BFI privacy policy

The British Film Institute (the “BFI”, “we”) is a registered charity (number 287780), Royal Charter Body, National Lottery distributor and non-departmental public body funded by the department of Digital, Culture, Media and Sport.

The BFI is committed to respecting and protecting your personal information.

This policy seeks to inform you about:

• how and why we collect, process and store your personal information
• your Rights

This policy applies to all the BFI’s activities, services, products and platforms.

The BFI is the Data Controller and Richard Brousson is the Data Protection Officer under the UK’s Data Protection Act 2018 and the EU’s General Data Protection Regulation 2016.

All questions and complaints about the BFI’s use and handling of personal information should be addressed to dpo@bfi.org.uk.

You also have the right of complaint to the UK’s Supervisory Authority for Data – the Information Commissioners Office (the “ICO”). See ico.org.uk/make-a-complaint.

Information about personal data relating to volunteering, working for or applying to work for the BFI can be found here: BFI Privacy Notice: Workforce and Recruitment

We may collect and process the following information about you:

• Your prefix and name, billing and delivery address, postcode, email address, phone numbers, gender, date of birth, diversity monitoring information (anonymously unless stated otherwise), job title, personal identification documents, data relating to access or dietary requirements, payment card information
• If you are making a grant application – your position within the company applying and relevant experience
• If you are a student – your course details, relevant experience, school, college or university
• You may provide us with this information when you set up an account (e.g. BFI Player, membership), apply for a grant (BFI Film Fund), apply for a course (BFI Education), apply to the BFI’s certification unit, buy tickets (BFI Southbank, BFI IMAX, BFI Festivals), fill in a form (competitions and surveys), complete an application form or otherwise apply for a job here either directly or via a third party, apply to volunteer, or correspond with us by phone, email or in writing

• Device IDs, IP addresses and other unique identifiers
• Your activity on our services and platforms such as title selections and browsing history
• Advertising identifiers, such as those on mobile devices, tablets and streaming media devices and information collected by cookies (please see our Cookies and internet advertising policy below)

• Service providers that help us determine a location based on your IP address
• Select partners that make our services available on their platform or with whom we offer co-branded services or engage in joint marketing
• Publicly available information such as geo-demographic information and measures of capacity and propensity for giving to help us fundraise effectively and in line with our ethical policies from sites such as Companies House
• Social media – depending on your settings you may have given us permission to access your personal information held by companies such as Facebook and Twitter

When using our websites and platforms third parties may collect information about you. This can be controlled by adjusting the settings in your internet browsers. There is more detail about adjusting your browser settings on the Information Commissioner’s Office website.

We use your personal data for the following purposes:

• Carrying out research in the public interest
• Maintaining, preserving and enhancing the BFI National Archive
• Providing you with customer service when you visit, make use of or access any of the BFI premises, services or platforms
• To administer any of your accounts, applications, contracts, enquiries or complaints
• To process payments
• Fulfil ticket, product, donation and membership requests
• Contacting you
• Providing you with information about things we think may interest you
• Use your pseudonymised details, to protect your personal data, to show you advertising on social media platforms such as Facebook and Instagram or via other third-party advertising that may appear on other websites you use. This includes using specific services offered by some sites and social networks, such as Meta’s Custom Audience service. We also use cookies to provide you with information on products and offers that are relevant to you on social media. You can find more information about how we use pixels and cookies on our website by reading our Cookie Policy. You can limit the advertising you see and the kind of profiling and tracking that third parties use by going to your third party account settings and selecting ‘Ads’
• Share your pseudonymised personal data with third-party advertisers (such as Meta or Google) to help us identify customers similar to our audience or to serve relevant adverts to you on third party websites
• To prevent, detect and investigate illegal activity such as fraud. The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. For further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, see Fair Processing Notices for Cifas’s Databases
• Analyse and understand our members, audiences and customers and improve our services
• To protect and keep your personal information accurate
• Using CCTV recording equipment in and around our premises for security purposes

Data protection law recognises certain “special categories” of personal information, which include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning a person’s sex life or sexual orientation.

These special categories are considered particularly sensitive and so we will only collect and use this information where you have given us your explicit consent. For example, you may choose to tell us about your health condition before attending one of our events and we will only use this information for the particular event and not for any other purpose.

Our legal basis for collecting and processing your personal information depends on the type of personal information and how we use it. There are 6 lawful bases:

• Consent – acquiring your agreement for us to process personal data for a precise purpose. You can withdraw consent for the storage and processing of data at any time (dpo@bfi.org.uk)
• Public task – something we’re required to do as a public charity for example maintaining and enhancing the BFI National Archive
• Legitimate interests – where we have a legitimate interest that isn’t overridden by your fundamental rights and freedoms for example something we think you’d be happy for us to do like contact you when you have actively shown an interest in our activities or services
• Contract – fulfilment of a contract e.g. subscribing to BFI Player or becoming a BFI member
• Legal obligation – where we have to use data as prescribed by law
• Vital interests – protecting your health and personal safety

We only share your personal data with third parties where we have a legal basis for doing so, such as with your consent or the fulfilment of a contract. For example, to invite you to an event and administer payments. We will never sell your personal information.

Where we transfer personal information outside of the EEA for processing this is carried out in accordance with all applicable laws and with third parties we trust.

We only keep your personal information for as long as is necessary for the purpose for which it was collected. This depends on the personal information and the purpose for which it is processed. For precise information relating to the periods relating to each category of personal data, please contact dpo@bfi.org.uk. If you ask us to stop sending direct marketing communications to you, we will keep the minimum amount of information (e.g. name, address and email address) to ensure we adhere to such requests.

We use administrative, physical, managerial and technical measures to safeguard your personal information against loss, theft and unauthorised use.

The BFI will utilise your personal information to administer your relationship with the BFI. We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you. We may make use of additional information about you, such as geo-demographic information and measures of capacity and propensity for giving from sites such as Companies House. This helps us understand the background of the people who support us so we can contact you in the most appropriate way, with the most relevant information; and helps us to make appropriate requests for gifts in line with our ethical policies. To change how we contact you or process your personal information (including if you would like us to stop doing so), simply email dpo@bfi.org.uk.

Your personal information is your data and you are in control of it. Where you have an account with us, you can access it and amend the data we hold and the marketing you wish to receive.

You can ask us to provide you with all the information that we hold about you, how we use it and why, utilising your right to be informed and your right to access. Contact dpo@bfi.org.uk.

You can then ask us to do the following with the personal information we hold about you:

• If it is incorrect, you can ask for it to be updated – your right to rectification
• Restrict or object to it being processed at all or in a specific way — your right to restrict, right to object and right related to automated decision making
• Ask for it to be deleted — your right to erasure, sometimes called the right to be forgotten
• Ask for a digital copy of it – your right to digital portability

Many of the rights listed above are limited to certain defined circumstances and we may not always be able to comply with your request. We will tell you if this is the case.

For more information on your rights in your personal information, please see the ICO guidance.

We will update this policy from time to time in response to changes to legal or regulatory requirements and changes in our activities, services or platforms. The date of the last update will be noted at the bottom of this policy.

Personal data means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

Data Controller – An individual or an organisation which determines the purposes for which, and the manner in which, any personal data are to be processed

Data Processor – An individual or an organisation who processes personal data on behalf of the Data Controller

Data Processing – Anything you do with data: any operation, collection, recording, organisation, storage, adaption or disclosure of personal information

The BFI’s Data Protection Officer, Richard Brousson (dpo@bfi.org.uk), assists the BFI to monitor internal compliance, informs and advises on the BFI’s data protection obligations, and provides a contact point for data subjects and the ICO.

We and approved third parties use cookies and other technologies, as well as advertising identifiers, for various reasons. For example, we use these technologies to make it easy to access our services by remembering you when you return, to provide and analyse our services. They are also used to learn more about you and your likely interests, and to deliver and tailor marketing or advertising. We want you to be informed about our use of these technologies, so this section explains the types of technologies we use, what they do and your choices regarding their use.

Cookies are small data files that are commonly stored on your device when you browse and use websites and online services. They are widely used to make websites work, or to work more efficiently, as well as to provide reporting information and assist with service or advertising personalisation.

Advertising identifiers are similar to cookies and are found on many mobile devices and tablets (for example, the “Identifier for Advertisers” (or IDFA) on Apple iOS devices and the “Google Advertising ID” on Android devices), and certain streaming media devices. Like cookies, advertising identifiers are used to make online advertising more relevant.

Cookies and Internet Advertising Policy

The BFI and approved third parties use cookies and other technologies, as well as advertising identifiers: 

• to make it easy to access our services by remembering you when you return
• to provide and analyse our services
• to learn more about you and your likely interests, and to deliver and tailor marketing or advertising that may be more relevant to you

We want you to be informed about our use of these technologies. To find out more about the types of technologies we use, what they do and your choices regarding their use, please visit our Cookie policy page

Updated August 2024