, phone numbers, gender, date of birth, diversity monitoring information (anonymously unless stated otherwise), job title, personal identification documents, data relating to access or dietary requirements, payment card information
- If you are making a grant application – your position within the company applying and relevant experience
- If you are a student – your course details, relevant experience, school, college or university
- You may provide us with this information when you set up an account (e.g. BFI Player, membership), apply for a grant (BFI Film Fund), apply for a course (BFI Education), apply to the BFI’s certification unit, buy tickets (BFI Southbank, BFI IMAX, BFI Festivals), fill in a form (competitions and surveys), complete an application form or otherwise apply for a job here either directly or via a third party, apply to volunteer, or correspond with us by phone, email or in writing
Information we collect automatically
- Device IDs, IP addresses and other unique identifiers
- Your activity on our services and platforms such as title selections and browsing history
- Advertising identifiers, such as those on mobile devices, tablets and streaming media devices and information collected by cookies (please see our Cookies and internet advertising policy below)
Information we collect about you from other sources
- Service providers that help us determine a location based on your IP address
- Select partners that make our services available on their platform or with whom we offer co-branded services or engage in joint marketing
- Publicly available information such as geo-demographic information and measures of capacity and propensity for giving to help us fundraise effectively and in line with our ethical policies from sites such as Companies House
- Social media – depending on your settings you may have given us permission to access your personal information held by companies such as Facebook and Twitter
Third parties may collect information about you
When using our websites and platforms third parties may collect information about you. This can be controlled by adjusting the settings in your internet browsers. There is more detail about adjusting your browser settings on the Information Commissioner’s Office website.
Why we collect and process your personal information
We use your personal data for the following purposes:
- Carrying out research in the public interest
- Maintaining, preserving and enhancing the BFI National Archive
- Providing you with customer service when you visit, make use of or access any of the BFI premises, services or platforms
- To administer any of your accounts, applications, contracts, enquiries or complaints
- To process payments
- Fulfil ticket, product, donation and membership requests
- Contacting you
- Providing you with information about things we think may interest you
- To prevent, detect and investigate illegal activity such as fraud. The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. For further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, see Fair Processing Notices for Cifas’s Databases
- Analyse and understand our members, audiences and customers and improve our services
- To protect and keep your personal information accurate
- Using CCTV recording equipment in and around our premises for security purposes
Special categories of personal information
Data protection law recognises certain “special categories” of personal information, which include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning a person’s sex life or sexual orientation.
These special categories are considered particularly sensitive and so we will only collect and use this information where you have given us your explicit consent. For example, you may choose to tell us about your health condition before attending one of our events and we will only use this information for the particular event and not for any other purpose.
Lawful bases for processing your personal information
Our legal basis for collecting and processing your personal information depends on the type of personal information and how we use it. There are 6 lawful bases:
- Consent – acquiring your agreement for us to process personal data for a precise purpose. You can withdraw consent for the storage and processing of data at any time (email@example.com)
- Public task – something we’re required to do as a public charity for example maintaining and enhancing the BFI National Archive
- Legitimate interests – where we have a legitimate interest that isn’t overridden by your fundamental rights and freedoms for example something we think you’d be happy for us to do like contact you when you have actively shown an interest in our activities or services
- Contract – fulfilment of a contract e.g. subscribing to BFI Player or becoming a BFI member
- Legal obligation – where we have to use data as prescribed by law
- Vital interests – protecting your health and personal safety
Sharing of personal data
We only share your personal data with third parties where we have a legal basis for doing so, such as with your consent or the fulfilment of a contract. For example, to invite you to an event and administer payments. We will never sell your personal information.
Transfers Outside of the European Economic Area (the “EEA”)
Where we transfer personal information outside of the EEA for processing this is done in accordance with all applicable laws with third parties we trust. This is only to the USA where lots of companies’ servers are located. The USA has weaker data protection laws than that of the EEA therefore we will ensure that only organisations that are part of the EU privacy shield initiative will handle your personal information. More details of this certification can be found at www.privacyshield.gov/welcome.
Retention Policies and Periods
We only keep your personal information for as long as is necessary for the purpose for which it was collected. This depends on the personal information and the purpose for which it is processed. For precise information relating to the periods relating to each category of personal data, please contact firstname.lastname@example.org. If you ask us to stop sending direct marketing communications to you, we will keep the minimum amount of information (e.g. name, address and email address) to ensure we adhere to such requests.
We use administrative, physical, managerial and technical measures to safeguard your personal information against loss, theft and unauthorised use.
The BFI will utilise your personal information to administer your relationship with the BFI. We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you. We may make use of additional information about you, such as geo-demographic information and measures of capacity and propensity for giving from sites such as Companies House. This helps us understand the background of the people who support us so we can contact you in the most appropriate way, with the most relevant information; and helps us to make appropriate requests for gifts in line with our ethical policies. To change how we contact you or process your personal information (including if you would like us to stop doing so), simply email email@example.com.
Your Rights in Personal Information
Your personal information is your data and you are in control of it. Where you have an account with us, you can access it and amend the data we hold and the marketing you wish to receive.
You can ask us to provide you with all the information that we hold about you, how we use it and why, utilising your right to be informed and your right to access. Contact firstname.lastname@example.org.
You can then ask us to do the following with the personal information we hold about you:
- If it is incorrect, you can ask for it to be updated – your right to rectification
- Restrict or object to it being processed at all or in a specific way — your right to restrict, right to object and right related to automated decision making
- Ask for it to be deleted — your right to erasure, sometimes called the right to be forgotten
- Ask for a digital copy of it – your right to digital portability
Many of the rights listed above are limited to certain defined circumstances and we may not always be able to comply with your request. We will tell you if this is the case.
For more information on your rights in your personal information, please see the ICO guidance.
Changes to this policy
We will update this policy from time to time in response to changes to legal or regulatory requirements and changes in our activities, services or platforms. The date of the last update will be noted at the bottom of this policy.
Personal Information, sometimes known as Personal Data
Personal data means data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
Data Controller – An individual or an organisation which determines the purposes for which, and the manner in which, any personal data are to be processed
Data Processor – An individual or an organisation who processes personal data on behalf of the Data Controller
Data Processing – Anything you do with data: any operation, collection, recording, organisation, storage, adaption or disclosure of personal information
Data Protection Officer
The BFI’s Data Protection Officer, Richard Brousson (email@example.com), assists the BFI to monitor internal compliance, informs and advises on the BFI’s data protection obligations, and provides a contact point for data subjects and the ICO.
Cookies and Internet Advertising Policy
What are cookies?
Cookies are small data files that are commonly stored on your device when you browse and use websites and online services. They are widely used to make websites work, or to work more efficiently, as well as to provide reporting information and assist with service or advertising personalisation.
What are advertising identifiers?
Advertising identifiers are similar to cookies and are found on many mobile devices and tablets (for example, the “Identifier for Advertisers” (or IDFA) on Apple iOS devices and the “Google Advertising ID” on Android devices), and certain streaming media devices. Like cookies, advertising identifiers are used to make online advertising more relevant.
Types of cookies
First party cookies
These cookies remain on a user’s device for the period of time specified in the cookie. They are activated each time that the user visits the website that created that particular cookie.
These cookies allow website operators to link the actions of a user during a browser session. A browser session starts when a user opens the browser window and finishes when they close the browser window. Session cookies are created temporarily. Once you close the browser, all session cookies are deleted.
These relate to the functionality of our website and allow us to improve the service we offer to you through our website, for example:
- by remembering that you have signed up to view content;
- by allowing you to carry information across pages of our website to avoid you having to re-enter information;
- to allow you to access stored information if you have registered with us;
- by recognising your preferences when you return to our website.
Many websites use Adobe Flash Player to deliver video and game content to their users. Adobe utilise their own cookies, which are not manageable through your browser settings but are used by the Flash Player for similar purposes, such as storing preferences or tracking users. Flash cookies work in a different way to web browser cookies (the cookie types listed above are all set via your browser); rather than having individual cookies for particular jobs, a website is restricted to storing all data in one cookie. You can control how much data can be stored in that cookie but you cannot choose what type of information is allowed to be stored. Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences, and generally improve the user experience. They can also help to ensure that adverts you see online are more relevant to you and your interests.
Strictly necessary cookies
These cookies enable services you have specifically asked for. For those types of cookies that are strictly necessary, no consent is required. These cookies are essential in order to enable you to move around the Website and use its features, such as accessing secure areas of the Website. Without these cookies, services you have asked for, like film rentals, cannot be provided.
Advertising and remarketing cookies
The BFI carries advertising on some pages of our website. Many of the adverts on our website are provided by other organisations. They may set cookies to help understand when and how often these adverts are displayed. The BFI and its partners may also set tracking pixels for ‘remarketing’ or ‘retargeting’. As a result, you may see BFI advertising more frequently on other websites after visiting the BFI website.
You can opt out of cookies or set specific preferences about which types are set through the settings on your web browser.
Visit the Your Online Choices website to find out more about behavioural advertising and how to control browser privacy settings.
Updated April 2019