Skydance UK/EU Personnel Privacy Notice ("Notice")

Skydance UK/EU Personnel Privacy Notice (“Notice”)

Effective Date: September 9, 2024

This Notice describes how Skydance Productions, LLC and its parent, subsidiaries, and other affiliates under the control of our corporate parent

(“Company,” “we,” “us,” or “our”) processes personal data / personal information (“PI”) of Personnel (defined below) in various human resources contexts (“HR”) and in connection with the production of media products and services (“Commercial Purposes”). This Notice applies where the Company entity (the “Controller”) that employs, engages or otherwise instructs you is based within in the UK or EU and is designed to inform Personnel how their PI will be processed in accordance with data protection laws, including Regulation (EU) 2016/679 (the GDPR), the Data Protection Act 2018, the UK GDPR (as defined in the Data Protection Act 2018) and any other legislation that amends, supplements or replaces the GDPR or UK GDPR (“Data Protection Laws”). In the event of a conflict between any other Company policy, statement, or notice and this Notice, this Notice will prevail, unless stated otherwise. Terms defined under Data Protection Laws shall have the same meaning when used in this Notice.

Applicability: This Notice applies to the following whose PI is collected by the Controller in HR contexts and for Commercial Purposes:

Job applicants who have applied for a position with Company.
Current/former employees of Company.
Independent contractors of Company (including loaned out personnel).
Cast and crew (whether engaged by direct hire or loan out).
Co-employees that are also employed by a third-party. Note, however, that co-employees may also be subject to the third-party’s privacy notice.
Personnel that are employed or engaged by another business from which we license or otherwise acquire media products or services that provide us with their PI in connection therewith (e.g., as part of the rights chain of title).

This Notice also applies to family or friends whose PI has been provided to the Controller in an HR context or in connection with Commercial Purposes, such as if:

They are listed as an emergency contact for one of the foregoing.
They are a beneficiary or dependent of one of the foregoing.

The individuals referred to in the foregoing bullet points are collectively referred to as “Personnel” throughout this Notice.

TABLE OF CONTENTS

1. Notice of Data Practices 2

2. PI Sources 2

3. PI Collection. 3

4. PI Purposes and Lawful Bases 6

5. Recipients of your PI 8

6. Data Retention. 9

1. Notice of Data Practices

The description of our data practices in this Notice covers the twelve (12) months prior to the Effective Date and will be updated at least annually if there are any material changes. We will notify you of any material changes by updating this Notice. On occasion (and at our discretion) we may also notify you of specific changes to this Notice from time-to-time in another reasonable and appropriate manner. Our data practices may differ between updates, however, and if materially different from this Notice, we will endeavour to provide supplemental pre-collection notice of the current practices, which may include references to other privacy policies, notices, or statements. Otherwise, this Notice serves as our notice at collection.

2. PI Sources

We may collect your PI directly from you, such as when you apply for a position or become employed or engaged by us (e.g., identification/identity data, contact details, educational and employment data), from others through interactions in the course of employment or engagement, from third parties (e.g., background check vendors and references, co-employers, loan out companies, producers from which we acquire media properties, etc.), or from public sources of data.We may collect your PI directly from you, such as when you apply for a position or become employed or engaged by us (e.g., identification/identity data, contact details, educational and employment data); from others through interactions in the course of employment or engagement (e.g., line managers); from third parties (e.g., background check vendors and references, co-employers, loan out companies, producers from which we acquire media properties, etc.); or from public sources of data.

3. PI Collection

Below we have set out the PI that we will collect from Personnel. Not all such PI listed below is collected from all Personnel, but only where required for the purposes listed in Section 4. The information in this Section below is not required under Data Protection Laws, but has been provided in accordance with transparency.

Category of PI	Examples of PI Collected and Retained
Identifiers	Name, postal address, telephone number, mobile number, date of birth, National insurance number, vehicle registration plate, passport number and copy, unique personal identifiers, online identifier, networking address, device identifier, e-mail address, account name, and similar contact information and identifiers.
Personal Records	Name, signature, description, National insurance number, address, telephone number, driver’s license, education, employment, employment history, bank account number, other financial information, medical information (including disability-related information), and health insurance information. Some PI included in this category may overlap with other categories.
Special Categories of Personal Data	In some circumstances, we may collect PI that has heightened protection under Data Protection Laws, such as PI revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data. We abide by the legal requirements imposed under Data Protection Laws in regard to such information.
Commercial Information	Records of products or services purchased or obtained in the HR context, such as benefits you have signed up for.
Internet Usage Information	When you use our online systems or otherwise interact with us online, we may collect browsing history, search history, computer type, operating system, and other information and analytics regarding your interaction with our systems or other sites, applications, or content.
Geolocation Data	If you use our systems or interact with us online, we may gain access to the approximate, and sometimes precise, location of the device or equipment you are using, or the location from which you are accessing our systems. We may also track the location of Company-owned, -rented, or -leased equipment.
Sensory Data	We may collect audio, video, electronic, or similar information, for example, CCTV security, HR hotlines (though you may use the hotline without identifying yourself), audio/video conferencing services and photo identification.
Professional or Employment Information	Professional, educational, or employment-related information, such as compensation information, work history and prior employer.
Non-public Education Records	Education records directly maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, schedules, identification codes, financial information, or disciplinary records.
Inferences from PI Collected	We may draw performance inferences from other information we collect about you.
Sensitive PI	Government Issued ID Numbers (National insurance, driver’s license, or passport number)
	Account Log-In (e.g., username and password to online account with Company)
	Geolocation from certain company owned and managed devices.
	Communication Content (contents of mail, email, and text messages, other than where Company is the intended recipient of the communication – or where such communication is sent from a Company device or account and Company has reason to believe there has been a breach of Company policy)
	Health Information (PI collected and analyzed concerning an individual’s health, such as disability-related information).
	Sexual orientation or ethnicity information (e.g., in connection with voluntary diversity programs).

There may be additional information we collect that meets the definition of PI under Data Protection Laws. Any additional PI will be used only for the purposes set out in this Notice (including via any updates to this Notice).

Company may process biometric data, including but not limited to scans of facial geometry (collectively “Biometric Data”), from select Personnel in connection with the production, distribution, and promotion of media products and services (e.g., depicting performers, creating animations based on performers, promoting productions, etc.). Biometric Data collected by Company is used solely in connection with media products and services. Any Biometric Data collected, used, or stored by Company will be used solely for these purposes and, for the avoidance of doubt, Biometric Data is not used for purposes of uniquely identifying an individual. In the event Company begins collecting Biometric Data for any additional purpose, we will update this Notice.

4. PI Purposes and Lawful Bases

Generally, we use Personnel PI for HR purposes Commercial Purposes and as otherwise related to the operation of our business. These purposes are necessary for the performance of the contract that we have with you.

We use your PI only in accordance with Data Protection Laws, which means that we must have a lawful basis for each purpose for which we process your PI. Below, you can find specific information about the purposes for which we process your PI and the lawful basis on which we rely:

a) The processing is necessary for the performance of a contract:

Recruitment.
Employment.
Personnel intake/onboarding/off-boarding.
Maintaining personnel records.
Payroll, reimbursements and timekeeping.
Managing the loaned-out personnel.
Processing leaves of absence.
Booking travel.
Personnel activation initiatives and communications.
Administering mandatory training and education programs.
Personnel activation initiatives and communications.
Commercial Purposes, including providing credits, depicting performers, creating animations based on performers, promoting productions, distributing media properties, etc., and sharing such PI with our licensees and assigns (e.g., actors, writers, directors, etc.) for these same Commercial Purposes.

b) The processing is necessary for compliance with a legal obligation:

Processing workers’ compensation claims.
Running background checks.
Facilitating diversity and inclusion programs.
Health & safety/occupational health.

c) The processing is necessary for the purposes of the legitimate interests pursued by us:

Running background checks.
Benefits administration.
Administering training and education programs.
HR and IT systems.
Security (including electronic and on premises).

5. Recipients of your PI

We may disclose your PI to the following categories of recipients:

Disclosing it to our service providers, contractors, or processors that perform services for us (“Vendors”);
Disclosing it to our distribution and production partners who shall also act as independent controllers in respect of development, production, marketing, distribution and financing.
Disclosing it to you or to other parties at your direction or through your action (e.g., payroll processors, benefits providers, personnel loan out providers, some software platform operators, co-employers and their auditors, unions and guilds and their auditors, etc.);
Disclosing it to our investors (e.g., in connection with our voluntary diversity programs, review and approval of executive employment terms, and other contractual obligations to investors);
For the additional purposes explained at the time of collection (such as in the applicable privacy policy or notice);
As required or permitted by applicable law;
? To the government or private parties, and their respective representatives, to comply with law or legal process or protect or enforce legal rights or obligations or prevent harm;

Where we believe we need to in order to investigate, prevent or take action if we think someone might be using information for illegal activities, fraud, or in ways that may threaten someone’s safety or violate our policies or legal obligations, including disclosures to law enforcement and others; and
To assignees and their agents as part of an acquisition, merger, bankruptcy, license or sale of media properties, asset sale, or other transaction where another party assumes control over all or part of our business (“Corporate Transaction”).

6. Data Retention

Because there are so many different types of PI in certain categories, and so many purposes and use cases for different data, we are unable to provide retention ranges based on categories of PI in a way that would be meaningful and transparent to you. Actual retention periods for all PI will depend upon how long we have a legitimate purpose for the retention — consistent with the collection purposes and applicable law. Unless Company has a legal requirement to hold an individual’s Biometric Data for a longer period of time, Company will permanently destroy and delete Personnel’s Biometric Data when such Biometric Data is no longer needed to facilitate the purpose(s) of collection and processing identified above or as may earlier be required by applicable law (e.g., three (3) years from last interaction where applicable).

Please note, we will always retain a record of all of Personnel engaged by us.

Please also note that any PI contained within the final version of a production, and any related marketing, will be publicly available on a permanent basis.

International transfers of PI

We may transfer your PI to recipients outside the UK / EU in countries that may have different data protection rules to the UK / EU, such as the USA. When we transfer PI outside the UK to a country that has not been recognised as providing an adequate level of data protection, we are required to ensure you are afforded equivalent protection in respect of your PI to that provided in the UK. We do this by putting in place appropriate safeguards, for example, by using specific contractual clauses which have been approved by the UK government together with other measures if we deem it necessary in the circumstances, for example, enhanced security.

Your rights

Under certain circumstances, by law you have the right to:

Request access to your PI (commonly known as a “data subject access request”). This enables you to receive a copy of the PI we hold about you and to check that we are lawfully processing it.
Request correction of the PI that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your PI (commonly known as a “right to be forgotten”). This enables you to ask us to delete or remove PI where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your PI where you have exercised your right to object to processing (see below).
Object to processing of your PI where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to our object to processing on this ground and provided that we do not have compelling legitimate interests to override such objection.
Request the restriction of processing of your PI. This enables you to ask us to suspend the processing of PI about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your PI to another party.
Complain to a relevant supervisory authority in respect of our processing of your PI, which will be the Information Commissioner’s Office in the UK. However, if you have any concerns about how we handle your PI, we encourage you to contact us in the first instance so that we can work with you to resolve them.
Withdraw consent – in most cases we do not rely on consent to process your PI but in the limited circumstances we have sought and you have given consent for a specific use of your PI, you have the right to withdraw your consent at any time (although if you do, it does not mean that anything we have done with your PI with your consent up to that point is unlawful).

If you want to exercise any of data rights, please contact us on the details below.

Please be aware that the rights above are not absolute and there may be circumstances where we are unable to comply with your request (either wholly or in part). In such cases we will explain why we cannot comply with the request. For example, Data Protection Laws contains exemptions to some obligations on controllers and rights of individuals where PI is used for artistic purposes which means that in some circumstances your data rights may not apply.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that PI is not disclosed to any person who has no right to receive it. You will not usually have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive, or refuse the request altogether.

Contact us

If you have any queries in relation to how we use your PI or you want to exercise your data rights please contact via email to EUprivacy@skydance.com.