Privacy Policy

This Data Protection Policy explains our data protection and privacy practices and how personal data is collected and used by The Juju Studio.

The purpose of this Policy is to set out the criteria for the collection, storage, use, sharing and deletion of personal data processed by The Juju Studio.

“Personal data” means any information relating to an identified or identifiable natural person, whether directly or indirectly. This Policy does not apply to anonymous data, which does not allow an individual to be identified.

The types of personal data that The Juju Studio may collect include: full name, surname, nationality, personal identification and tax identification numbers, signature, occupation, email address, telephone number; educational, employment and financial history; IP address; and browsing and cookie data from our website.

In general, providing personal data to The Juju Studio is voluntary. However, some data is necessary to enter into or perform a contract, or to comply with legal obligations, such as the employee data required under employment and tax legislation. If the data subject does not provide it, The Juju Studio may be unable to provide the service or establish the relevant relationship.

Each use of personal data relies on a lawful basis: performance of a contract, compliance with a legal obligation, the legitimate interests of The Juju Studio, or the data subject’s consent. The table below summarises, according to each data subject’s relationship with The Juju Studio, the purposes for which their data is used, the lawful basis relied upon and how long it is retained:

Where The Juju Studio needs the data to defend itself or to enforce its rights in a claim or legal proceedings, it may retain the data for longer, but only for as long as those proceedings remain open.

1. Lawfulness and transparency

The Juju Studio is committed to processing personal data lawfully, fairly and in a transparent manner.

2. Purpose limitation and data minimisation

The Juju Studio will only process personal data for specified and legitimate purposes, and will only collect data that is adequate, relevant and not excessive for those purposes. This means that it will only collect personal data that is relevant and not excessive for the purposes for which it is required and used.

The Juju Studio will ensure that the personal data processed is adequate, relevant and not excessive in relation to the purposes for which it was collected. In other words, only data that is strictly necessary to achieve the stated purpose will be collected and processed.

3. Lawful bases for processing

The Juju Studio will process personal data on one of the lawful bases provided for under applicable law, depending on the purpose and circumstances of each processing activity. These may include performance of a contract, compliance with legal obligations, the legitimate interests of The Juju Studio or the consent of the data subject, as set out in section 5.

Where processing is based on consent, that consent must be freely given, specific, informed and unambiguous. The data subject may withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

4. Accuracy and storage limitation

The Juju Studio will keep data accurate and up to date, rectify or erase inaccurate or incomplete data, and retain data only for the periods set out in section 5, after which it will be destroyed or anonymised.

5. Security and confidentiality

The Juju Studio takes appropriate technical and organisational security measures to keep data secure and to prevent unauthorised access, unlawful processing and unauthorised or accidental loss of, destruction of or damage to personal data.

The Juju Studio adopts the measures necessary to ensure the security and confidentiality of personal data, so as to prevent its alteration, loss, or unauthorised consultation or processing, and to enable the detection of any intentional or unintentional diversion of information, whether the risks arise from human action or from the technical means used.

6. Special category data

The Juju Studio will never require any individual to provide special category (sensitive) data, such as data concerning health, ethnic origin, beliefs or sexual orientation, and will only process such data where permitted by the UK GDPR and the Data Protection Act 2018.

The Juju Studio will not sell or rent personal data to any third party. Personal data may be disclosed to:

1. other The Juju Studio companies and other companies within the Untold group;
2. partners and third-party data processing service providers, in accordance with the lawful reasons and purposes for which the data was collected;
3. auditors, legal advisers and insurers; and
4. public authorities, where required or permitted by law.

Personal data collected and processed for the purposes described in this Policy may, in certain cases, be transferred to companies located outside the United Kingdom, including to countries whose data protection laws are less stringent than those of the European Economic Area (EEA) or the United Kingdom, or which have no data protection laws at all.

Whenever The Juju Studio transfers personal data in these circumstances, it will take all reasonably necessary steps to ensure that appropriate safeguards are in place to protect the data and to ensure that it is processed securely and in accordance with this Policy. To this end, it will rely on approved data transfer mechanisms, such as standard contractual clauses, to ensure that the data is subject to appropriate safeguards in the receiving country.

If the data subject is located in the United Kingdom or the EEA, they may contact The Juju Studio using the contact details set out in section 9 to request a copy of the safeguards in place to protect their personal data and privacy rights in these circumstances.

Data subjects have certain rights in relation to their personal information, as set out below. The Juju Studio will handle any request to exercise these rights in accordance with applicable law and any applicable legal exemptions.

• Right of access: the data subject may find out what personal data The Juju Studio holds about them and obtain access to it, regardless of where it is processed or stored.
• Right to rectification: if their personal data is inaccurate or incomplete, the data subject may request that it be corrected.
• Right to object: the data subject may object at any time to the processing of their personal data by The Juju Studio.
• Right to erasure: the data subject may request the deletion of their personal data where permitted by applicable law.
• Right to restriction of processing: the data subject may request that the processing of their personal data be restricted where permitted by applicable law.
• Right to data portability: where the legal conditions are met, the data subject may receive certain of their personal data and transmit it to another controller.
• Right to withdraw consent: where processing is based on consent, the data subject may withdraw it at any time.
• Right to lodge a complaint: the data subject may lodge a complaint with the competent supervisory authority, the UK Information Commissioner’s Office (ICO).