Who we are

This policy explains how DevilBoy Productions, a video production company based in London, uses personal information. We are the controller of the personal information described here, which means we decide how and why it is used.

For anything about privacy or your personal information, email us at [email protected].

We have written this policy to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), which cover cookies and similar technologies.

The short version

We only collect what we need to answer enquiries, make films and run the business.
We do not sell personal information.
We don’t send marketing emails or newsletters.
This website sets no cookies of its own. We use privacy-friendly analytics that don’t use cookies, currently Cloudflare Web Analytics, and no advertising tracking.
You can ask to see, correct or delete your information at any time.

What we collect, why, and our lawful basis

UK data protection law says we must have a lawful basis for each use of personal information. The ones we rely on are: contract (we need it to agree or carry out a contract with you, or to take steps you ask for before one), legitimate interests (we have a genuine business reason, and it does not override your rights), legal obligation (the law requires it) and consent (you have agreed, and you can change your mind).

Quote form and enquiries

If you use the Request a Quote form, we receive your name and email address and, if you add them, your company or organisation, the kind of film you need, when you need it, a budget range, a description of the project and how you heard about us. If you email us, we receive whatever you include in your message.

We use this to reply to you, discuss your project and send a quote. Our lawful basis is contract, because you are asking us to take steps before a possible contract, and our legitimate interest in answering the enquiries we receive.

The form sends your message straight to our inbox through a Cloudflare Pages Function and the email delivery service Resend. Nothing you type into the form is stored on the website.

Emails and other correspondence

We keep the emails and messages we exchange with clients, contributors, crew and suppliers, including names, contact details and anything else they contain. We use them to run projects and keep a record of what was agreed. Our lawful basis is contract where you are our client or supplier, and our legitimate interest in running the business and keeping accurate records in other cases.

Clients: project and contract records

When we work together, we keep the names and work contact details of the people we deal with, along with briefs, quotes, contracts, schedules, call sheets, review comments and delivery records. We use this to plan, film, edit and deliver the project. We usually share cuts and deliver files through Google Drive, or another platform the client asks for. Our lawful basis is contract where the contract is with you personally, and our legitimate interest in delivering work for the organisation you represent where the contract is with your employer.

Invoices and accounts

We keep invoices, payment records and the bank and billing details needed to pay and be paid. Our lawful basis is contract, to bill and pay for the work, and legal obligation, because UK tax and company law require us to keep financial records.

People we film

When we film interviews, events and documentaries, we record the images and voices of contributors, interviewees, speakers and sometimes members of the public. We also keep release forms and the names and contact details of contributors. How release forms are handled depends on the project and the client’s requirements.

Much of our work is filmed for a client. In that case the client usually decides how the finished film is used, and they are responsible for that use under their own privacy policy. We handle the footage on their behalf and on their instructions.

Where we are responsible for the footage, for example in our own documentaries, our lawful basis is our legitimate interest in making and showing the film, supported by a signed release where we ask for one. We will tell you before filming how the footage will be used. If a film includes sensitive information about you, such as your health or beliefs, we only use it with your explicit consent. We do not show a client project in our own showreel or portfolio without the client’s written permission.

Visiting the website

The website is a static site hosted by Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical information about each visit, such as your IP address, browser type, the page requested and the time. Our lawful basis is our legitimate interest in running a secure, working website. We do not use this information to identify you.

To see which pages are read, we use privacy-friendly analytics that don’t use cookies, currently Cloudflare Web Analytics. Cloudflare states that it stores nothing in your browser and does not fingerprint visitors. We only see totals, such as page views and visits. Our lawful basis is our legitimate interest in understanding how the site is used so we can improve it.

We do not use advertising tools or tracking that follows you across other websites.

Spam protection on the quote form

The Request a Quote form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile only loads on the Request a Quote page, as you reach the form. It looks at technical signals from your browser and device, such as your IP address and browser characteristics, and does not set advertising or tracking cookies. Our lawful basis is our legitimate interest in keeping spam and abuse out of our inbox.

How long we keep it

We keep personal information only for as long as we need it, then delete it securely.

Information	Lawful basis	How long we keep it
Enquiries that do not lead to work	Contract (steps before a contract), legitimate interests	12 months after our last contact with you
Client project and contract records, and related correspondence	Contract, legitimate interests	Six years after the project ends, because that is how long a claim about a contract can be brought
Invoices and accounts	Contract, legal obligation	Six years after the end of the financial year they relate to, as UK tax and company law requires
Raw footage and project files, including copies on Google Drive	Contract (for clients), legitimate interests	This varies by project. Usually around two months after delivery, unless agreed otherwise with the client
Contributor release forms	Legitimate interests, consent where we ask for it	This depends on the project and the client’s requirements. Typically for as long as the film is in use, and then for up to six years with the project records
Other correspondence	Legitimate interests	12 months after our last contact, unless it forms part of a project record
Website technical data and analytics	Legitimate interests	We do not keep records about individual visitors. Analytics reach us only as totals, and Cloudflare holds short term logs under its own retention policy
Quote form messages held by Resend	Contract, legitimate interests	A short period set by Resend for delivery records, after which Resend deletes them. The copy in our inbox follows the enquiry or project periods above

Finished films delivered to a client belong to the client, who decides how long to keep and use them.

Cookies and similar technologies

This website does not set any cookies of its own, and we do not use analytics, advertising or tracking cookies, so you will not see a cookie banner.

Our analytics (currently Cloudflare Web Analytics) use a small script that measures how pages are viewed and sends the results to Cloudflare. They place no cookies or other storage in your browser, and we only see totals. PECR allows this kind of statistics to improve a website without consent, provided you are told about it and can object.

A small number of technologies are strictly necessary for things you ask for, so PECR does not require consent for them:

Cloudflare may set a short lived security cookie if it needs to check that a visitor is not a bot.
Cloudflare Turnstile, on the Request a Quote page, may store a short lived value in your browser while it runs its check.

If you would rather not be counted, you can object at any time: use the Turn off analytics switch below, or email us.

Turn off analytics

Analytics are on. Turning them off saves a setting in this browser only.

If we add anything that needs your consent, we will update this policy first and ask you.

You can also block or delete cookies in your browser settings.

Embedded videos

Some pages show films hosted on Vimeo and YouTube. Nothing is loaded from those services until you press play. When you do, the film loads from Vimeo with its Do Not Track setting on, or from YouTube’s privacy enhanced mode (youtube-nocookie.com). Vimeo or YouTube may then collect information about your viewing under their own privacy policies, as separate controllers.

Who we share it with

We share personal information only where we need to. We use service providers who help us run the business, such as Google Workspace, Microsoft 365, Resend and Cloudflare. By role, they are currently:

Website hosting and security: Cloudflare, which hosts the site and protects it and the quote form from attacks and spam (Cloudflare Turnstile);
Form delivery: Resend, which delivers quote form messages to our inbox;
Email: Microsoft 365;
File storage and review: Google Drive, part of Google Workspace, which we usually use to share cuts for review and deliver files;
Analytics: Cloudflare Web Analytics;
Accounting and business software: the tools we use to keep our records and accounts.

We usually use Google Drive. If a client asks us to use a different review or file transfer platform, we use it under that provider’s terms and confirm which one with the client.

We also share information, where needed, with:

freelance crew, editors and subcontractors working on a project, who are bound by confidentiality. Which of them see personal information depends on the project;
our clients, when we deliver footage and films that feature contributors;
our accountant, bank and professional advisers;
HMRC, the police, courts or other authorities, where the law requires it.

Our service providers act on our instructions under data processing terms and may not use your information for their own purposes. We do not sell personal information.

Transfers outside the UK

Some of our providers process information outside the UK, for example in the United States. When we film abroad, crew and footage may travel with us. When information is processed outside the UK, we rely on UK adequacy regulations or on approved safeguards, such as the UK Addendum to the Standard Contractual Clauses or the International Data Transfer Agreement (IDTA). For example, Google relies on the UK Extension to the EU US Data Privacy Framework for UK data sent to the United States. You can email us for more detail on the safeguard used for a particular provider.

How we keep it secure

We use appropriate technical and organisational measures to protect personal information. For example, the website is served over an encrypted (HTTPS) connection, the quote form does not store your message on the website, only the people who need it for a project can access our email, files and footage, and freelancers work under confidentiality terms.

Automated decisions

We do not make decisions about you by automated means alone, and we do not use your information for profiling.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal information we hold about you (access);
have it corrected if it is wrong or incomplete (rectification);
have it deleted (erasure);
ask us to limit how we use it (restriction);
object to how we use it, where we rely on legitimate interests (objection);
receive information you gave us in a portable format, or have it sent to another organisation, where we use it under a contract or your consent (portability);
withdraw your consent at any time, where we rely on it. This does not affect anything we did before you withdrew it.

To use any of these rights, email [email protected]. We may need to confirm your identity first. Some rights have limits, for example where the law requires us to keep financial records, and we will explain if one applies.

There is normally no fee. We will reply within one month. If your request is complex, or you make several, we may extend this by up to two further months, and we will tell you within the first month if we need to. If we need more information from you to deal with the request, the time limit starts once we have it.

Complaints

If you are unhappy with how we have handled your personal information, please email [email protected] first. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk/make-a-complaint.

Children

This website and our services are for businesses and organisations, and are not aimed at children.

Changes to this policy

We review this policy from time to time and will post any changes on this page with a new date. We’ll update this page if our providers or practices change.

Last updated: 23 October 2026

Privacy Policy