PRODUCTION COVEN AB
PRIVACY POLICY
PRODUCTION COVEN AB
Contact details: Blåklintsvägen 1, 142 63 Trångsund, Sweden. Attn.: Erin Scolaro
Contact e-mail: erin@productioncoven.com
General
This privacy policy applies to Production Coven AB (“we”, “us”, “Production Coven”) and our processing of personal data of employees or contractors (“you”) in connection with your participation in the production with the tentative title “HÄXAN” (the “Production”). This policy applies to actors and other crew members part of the Production.
Any terms used but not defined herein shall have the meaning given to them in applicable data protection legislation.
Categories of personal data
This section describes which categories of personal data we collect and process about you. In section 3 below, we describe for which purposes and legal bases we process the categories of personal data.
Category: Description:
Contract data Information we need to enter into and fulfil a contract with you. This includes:
Full personal name
Email address
Phone number
Personal identification number
Address
Country
Passport or national ID
Other information we may need to fulfil our contract with you.
Professional data Information regarding your profession as an actor:
Actor name and/or aliases
Image and likeness
Biography and portfolio
Voice, sounds and theatrical and/or cinematic performances
CV
Production data Information relating to your participation in the Production:
Your work activities
Photos, voice, sounds and performances
Clothing size and measurements (for costume)
Financial data Information necessary to calculate and process payments to you:
Bank account number
Payment data
Tax status
Salaries
Benefits
Days/hours on set
Health data Sensitive personal data necessary for insurance and safety purposes and to accommodate food preferences and allergies.
We may collect and process also other data than the ones listed above if necessary in order for us to fulfil the purposes which the data is processed for (for example, if necessary to fulfil our contractual obligations).
Purposes, legal grounds and retention period for processing of personal data
The overall purpose for us processing your personal data is to produce, distribute and commercialise the Production. More specifically, we may process your personal data for the purposes, legal bases and during the retention periods set out below:
Category:
Legal basis:
Purpose:
Retention period
Contract data
Performance of contract
In order to fulfil our contractual obligations relating to your participation in the Production.
During the contract period and until the Production has been finalized and delivered (if after the contract period).
Professional data
Performance of contract
Legitimate interest
Where the processing is based on performance of contract, in order to fulfil our contractual obligations relating to your participation in the Production (regarding e.g. professional requirements, experiences, etc).
Where the processing is based on legitimate interest, our legitimate interests consist of our interests to (i) use your personal data to market the Production and allow third-parties (including distributors) to do the same, and (ii) investigate and handle contract breaches and protecting our rights in connection with any such breaches or claims. In these cases, our interests override your interest that your personal data is not processed for the relevant purposes.
Where the processing is based on performance of contract, during the contract period and until the Production has been finalized and delivered (if after the contract period).
Where the processing is based on our legitimate interest to market and exploit the Production, we may process your personal data for as long as the Production is being sold and broadcasted (up to the lifetime of copyright).
Where the processing is based on our legitimate interest to investigate and handle contract breaches and protect our rights, we may process your personal data for as long as necessary in order to investigate and protect our rights or otherwise until the statute of limitation has expired (up to 10 years).
Production data
Legitimate Interest
Our legitimate interests consist of our interest to (i) make the Production, (ii) market the Production, and (iii) investigate and handle contract breaches and protecting our rights in connection with any such breaches or claims. In these cases, our interests overrides your interest that your personal data is not processed for such purposes.
Where the processing is based on our legitimate interest to make the Production, we may process your personal data during the contract period and until the Production has been finalized and delivered (if after the contract period).
Where the processing is based on our legitimate interest to market the Production, we may process your personal data for as long as the Production is being sold and broadcasted (up to the lifetime of copyright).
Where the processing is based on our legitimate interest to investigate and handle contract breaches and protect our rights, we may process your personal data for as long as necessary in order to investigate and protect our rights or otherwise until the statute of limitation has expired (up to 10 years).
Financial data
Performance of contract
Legal obligation
Legitimate interest
Where the processing is based on performance of contract, in order to fulfil our contractual obligations to make payments to you.
Where the processing is based on legal obligation, in order to fulfil our legal obligations relating to bookkeeping, taxes and employment aspects.
Where the processing is based on legitimate interest, our legitimate interest consists of our interest to investigate and handle contract breaches and protecting our rights in connection with any such breaches or claims, where our interest overrides your interest that your personal data is not processed for this purpose.
Where the processing is based on performance of contract, during the contract period.
Where the processing is based on legal obligation, for as long as necessary in order to fulfil the legal obligation (up to 7 years).
Where the processing is based on our legitimate interest to investigate and handle contract breaches and protect our rights, we may process your personal data for as long as necessary in order to investigate and protect our rights or otherwise until the statute of limitation has expired (up to 10 years).
Health data
Consent
Legal obligation
Where the processing is based on consent, our processing is made in order to maintain and make claims under insurances we keep for the Production, or to accommodate allergies / food preferences when providing food on set.
However, we may also be legally required to have insurances in place for the Production, and where the processing is based on legal obligation, our processing is made in order to fulfil our legal obligations pursuant to applicable employment law or collective bargaining agreements.
Where the processing is made based on consent, during the contract period (or until you withdraw your consent).
Where the processing is based on legal obligation, for as long as we are legally required or otherwise until the statute of limitation has expired (up to 10 years).
Sharing of personal data and purposes for sharing
We may share the following categories of personal data with the recipients and for the purposes set out below:
Recipient:
Categories of Personal data and purposes:
Group companies
We may engage other companies within our company group to undertake any of the processing operations set out in this privacy policy e.g. if such group companies take part in administrating the contract with you or in the Production, or assist with fulfilling legal obligations to maintain insurances or relating to bookkeeping.
All personal data collected by us will be transferred to Witch Fodder, LLC, a Delaware limited liability company (“WFL”), which is the owner of the Production and will act as a separate data controller for your personal data.
IT support provider
In case we engage a third-party IT support provider, we may need to share all categories of your personal data in order for the IT support provider to provide IT maintenance, maintain IT functionality and/or for IT service development (as relevant). We will not share more data than necessary with such IT support provider.
Financial service provider
We usually engage third-party financial service providers in order to facilitate invoicing and payments in our business. We may in such case share your contract data and financial data with such third-party financial service providers.
Distributor, broadcasters, licensees and other users of the Production
We engage third parties to distribute the Production, and the Production may be broadcasted and exploited by licensees across all media throughout the world in perpetuity. In order for us to fulfil our contract with you and to conduct our business, may share your professional data and production data with such distributors and users in order for them to distribute, market, broadcast, transmit, make available, use and exploit the Production.
Insurance company
We may share your health data with the applicable insurance company as required in order for us to maintain and make claims under the insurance.
Food service provider
We may share information about allergies or food preferences (health data) to food service providers to be able to accommodate allergies or preferences when providing food during your work on the Production.
Other marketing partners
We may share your professional data and production data with ours and our licensees/assigns’ marketing partners for the purpose of sending marketing regarding you and/or the Production as required pursuant to our contract with you or to conduct our business.
Re-structuring partner
If we undergo a re-structuring of our company structure, we may need to disclose any and all your personal data to a third-party company or re-structuring partner.
Potential buyer of the business
If we are subject to a company or asset transfer, we may disclose all your personal data to any potential buyers of the company or the company’s assets.
Public authorities
In case we are legally obliged or need to disclose any information in order to enforce or apply our agreements or to protect our rights, or if otherwise required pursuant to an order by a competent court or authority, we may share all your personal data (depending on the matter at hand) with such competent authorities or courts. This includes e.g. taxing authorities and company registration authorities.
Sharing of personal data outside of the European Economic Area
Sharing of your personal data as described in this privacy policy can involve transferring your personal data to an entity or third party outside the European Economic Area (EEA). This will primarily regard when we share personal data with a distributor, IT service provider and/or an insurance company (if these are based outside of the EEA), and when we share personal data with WFL which is based in the US. [Such transfer will be subject to the SCC].
When we share your personal data with a party outside of the EEA, we will take reasonable measures to ensure that your Personal Data is protected to the same level as within the EEA as far as possible. This includes using the standard contractual clauses, approved by the European Commission, especially designed to give your personal data the same protection outside of the EEA as inside of the EEA. Additionally, we always use such safeguards and adhere to such requirements of data safety as required by local law.
You may have the right to request a copy of the safeguards we use to protect your personal data. Please contact us at erin@productioncoven.com for any questions regarding this.
How we store your Personal Data and for how long
We will store your personal data in a secure and safe manner. The personal data will only be accessible to our employees to the extent the access is strictly necessary. No third parties will access your personal data apart from the third parties and for the purposes described under Sections 4–5 above. We will take all reasonable measures to ensure that your personal data is protected from loss, alteration, unauthorized disclosure, unauthorized access or similar threats.
We will only store your personal data for as long as it is strictly necessary and relevant for the purposes as described in Section 3 above. We will delete your personal data when it no longer needs to be processed or stored.
Your privacy rights
Under the GDPR, you may have the following rights relating our processing of your personal data:
Right: Description:
Access You have the right to know whether we process your personal data. If we do, you also have the right to request access to all personal data and relevant information relating to your personal data from us. You can read more about your right of access on the Swedish Authority for Privacy Protection’s website here.
Rectification If you believe the personal data we store about you is incorrect, you have the right to ask us to correct the personal data. You can read more about your right to rectification on the Swedish Authority for Privacy Protection’s website here.
Erasure You have the right to request that we erase all your personal data permanently, also known as the right to be forgotten. You can read more about your right to erasure on the Swedish Authority for Privacy Protection’s website here.
Restrict processing You have the right to limit what types of processing measures we take with your personal data in certain situations. This however means that we are allowed to continue to store your data, but you may ask us to stop all other processing of your personal data. This right can be exercised for example in connection with a request to correct incorrect personal data, so that the incorrect personal data is not used until it has been corrected. You can read more about your right to restrict/limit processing on the Swedish Authority for Privacy Protection’s website here.
Data portability You have the right to request that we send all your personal data, that we have access to, to you or directly to another data controller. You can read more about your right to data portability on the Swedish Authority for Privacy Protection’s website here.
Objection You have the right to object to any processing of your personal data, even when we have a legitimate legal reason to process it. When we process your personal data on the basis of our legitimate interest, you can object to the processing if you believe your interest of privacy outweighs our interest for processing. In case you object to any direct marketing reasons for processing, we will always adhere to your objection. You can read more about your right to object on the Swedish Authority for Privacy Protection’s website here.
Withdrawal of consent When we process your personal data on the basis of your consent, you have the right to at any time withdraw your consent. After the withdrawal, we may not process that personal data for such purpose. Please note that your withdrawal of consent does not affect the processing made prior to your withdrawal. You can read more about your right to withdraw your consent in art. 7 of the GDPR here.
Submit complaints If you are unhappy with our processing of your personal data, you have the right to submit a complaint to the relevant supervisory authority (in Sweden, this is the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten)). You can read more about your right to submit complaints on the Swedish Authority for Privacy Protection’s website here.
We will not use your personal data for automated decision-making or profiling.
If you would like to exercise any of the above rights, please see our contact information under Section 8.2. Please note that you may not have the right to exercise all of the rights as listed above in Section 7.
Changes to this policy and contact information
We may update this privacy policy at our own discretion. Any updates will be made available in this privacy policy before the changes enter into effect. You can always find the latest version of the privacy policy on our website at https://www.productioncoven.com/privacy-policy.
If you have any questions regarding this privacy policy or how we process your personal data, please send us an e-mail at erin@productioncoven.com.