Effective date: 28 August 2026
1. Introduction and company information
This Privacy Policy explains how Northstar Content Studio Ltd (“we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you interact with us, use our services, visit our website, communicate with us, or otherwise engage with our content-production business.
Northstar Content Studio Ltd is the data controller responsible for the processing of personal data described in this Privacy Policy.
Company details:
- Legal name: Northstar Content Studio Ltd
- Address: Northstar Content Studio, 2nd Floor, 18 Hewitt Street, Manchester, M15 4GB, UK
- Email: [email protected]
- Phone: +44 161 924 7583
We provide content-production services, which may include strategy, writing, design, video, photography, editing, post-production, project management, client communications, and related creative and administrative services.
2. Data collection and processing
We may collect and process the following categories of personal data, depending on your relationship with us and how you interact with us:
- Identity data: name, job title, company name, and similar identifiers.
- Contact data: email address, postal address, telephone number, and communication preferences.
- Contract and service data: project details, briefs, approvals, service agreements, invoices, purchase orders, and correspondence relating to services.
- Communication data: messages, emails, call notes, meeting notes, feedback, and support queries.
- Financial and billing data: invoicing details, payment records, tax-related information, and transactional history.
- Technical data: IP address, browser type, device information, operating system, referral data, and website usage information.
- Marketing data: preferences for receiving marketing communications, responses to campaigns, and related engagement data.
- Content and media data: files, images, videos, audio recordings, drafts, assets, and other materials provided to us or created in the course of a project, which may include personal data.
- Recruitment data: CVs, application materials, references, interview notes, and related information if you apply for a role with us.
We may collect personal data directly from you, from your organisation, from our website or analytics tools, from email and communication platforms, from publicly available sources, or from third parties such as suppliers, partners, and professional advisers.
We only process personal data where necessary and appropriate for legitimate business purposes, to provide our services, to manage client relationships, to meet legal obligations, and to operate our business effectively.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and communicate with prospective, current, and former clients;
- to provide content-production services and manage projects;
- to prepare quotes, proposals, contracts, statements of work, and invoices;
- to manage supplier, client, and business relationships;
- to coordinate creative collaboration, approvals, and delivery of work;
- to maintain records, business administration, and internal operations;
- to process payments, issue invoices, and manage accounting and tax obligations;
- to send service-related communications and, where permitted, marketing communications;
- to monitor and improve our website, services, security, and user experience;
- to detect, prevent, and investigate fraud, misuse, security incidents, or unlawful activity;
- to comply with applicable legal, regulatory, and contractual requirements;
- to defend or establish legal claims and protect our rights and interests;
- to recruit and assess candidates for employment or freelance engagement.
4. Legal basis for processing
Where applicable privacy law requires a lawful basis, we rely on one or more of the following grounds:
- Contract: where processing is necessary to enter into or perform a contract with you or your organisation.
- Legal obligation: where processing is necessary to comply with legal, accounting, tax, regulatory, or record-keeping obligations.
- Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. These interests may include operating and improving our business, providing and marketing services, protecting our systems, and managing business relationships.
- Consent: where you have given us clear consent to process your data for a specific purpose, such as certain marketing activities or optional communications.
- Vital interests: in rare situations where processing is necessary to protect someone’s life or physical safety.
- Public task or official authority: where applicable under law, though this is generally unlikely to apply to our business activities.
For any processing of special category data or other sensitive information, we will only process such data where permitted by law and subject to additional safeguards and a valid legal condition.
5. Data sharing and third parties
We may share personal data with the following categories of recipients where necessary for the purposes described in this Privacy Policy:
- Service providers and processors: hosting providers, cloud storage providers, IT support, email and communication tools, analytics providers, project management platforms, payment processors, accounting software providers, and other business technology suppliers.
- Professional advisers: lawyers, accountants, auditors, insurers, and other advisers who support our business.
- Clients, collaborators, and suppliers: where necessary for project delivery, approvals, production workflows, or service performance.
- Authorities and regulators: where required by law, court order, lawful request, or to protect our rights, property, or safety.
- Business transferees: in connection with a merger, acquisition, restructuring, sale of assets, or similar corporate transaction.
We require third parties to handle personal data securely and in accordance with applicable legal requirements. Where third parties act as data processors on our behalf, they are expected to process personal data only under our instructions and for specified purposes.
6. Data transfer to third countries
Depending on the location of our service providers, collaborators, or storage systems, personal data may be transferred to and processed in countries outside the United Kingdom and, where applicable, outside the European Economic Area.
Where such transfers occur, we take appropriate safeguards to protect personal data in accordance with applicable law. These safeguards may include:
- transfer agreements incorporating standard contractual clauses or equivalent approved safeguards;
- reliance on adequacy decisions where available;
- supplementary technical, organisational, and contractual protections;
- limiting transfers to what is necessary for the relevant purpose.
Where required, we will provide additional information about relevant transfer mechanisms upon request.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, contractual, and reporting obligations.
Retention periods vary depending on the nature of the data and the purpose of processing. In general:
- client and project records are retained for the duration of the relationship and for a reasonable period thereafter;
- financial and tax records are retained for the period required by applicable law;
- marketing data is retained until you opt out, withdraw consent, or we no longer need it;
- website and technical logs are retained for operational and security purposes for a limited period;
- recruitment data is retained only as long as necessary for hiring decisions, unless we are permitted to retain it longer with your consent or for legal reasons.
When personal data is no longer required, we will delete it or anonymise it securely where feasible.
8. User rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: the right to request confirmation of whether we process your personal data and to obtain a copy of that data.
- Rectification: the right to request correction of inaccurate or incomplete personal data.
- Erasure: the right to request deletion of personal data in certain circumstances.
- Restriction: the right to request that we restrict processing in certain circumstances.
- Data portability: the right to receive certain personal data in a structured, commonly used, machine-readable format and, where technically feasible, to transmit it to another controller.
- Objection: the right to object to processing based on legitimate interests or for direct marketing.
You may also have rights regarding automated decision-making, although we do not عادة rely on fully automated decisions that produce legal or similarly significant effects without human involvement.
To exercise any rights, please contact us using the details provided below. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time.
Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, nor will it affect processing based on other legal grounds where applicable.
You can withdraw consent by contacting us at [email protected] or by using any unsubscribe or preference-management option provided in our communications, where available.
10. Right to complain
If you have concerns about how we handle personal data, we encourage you to contact us first so that we can try to resolve the issue directly.
You may also have the right to lodge a complaint with a data protection supervisory authority, particularly in the jurisdiction where you live, work, or where an alleged infringement occurred. In the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO).
We would appreciate the chance to address your concerns before you contact a supervisory authority, but you are not required to do so.
11. Data security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include access controls, password protection, encryption where appropriate, role-based permissions, secure storage, staff confidentiality obligations, and regular review of our internal procedures.
Although we take reasonable steps to safeguard personal data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we work to reduce risks and respond promptly to any suspected incident.
12. Contact information
If you have questions, requests, or concerns about this Privacy Policy or about how Northstar Content Studio Ltd processes personal data, please contact us using the details below:
- Northstar Content Studio Ltd
- Address: Northstar Content Studio, 2nd Floor, 18 Hewitt Street, Manchester, M15 4GB, UK
- Email: [email protected]
- Phone: +44 161 924 7583
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or operational needs.
When we make material changes, we will take reasonable steps to notify you, such as by posting the updated policy on our website, updating the effective date, or providing notice by email where appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how Northstar Content Studio Ltd processes personal data.