Privacy Policy

Draft for review · TBC · from Rishi · Launch date and live-service details await confirmation.

This preview does not send forms. The form handling and statistics described below are proposed for launch. PROPOSED · TBC · from Rishi

Opus AV Ltd · Last updated: [LAUNCH DATE]

This policy explains what personal information Opus AV collects, why, who sees it, how long we keep it and what your rights are. It covers this website, enquiries you send us, and the events we work on. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The short version

• We collect what you type into our enquiry forms so we can reply, check our availability and put an estimate together.
• Your enquiry goes to our email inbox, a short alert goes to our director's phone, and a copy is kept in a secure database so we don't lose track of it.
• We don't use cookies, advertising pixels or tracking. Our website statistics are counted without cookies and without identifying you.
• We never sell your information.
• You can ask to see, correct or delete your information at any time. Email enquiries@opus-av.com.

1. Who we are

Opus AV Ltd is the "controller" of your personal information. That means we decide how it is used and we are responsible for it.

We are not required to appoint a Data Protection Officer. For anything about your personal information, email enquiries@opus-av.com and put "Privacy" in the subject line. [RISHI TO CONFIRM: name of the person who handles privacy requests, e.g. "Rishi Pisavadia, Director"]

2. What we collect and why

2.1 When you send an enquiry

Our website has three forms: the contact form, the planners' and venues' supplier form, and the three-step estimate tool. Depending on the form, we ask for:

• your name, email address and phone number
• your company, agency or venue (if you have one)
• your event date, venue name and venue postcode
• the type of event, the number of guests and whether it's indoors, in a marquee or outdoors
• the services, looks and kit you're interested in, including anything in your kit list
• anything else you choose to write in the message box.

Why we use it: to reply to you, check whether we're free on your date, work out an estimate or quotation, and follow up on that enquiry.

Lawful basis:

• If you are enquiring for yourself (for example, for your own wedding or party), we use your information to take steps you have asked for before a possible contract, under UK GDPR Article 6(1)(b).
• If you are enquiring on behalf of a business, venue or planning agency, the contract would be with your organisation. We use your work contact details under our legitimate interests (Article 6(1)(f)), which are responding to business enquiries and building working relationships with planners and venues.

Do you have to give it? No. But we need at least your name and an email address to reply. Fields marked with an asterisk are the ones we need.

What happens when you press Send: your enquiry is passed to our form handler (run on Cloudflare), which:

1. emails the full enquiry to our inbox at enquiries@opus-av.com (Microsoft 365)
2. sends a short alert to our director's phone through Telegram. The alert contains only your first name, the type of event, the date and the venue's town or postcode area. It does not include your email address, your phone number or your message. [RISHI TO CONFIRM: alert contents. This is the PROPOSED design, see NOTES.md]
3. saves a copy of the enquiry in a secure database so we can follow it up
4. sends you an automatic email confirming we've received it.

Please don't include sensitive details that we don't need, such as health information, in the message box. If you tell us about the ceremonies or traditions at your event, we use that only to plan the production. We do not use it to draw conclusions about you.

2.2 When you email, phone or message us

We keep the emails, messages and notes of calls you send us, for the same reasons and on the same lawful bases as in 2.1.

[RISHI TO CONFIRM: do you use WhatsApp (or another messaging app) with clients? If yes, add: "If you message us on WhatsApp, WhatsApp (Meta) also processes those messages under its own privacy policy."]

2.3 When you book with us

If you become a client, we also keep:

• billing and invoicing details (name, billing address, company details, purchase order numbers)
• payment records. We do not see or store your full card details.
• event and production details: running orders, venue contacts, access times and technical requirements
• our correspondence with you about the booking.

Lawful basis: to perform our contract with you (Article 6(1)(b)). We keep accounting records because the law requires it (Article 6(1)(c)). Where the contract is with your organisation, we use your contact details under our legitimate interests in running the booking (Article 6(1)(f)).

2.4 When you visit our website

What we get: like every website, our host, Cloudflare, receives technical information when your browser requests a page. This includes your IP address, browser type, the page you asked for and the page that linked to it. Cloudflare uses this to deliver the page and to protect the site from attacks and abuse.

Website statistics: we use Cloudflare Web Analytics to count visits and see which pages are popular and how fast they load. It does not use cookies or local storage, does not build a profile of you, and does not identify you by IP address. We only see totals. You can turn it off for your device: see our Cookies page.

Your kit list: if you add kit to an estimate on our kit page, the list is saved in your own browser so it's still there when you come back. It stays on your device. We only receive it if you send it to us as part of an enquiry.

Lawful basis: legitimate interests (Article 6(1)(f)), which are running a secure, working website and understanding in general terms how it is used. The rules on storing or reading information on your device are on our Cookies page.

2.5 Photos and video of events

We photograph and film our lighting, staging and screens at events we produce, and we use some of this on our website and social media to show our work. Guests may be visible in the background.

Lawful basis: legitimate interests (Article 6(1)(f)), which are showing prospective clients real examples of our work. We choose images that focus on the production, not on individuals.

[RISHI TO CONFIRM: how you get the booking client's agreement before publishing photos or video of their event (for example, a line in the booking confirmation). See NOTES.md, R12.]

If you appear in any of our photos or videos and would like it removed, email enquiries@opus-av.com and we will take it down.

2.6 Marketing

We do not send marketing newsletters. If you enquire, we will contact you about that enquiry, and that is not marketing. If we ever start sending marketing emails, we will only do so where the law allows, and every email will include a simple way to unsubscribe. [RISHI TO CONFIRM: no newsletters or marketing mailings at present]

2.7 Automated decisions

Our brief form doesn't calculate prices or make any decision about you. Rishi reads every brief himself. We don't make decisions about people using only automated means.

3. Who we share your information with

We never sell or rent your personal information. We share it only with the service providers who run our systems, and only as much as each one needs. They act on our instructions.

We may also share information with:

• freelance technicians and crew working on your event, who receive only the event details they need, such as the venue, timings and on-site contact [RISHI TO CONFIRM]
• our accountants and professional advisers
• our insurers, if there is an incident or claim [RISHI TO CONFIRM]
• the police, courts, HMRC or other authorities, where the law requires it.

4. International transfers

Some of our providers process information outside the UK.

• Cloudflare: Cloudflare, Inc. is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as adequate protection. Cloudflare's data processing terms also include the UK International Data Transfer Addendum as a backup safeguard. [PROPOSED: our enquiry database is set to Cloudflare's EU jurisdiction, so it is stored inside the EU.]
• Microsoft: Microsoft 365 is covered by Microsoft's Products and Services Data Protection Addendum, which includes safeguards for transfers out of the UK.
• Telegram: Telegram says it stores data for accounts registered in the UK in the Netherlands, which the UK treats as giving adequate protection. Telegram does not offer a standard data processing contract to businesses that use its bots. That's why we send only a minimal alert through it, with no contact details or message text.

You can ask us for more detail about these safeguards.

5. How long we keep it

All retention periods below are PROPOSED and waiting for Rishi's sign-off.

When the period ends, we delete the information securely or make it fully anonymous.

6. How we keep it safe

Only Opus AV's directors and the people who need it for your event can see your information. Our accounts are protected with strong passwords and two-step sign-in [RISHI TO CONFIRM: two-step sign-in is switched on for Microsoft 365, Cloudflare and Telegram]. The website uses encrypted (HTTPS) connections throughout. If a data breach puts you at risk, we will tell you and, where required, the Information Commissioner's Office (ICO).

7. Your rights

You have the right to:

• access: ask for a copy of the information we hold about you
• rectification: ask us to correct anything wrong or incomplete
• erasure: ask us to delete your information. We may have to keep some records, such as invoices, for legal reasons.
• restriction: ask us to pause using your information while a concern is looked into
• objection: object to us using your information on the basis of legitimate interests (including the photos described in 2.5) and to any direct marketing
• portability: ask for information you gave us, in a common electronic format, to move elsewhere
• withdraw consent: where we rely on your consent, withdraw it at any time.

To use any of these rights, email enquiries@opus-av.com. It is free. We will reply within one month. If your request is complex, we may extend this by up to two more months, and we will tell you if we need to. We may ask you to confirm your identity first.

8. Complaints

If you're unhappy with how we've handled your information, please tell us first at enquiries@opus-av.com. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO):

• Online: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

9. Children

Our services are for adults and organisations. Our website is not aimed at children, and we don't knowingly collect personal information from anyone under 18. Enquiries should be made by an adult. If you're booking an event for children, such as a birthday party, please tell us only what we need to plan it. If you think a child has sent us their details, contact us and we'll delete them.

10. Links to other websites

Our website may link to other websites, such as our partners or social media. We are not responsible for their privacy practices, so please read their own policies.

11. Changes to this policy

We will update this policy when the way we use personal information changes. The date at the top shows when it was last updated. If we make a significant change that affects you, we will tell you directly where we can.

12. Contact

Opus AV Ltd · Unit 855 Plymouth Road, Slough SL1 4LP enquiries@opus-av.com · +44 (0)7932 997 474