BFI privacy policy

Your rights and how we use personal information.

The British Film Institute (the “BFI”, “we”) is a registered charity (number 287780), Royal Charter Body, National Lottery distributor and non-departmental public body funded by the department of Digital, Culture, Media and Sport.

The BFI is committed to respecting and protecting your personal information.

This policy seeks to inform you about:

how and why we collect, process and store your personal information
your Rights

This policy applies to all the BFI’s activities, services, products and platforms.

The BFI is the Data Controller and Richard Brousson is the Data Protection Officer under the UK’s Data Protection Act 2018 and the EU’s General Data Protection Regulation 2016.

All questions and complaints about the BFI’s use and handling of personal information should be addressed to [email protected].

You also have the right of complaint to the UK’s Supervisory Authority for Data – the Information Commissioners Office (the “ICO”). See ico.org.uk/make-a-complaint.

Information about personal data relating to volunteering, working for or applying to work for the BFI can be found here: BFI Privacy Notice: Workforce and Recruitment

Information we may collect about you

We may collect and process the following information about you:

Information you give us

Your prefix and name, billing and delivery address, postcode, email address, phone numbers, gender, date of birth, diversity monitoring information (anonymously unless stated otherwise), job title, personal identification documents, data relating to access or dietary requirements, payment card information
If you are making a grant application – your position within the company applying and relevant experience
If you are a student – your course details, relevant experience, school, college or university
You may provide us with this information when you set up an account (e.g. BFI Player, membership), apply for a grant (BFI Film Fund), apply for a course (BFI Education), apply to the BFI’s certification unit, buy tickets (BFI Southbank, BFI IMAX, BFI Festivals), fill in a form (competitions and surveys), complete an application form or otherwise apply for a job here either directly or via a third party, apply to volunteer, or correspond with us by phone, email or in writing

Information we collect automatically

Device IDs, IP addresses and other unique identifiers
Your activity on our services and platforms such as title selections and browsing history
Advertising identifiers, such as those on mobile devices, tablets and streaming media devices and information collected by cookies (please see our Cookies and internet advertising policy below)

Information we collect about you from other sources

Service providers that help us determine a location based on your IP address
Select partners that make our services available on their platform or with whom we offer co-branded services or engage in joint marketing
Publicly available information such as geo-demographic information and measures of capacity and propensity for giving to help us fundraise effectively and in line with our ethical policies from sites such as Companies House
Social media – depending on your settings you may have given us permission to access your personal information held by companies such as Facebook and Twitter

Third parties may collect information about you

When using our websites and platforms third parties may collect information about you. This can be controlled by adjusting the settings in your internet browsers. There is more detail about adjusting your browser settings on the Information Commissioner’s Office website.

Why we collect and process your personal information

We use your personal data for the following purposes:

Carrying out research in the public interest
Maintaining, preserving and enhancing the BFI National Archive
Providing you with customer service when you visit, make use of or access any of the BFI premises, services or platforms
To administer any of your accounts, applications, contracts, enquiries or complaints
To process payments
Fulfil ticket, product, donation and membership requests
Contacting you
Providing you with information about things we think may interest you
To prevent, detect and investigate illegal activity such as fraud. The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. For further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, see Fair Processing Notices for Cifas’s Databases
Analyse and understand our members, audiences and customers and improve our services
To protect and keep your personal information accurate
Using CCTV recording equipment in and around our premises for security purposes

Special categories of personal information

Data protection law recognises certain “special categories” of personal information, which include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning a person’s sex life or sexual orientation.

These special categories are considered particularly sensitive and so we will only collect and use this information where you have given us your explicit consent. For example, you may choose to tell us about your health condition before attending one of our events and we will only use this information for the particular event and not for any other purpose.

Lawful bases for processing your personal information

Our legal basis for collecting and processing your personal information depends on the type of personal information and how we use it. There are 6 lawful bases:

Consent – acquiring your agreement for us to process personal data for a precise purpose. You can withdraw consent for the storage and processing of data at any time ([email protected])
Public task – something we’re required to do as a public charity for example maintaining and enhancing the BFI National Archive
Legitimate interests – where we have a legitimate interest that isn’t overridden by your fundamental rights and freedoms for example something we think you’d be happy for us to do like contact you when you have actively shown an interest in our activities or services
Contract – fulfilment of a contract e.g. subscribing to BFI Player or becoming a BFI member
Legal obligation – where we have to use data as prescribed by law
Vital interests – protecting your health and personal safety

Sharing of personal data

We only share your personal data with third parties where we have a legal basis for doing so, such as with your consent or the fulfilment of a contract. For example, to invite you to an event and administer payments. We will never sell your personal information.

Transfers Outside of the European Economic Area (the “EEA”)

Where we transfer personal information outside of the EEA for processing this is carried out in accordance with all applicable laws and with third parties we trust.

Retention Policies and Periods

We only keep your personal information for as long as is necessary for the purpose for which it was collected. This depends on the personal information and the purpose for which it is processed. For precise information relating to the periods relating to each category of personal data, please contact [email protected]. If you ask us to stop sending direct marketing communications to you, we will keep the minimum amount of information (e.g. name, address and email address) to ensure we adhere to such requests.

Security

We use administrative, physical, managerial and technical measures to safeguard your personal information against loss, theft and unauthorised use.

Fundraising

The BFI will utilise your personal information to administer your relationship with the BFI. We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you. We may make use of additional information about you, such as geo-demographic information and measures of capacity and propensity for giving from sites such as Companies House. This helps us understand the background of the people who support us so we can contact you in the most appropriate way, with the most relevant information; and helps us to make appropriate requests for gifts in line with our ethical policies. To change how we contact you or process your personal information (including if you would like us to stop doing so), simply email [email protected].

Your Rights in Personal Information

Your personal information is your data and you are in control of it. Where you have an account with us, you can access it and amend the data we hold and the marketing you wish to receive.

You can ask us to provide you with all the information that we hold about you, how we use it and why, utilising your right to be informed and your right to access. Contact [email protected].

You can then ask us to do the following with the personal information we hold about you:

If it is incorrect, you can ask for it to be updated – your right to rectification
Restrict or object to it being processed at all or in a specific way — your right to restrict, right to object and right related to automated decision making
Ask for it to be deleted — your right to erasure, sometimes called the right to be forgotten
Ask for a digital copy of it – your right to digital portability

Many of the rights listed above are limited to certain defined circumstances and we may not always be able to comply with your request. We will tell you if this is the case.

For more information on your rights in your personal information, please see the ICO guidance.

Changes to this policy

We will update this policy from time to time in response to changes to legal or regulatory requirements and changes in our activities, services or platforms. The date of the last update will be noted at the bottom of this policy.

Definitions

Personal Information, sometimes known as Personal Data

Personal data means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

Data Controller

Data Controller – An individual or an organisation which determines the purposes for which, and the manner in which, any personal data are to be processed

Data Processor

Data Processor – An individual or an organisation who processes personal data on behalf of the Data Controller

Data Processing

Data Processing – Anything you do with data: any operation, collection, recording, organisation, storage, adaption or disclosure of personal information

Data Protection Officer

The BFI’s Data Protection Officer, Richard Brousson ([email protected]), assists the BFI to monitor internal compliance, informs and advises on the BFI’s data protection obligations, and provides a contact point for data subjects and the ICO.

What are advertising identifiers?

Advertising identifiers are similar to cookies and are found on many mobile devices and tablets (for example, the “Identifier for Advertisers” (or IDFA) on Apple iOS devices and the “Google Advertising ID” on Android devices), and certain streaming media devices. Like cookies, advertising identifiers are used to make online advertising more relevant.

Cookies and Internet Advertising Policy

The BFI and approved third parties use cookies and other technologies, as well as advertising identifiers:

to make it easy to access our services by remembering you when you return
to provide and analyse our services
to learn more about you and your likely interests, and to deliver and tailor marketing or advertising that may be more relevant to you

We want you to be informed about our use of these technologies. To find out more about the types of technologies we use, what they do and your choices regarding their use, please visit our Cookies policy page