Series One Studios

Series One Studios Limited

Company Number: 17315046

Registered Address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ

Information Commissioner's Office (ICO) Registration Reference: ZC235648.

Privacy Policy

Last Updated 3 November 2026

Series One Studios Limited ("we", "us", "our") is the "controller" of the personal data described in this policy. That means we decide how and why it is used. You can contact us at hello@seriesonestudios.com.

This policy explains what personal data we collect when you visit our website, book a session, buy a gift card, take part in our referral scheme, join our mailing list or otherwise deal with us, and what we do with it. It should be read with our Terms & Conditions at https://www.seriesonestudios.com/tcs/.

What personal data we collect

When you make an enquiry or booking

• Your name, email address, phone number and any details you give us about your session (for example, your acting credits or the material for a self tape).
• Your booking details and payment records. Card payments are handled by Stripe, and we do not store full card numbers.

During and after your session

• Photographs and video of you taken in the session, including raw files, your image selections, requested amendments and the final retouched images.
• Self tape recordings and any scripts or sides you give us.
• Notes about your session and any messages between us.

Gift cards

• If you buy a gift card: your name, email address, payment record and, where you give it to us, the recipient's name and email address.
• If you use a gift card: the code and your booking details.

Referral scheme

• If you take part as a referrer: your name, your referral code, the number of qualifying referrals and, when a reward is due, your bank details so we can pay you.
• If you book using a referral code: your booking details and the code you used. We do not tell the referrer who you are. We only confirm to them that a qualifying referral has been made.

Marketing and social media

• Your name and email address if you join our mailing list, and your preferences.
• Messages, comments or tags if you contact or tag us on Instagram, TikTok or other platforms.

When you use our website

• Technical information such as your IP address, browser, device and the pages you visit. This is collected through cookies and similar technologies. See Cookies section below.

We do not knowingly collect any special category data (such as health or ethnicity data) unless you give it to us yourself, for example in a message. If you do, we use it only for the purpose you gave it for.

How and why we use your personal data

The law requires us to have a lawful basis for using your personal data. We rely on the following:

• Taking and managing your booking or gift card, taking payment, running your session, and delivering your images or self tape: contract. We need this to provide the service you ask for.
• Replying to your enquiries and sending service messages about your booking: contract, or our legitimate interests in running our business.
• Keeping raw files for 2 years, and keeping final images and self tapes in our archive: our legitimate interests in running the business and handling queries, reshoots and disputes.
• Using images or footage from your session to promote our work on our website, social media and in advertising: your consent, which you give when you book. You can withdraw it at any time.
• Running the referral scheme, including paying rewards: contract with you under the scheme terms, and our legitimate interests in preventing misuse.
• Sending you marketing emails: your consent, or, if you are an existing client, our legitimate interests under the "soft opt-in" rules. You can unsubscribe at any time.
• Keeping accounting and tax records: legal obligation.
• Protecting our business, preventing fraud and dealing with legal claims: our legitimate interests, or legal obligation.

We do not make decisions about you using automated processing or profiling that have a legal or similarly significant effect on you.

Who we share your personal data with

We do not sell your personal data. We share it only with:

• Service providers who help us run our business: Pixieset (website, booking, online gallery and mailing list), Google Workspace (email, file storage and mailing list), Stripe (card payments), Google Analytics (website analytics), Meta (our Facebook and Instagram pages and messages, through Meta Business Suite), Linktree (our link-in-bio page), and our accountant or bookkeeper. Some of these act on our instructions. Others, such as Google Analytics and Meta, also use data for their own purposes under their own privacy policies.
• Social media platforms, where you have agreed to us publishing images or footage of you, or where you have tagged us.
• Professional advisers such as lawyers and insurers, where needed.
• Authorities and regulators, where the law requires it or to protect our rights.
• A buyer or successor, if our business is ever sold, subject to this policy.

When you receive final images, you may share them with others as our terms allow. What you do with them is your responsibility.

Transfers outside the UK

Some of our third-party service providers are based outside the UK or process personal data in other countries (predominantly the United States, Canada, and Australia).

Whenever your personal data is transferred outside the UK, we ensure that a similar degree of protection is afforded to it by relying on at least one of the lawful transfer safeguards recognised under the UK GDPR:

• UK Adequacy Regulations: Transfers to jurisdictions officially recognized by the UK Government as providing an adequate level of data protection (such as Canada and the European Economic Area).
• The UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework): Transfers to US organisations actively certified under the UK-approved Data Privacy Framework.
• Standard Contractual Safeguards: Transfers governed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs), accompanied by appropriate technical and organisational security measures.

The specific processing locations and lawful transfer safeguards for each of our primary service providers are set out below:

• Pixieset (Pixieset Internet Services Inc.)
• Purpose: Website hosting, booking platform, client communications, and online delivery galleries.
• Processing Location: Canada and the United States.
• Lawful Safeguard: Data processed in Canada is protected under UK adequacy regulations for commercial entities. For processing on US servers, Pixieset relies on Standard Contractual Clauses (SCCs) incorporating the UK Addendum / International Data Transfer Agreement (IDTA).
• Google (Google LLC / Google Ireland Limited) – Workspace & Google Analytics
• Purpose: Business email hosting, cloud file storage, document management, and website traffic analytics.
• Processing Location: United States and globally distributed data centres.
• Lawful Safeguard: Certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), alongside the UK Addendum to standard contractual clauses.
• Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.)
• Purpose: Secure card payment handling, transaction records, and billing receipts.
• Processing Location: Ireland and the United States.
• Lawful Safeguard: Certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) and supported by Stripe’s approved Binding Corporate Rules (BCRs) and the UK Addendum to SCCs.
• Meta Platforms (Meta Platforms Ireland Limited / Meta Platforms, Inc.)
• Purpose: Managing Facebook, Instagram, and direct messaging via Meta Business Suite.
• Processing Location: Ireland and the United States.
• Lawful Safeguard: Certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), supported by the UK Addendum to standard contractual clauses.
• Linktree (Bolster Labs, Inc. / Linktree Pty Ltd)
• Purpose: Link-in-bio landing page navigation.
• Processing Location: Australia and the United States.
• Lawful Safeguard: Standard Contractual Clauses (SCCs) incorporating the UK Addendum / IDTA under their Data Processing Addendum (DPA).

If you would like a copy of the specific transfer mechanism or documentation covering any of these providers, you can request it by emailing us at hello@seriesonestudios.com.m.

How long we keep your personal data

• Booking, payment, gift card and referral reward records: 6 years from the end of the financial year, for tax and accounting purposes.
• Raw (unedited) image files: 2 years from the session date, after which we may delete them. You can ask us to delete them sooner in writing.
• Final edited images: kept in our archive and for portfolio and business purposes, unless you ask us to delete them and we have no good reason to keep them.
• Self tape recordings: 2 years from the session date, after which we may delete them.
• Enquiries that do not lead to a booking: 12 months from your last message to us.
• Mailing list details: until you unsubscribe.
• Website and cookie data: depends on the cookie. See cookie policy below.

We may keep some information for longer where the law requires it or where we need it to deal with a legal claim.

Your rights

You have the following rights over your personal data:

• Access: to ask for a copy of the personal data we hold about you.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to ask us to delete your data in certain circumstances.
• Restriction: to ask us to limit how we use your data in certain circumstances.
• Portability: to receive certain data you gave us in a portable format, or ask us to send it to someone else.
• Objection: to object to us using your data on the basis of our legitimate interests, and to object to direct marketing at any time.
• Withdrawing consent: where we rely on your consent (for example, to use your session images to promote our work, or to send marketing emails), you can withdraw it at any time. This does not affect anything we did before you withdrew. We will stop further use as soon as reasonably practicable, but we cannot recall material that has already been published or distributed.

To use any of these rights, email hello@seriesonestudios.com. We may need to check your identity first. There is no charge, and we will reply within one month. If your request is complex, we may take up to two further months and will tell you if so.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first by emailing hello@seriesonestudios.com or writing to us at our registered address. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

You do not have to complain to us first, but we would welcome the chance to put things right.

Cookies

Our website is built on Pixieset and uses cookies and similar technologies to make the site work, remember your preferences and help us understand how visitors use it. Pixieset explains the cookies it uses at https://pixieset.com/cookies/.

We also use Google Analytics to see how visitors use our website, such as which pages they view and how they found us. You can opt out of Google Analytics by installing Google's browser add-on. We use Meta Business Suite to manage our Facebook and Instagram pages and messages, and Linktree for our link-in-bio page. These services may set their own cookies and collect information under their own privacy policies.

You can control cookies through your browser settings. Blocking some cookies may affect how the website works.

Keeping your data secure

We use appropriate technical and organisational measures to protect your personal data, including password-protected accounts, access limited to those who need it and reputable service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your rights, we will tell you and the ICO where the law requires it.

Children

Our services are for clients aged 18 and over. Sessions for anyone under 18 are by separate arrangement, with a parent or guardian involved. Our website is not aimed at children, and we do not knowingly collect their data without a parent's or guardian's agreement.

Links to other websites

Our website may link to other sites, such as our social media pages. We are not responsible for their privacy practices, so please read their policies.

Changes to this policy

We may update this policy from time to time. The current version will always be on our website, with the date it was last updated at the top. If we make an important change, we will tell you where we reasonably can.

Contact us

Series One Studios Limited 71-75 Shelton Street, Covent Garden, London WC2H 9JQ hello@seriesonestudios.com