Privacy Policy

Introduc)on

We are Arwen and Co Management Ltd (“we” or “us”), a company registered in England and Wales. Our company registraion number is 14208430 and our registered office is at Marlbridge House, Enterprise Way, Edenbridge, England, TN8 6HF.

This privacy policy sets out the basis on which we collect, use and disclose your personal data. Please read this policy carefully alongside any applicable Terms & Condi)ons to understand our views and pracIces regarding your personal data and how we will treat it.

Our responsibilities

For the purpose of the applicable Data Protection Legislation Act 2018, we control of any personal data we process. We are responsible for ensuring our systems, processes, suppliers and people comply with Data Protection Legislation in relaIon to the personal data we handle.

We require our people to comply with this privacy policy and our Data Protection Policy when dealing with personal data. We have a Data Protection Manager who is responsible for overseeing and enforcing the compliance of our business and people with the Data Protection Legislation, and for ensuring our people receive regular compliance training.

We take personal data breaches very seriously, and are required to notify the Information Commissioner’s Office in the event of such a breach.

When using, collectng and disclosing personal data, we follow the key data protecIon principles.

We have policies, procedures and records to demonstrate compliance with the principles, as further detailed in our Data Protection Policy.

How we collect, use and disclose your personal data
1. 3.1.Models & Talents (including potential models & talents): we collect your name, address, email address, DOB, body measurements, contact number, images/photographs and any other information that you might share in our model application via email at the agency. Your data will be destroyed if you are unsuccessful in your application. If you are successful, please refer to your Agency Agreement.
2. Clients: Your name, business information, identification documentation and payment details will be collected for relationship management and ﬁle opening is collected from you directly and further information (e.g. to verify your identify) may be collected from third parties, such as publicly available sources. When you contact us via email or telephone, we may collect any personal data you provide to us. All additional personal data is collected when supplied to us, or created by us in connection. We shall only transfer personal data to third party which is limited to the relevant purpose and it is adequate protected.
3. People: Your name, address, contact details, education and employment history, background checks (ﬁnancial and criminal), identification documentation, right to work status, information relating to next of kin/ dependants, and ﬁnancial information including bank details and identiﬁers (e.g. National Insurance numbers). We may also process sensitive personal data such as health details, racial origin, religious beliefs and informaIon about offences/ alleged offences. Your personal data will be collected from various sources including, your application form/CV, providers of background checks, notes and records kept for the duration of your employment (including absences, appraisals, disciplinary action), providers of occupation health services. Your personal data will be used for the following purposes of human resources administraIon, assessing suitability/eligibility and/or ﬁtness to work, security; and training.
Your rights

Personal data must be processed in line with an individual’s rights, including the right to: 5.1- Request a copy of their personal data;

1. 5.2.- Request that their inaccurate personal data is corrected;
2. 5.3.- Request that their personal data is deleted and destroyed when causing damage or distress; and
3. 5.4.- Opt out of receiving electronic communicaIons from us.

Should you wish to make a request in line with your rights as an individual, please forward it to Arwen and Co Management using the contact details provided at the end of this privacy policy.

Our People must notify or inform Arwen and Co Management immediately if they receive a request in relation to personal data which the ﬁrm processes.

The Data Protection Legislation gives you the right to access information held about you. Your right of access can be exercised in accordance with the Data Protection Legislation (as applicable).

Security

Information security is a key element of data protection. We take appropriate measures to secure personal data and protect it from loss or unauthorised disclosure or damage. Our policy and approach to informaIon security is contained within our Data ProtecIon Policy.

Our website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our Website.

Changes to our privacy policy

Any changes we may make to this privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

Contacts and complaints

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed by writing to us at info@arwenandco.com.

You should direct all complaints relaIng to how the ﬁrm has processed your personal data to Arwen and Co Management.

Our People must inform Arwen and Co Management immediately if they receive a complaint relating to how we have processed personal data so our complaints procedure can be followed.

APPENDIX

Clients: any person, business or other organisation who engages, or is looking to engage, the services of our Talent.

Controller: a personal/organisation who determines the purpose for which, and the way, any personal data is processed.

Data Protection Policy: our internal data protecIon policy which sets out how we keep personal data secure, including technical measures (e.g. encryption of personal data, restricted access to personal data, monitoring and testIng systems for unauthorised access, backups of personal data), roles and responsibilities of individuals and the scope of protection.

People: all people providing services to or working for us, including but not limited to our employees, directors, members, and contractors.

Personal data: information (including opinions) which relates to an individual and from which he or she can be identified either directly or indirectly through other data which we have or are likely to have in our possession. These individuals are someImes referred to as data subjects.

Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed by an organisation electronically. A personal data breach may mean someone outside the organisation gets unauthorised access to personal data, but a breach can occur if there is unauthorised access within the organisation or if an employee accidentally alters or deletes personal data.

Principles: the core data protection principles underlying the Data Protection Legislation, which specify personal data should be: processed lawfully, fairly and in a transparent manner; collected for speciﬁed, explicit and legiImate purposes; adequate, relevant and limited to what is necessary; accurate and, where necessary, kept up to date; kept for no longer than is necessary; processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Additionally, organisations must adhere to the principal of accountability.

Process: the ‘processing’ of personal data captures a wide range of acIviIes, and includes obtaining, recording and holding personal data and performing any operaIon of the personal data (including erasure/destruction).

Processor: any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

Purpose: the purposes identifed in the “Purpose” column of the tables in section 3 of this privacy policy (How we collect, use and disclose your personal data), as applicable.

Talent: models and/or other talent who have engaged, or are looking to engage, our modelling and/or talent agency services and are or are considering being, represented by us.

Terms and Conditions

Third party: a person, organisation or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.