Privacy Policy
1. Introduction
dmb digital ltd (“dmb digital”, “we”, “us”, “our”) is committed to protecting the privacy and security of anyone who uses our client asset portal (the “Portal”). This Privacy Policy explains what personal data we collect through the Portal, why we collect it, how we use and protect it, and what rights you have in relation to it.
This Policy applies specifically to the Portal, which allows clients to register for an account, log in, and upload, view, and manage digital assets (such as photos, video, and related files) shared with us for the purposes of our work together. It should be read alongside any separate notice covering our main website, if applicable.
This Policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who we are (the data controller)
dmb digital ltd is the data controller responsible for your personal data collected via the Portal.
Company: dmb digital ltd
Contact email: hello@dmbfilms.co.uk
If you have any questions about this Policy or how we handle your personal data, please contact us using the details above.
3. What personal data we collect
When you register for and use the Portal, we may collect the following categories of personal data:
- Account and identity data: name, username, email address, and password (stored in encrypted/hashed form).
- Contact data: email address, and if provided, phone number or postal address.
- Login and usage data: login timestamps, IP address, and records of activity within the Portal (e.g. uploads, downloads, form submissions).
- Content and asset data: photos, videos, documents, and any other files you upload to the Portal, together with associated metadata (e.g. file names, upload dates, embedded EXIF/location data if present in files).
- Form submission data: any information you provide when submitting an upload form, such as project or job references, captions, or notes.
- AI-generated descriptions: automatically generated caption/description text produced by an AI tool based on the visible content of images you upload (see Section 6).
- Technical data: browser type and version, device information, and cookie identifiers (see Section 7).
We do not knowingly collect special category data (such as health, racial/ethnic origin, or biometric data) through the Portal. Please avoid including such information in file names, captions, or notes unless it is directly necessary for the project and you have a lawful basis to share it with us.
4. How we collect your data
- Directly from you, when you create an account, log in, or submit an upload form on the Portal.
- Automatically, through cookies and similar technologies as you use the Portal (see Section 7).
- From the files you upload, which may contain embedded metadata.
5. How we use your personal data and our legal basis
We use your personal data for the following purposes:
| Purpose | Data used | Legal basis (UK GDPR) |
| Creating and managing your Portal account, and authenticating your login | Account/identity data, login data | Performance of a contract (Art. 6(1)(b)) |
| Receiving, storing, and organising the assets you upload | Content/asset data, form submission data | Performance of a contract (Art. 6(1)(b)) |
| Communicating with you about your account, uploads, or projects | Contact data | Performance of a contract; legitimate interests (Art. 6(1)(b) and (f)) |
| Maintaining the security of the Portal, preventing fraud or misuse, and troubleshooting | Login/usage data, technical data | Legitimate interests (Art. 6(1)(f)) |
| Complying with our legal and regulatory obligations | Account data, records of activity | Legal obligation (Art. 6(1)(c)) |
| Automatically generating descriptive captions for uploaded images using AI (see Section 6) | Content/asset data (image content) | Legitimate interests (Art. 6(1)(f)) |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. We do not sell your personal data.
6. Cookies and similar technologies
The Portal uses cookies and similar technologies that are strictly necessary for it to function, such as cookies that keep you logged in and remember your session. We may also use cookies to understand how the Portal is used so we can improve it. Where we use any non-essential cookies, we will ask for your consent in line with the Privacy and Electronic Communications Regulations (PECR).
You can control or delete cookies through your browser settings; however, disabling essential cookies may prevent the Portal from working correctly.
7. Who we share your data with
We do not sell or rent your personal data. We may share personal data with the following categories of third parties, who process it on our behalf or as joint/independent controllers where relevant:
- Website hosting provider: the Portal is hosted by our web hosting provider, who stores data on our behalf on secure servers.
- Form and upload processing: we use third-party software to manage upload forms and submissions on the Portal.
- AI processing: we use Claude, provided by Anthropic, to automatically generate descriptive captions for uploaded images (see Section 6).
- IT and technical support providers, where needed to maintain or troubleshoot the Portal.
- Professional advisers (e.g. accountants, lawyers) and regulators or law enforcement, where required by law.
We require all third parties who process personal data on our behalf to respect the security of your data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.
8. How long we keep your data
We retain personal data and uploaded assets for as long as necessary to fulfil the purposes for which they were collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.
- Account data is retained for as long as your account remains active, and for a reasonable period afterwards in case you wish to reactivate it or raise a query.
- Uploaded assets are retained for the duration of the relevant project and any agreed archive period, after which they are deleted or anonymised unless we are required or agree to retain them for longer.
- Records required for legal, tax, or accounting purposes are retained for the periods required by law (typically up to 6 years).
If you close your account or ask us to delete your data, we will do so within a reasonable period, except where we are legally required or entitled to retain it.
9. How we protect your data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include access controls and authentication on the Portal, encrypted storage of passwords, secure hosting, and limiting access to personal data to those who need it. While we take reasonable steps to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to ask us to correct inaccurate or incomplete data.
- Right to erasure — to ask us to delete your personal data in certain circumstances.
- Right to restrict processing — to ask us to limit how we use your data in certain circumstances.
- Right to data portability — to receive certain data in a structured, commonly used format, or ask us to transfer it to another organisation.
- Right to object — to object to our processing of your data based on legitimate interests, including the use of AI to generate image descriptions (see Section 6).
- Right to withdraw consent — where we rely on your consent (e.g. for non-essential cookies), you can withdraw it at any time.
To exercise any of these rights, please contact us at hello@dmbfilms.co.uk. We will respond within one month, in line with UK GDPR requirements. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or by calling 0303 123 1113, though we would welcome the chance to address your concerns directly first.
11. Children’s privacy
The Portal is intended for use by our adult clients and contacts, and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
12. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will post any updates on the Portal and update the “Last updated” date at the top of this Policy. We encourage you to review this Policy periodically.
13. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
dmb digital ltd
Email: hello@dmbfilms.co.uk