PRIVACY POLICY

1. Who We Are

rocketFLOW Studios Ltd is a VFX outsourcing and talent coordination company registered in England and Wales.

• Company name: ROCKETFLOW STUDIOS LTD
• Company number: 17221052
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
• Operating base: Leeds, United Kingdom — remote-first
• ICO registration number: ZC159820

For data-protection enquiries, email information@rocketflowstudios.com.

2. What Data We Collect

Talent applicants

When you submit the talent application form, we may collect your full name, email address, phone number, location, CV or resume, showreel or portfolio links, primary discipline, years of experience, software skills, application ID, submission date and privacy-consent timestamp.

Studio and project enquiries

When you use our contact, start-project or estimate forms, we may collect your name, company, email address and project details.

Operational communications

Where relevant to a future project or artist-verification process, we may also process communications, call records, progress updates, availability information and related production notes.

3. Why We Use Personal Data

• Talent applications: primarily with your consent under UK GDPR Article 6(1)(a), and where appropriate for legitimate recruitment or talent-network administration interests.
• Studio enquiries: under legitimate interests under Article 6(1)(f), so that we can respond and assess potential work.
• Contracts and legal obligations: where processing is necessary to enter into or perform a contract, comply with law, protect legal rights, prevent fraud or maintain security.

4. Where Data Is Stored

Depending on the type of information, data may be stored in:

• Notion — operational databases
• Cloudinary — CV and document storage
• Zoho — company email and correspondence
• Railway — application hosting and operational logs
• Access-restricted CSV backup records
• Google Drive — temporary company-controlled backup storage when implemented

CSV backups are currently held on the founder's password-protected computer. Full-disk encryption has not yet been independently confirmed. The company intends to move these backups to restricted company-controlled cloud storage and strengthen backup controls.

5. Who We Share Data With

We do not sell personal data and do not share it with third parties for their own marketing purposes.

We use service providers where necessary to operate the business, including Notion, Cloudinary, Zoho, Railway, Twilio, Anthropic and OpenAI. These providers process data subject to their own terms, privacy policies and applicable contractual safeguards.

We may also disclose data where required by law, to protect legal rights, respond to regulators or prevent fraud and security incidents.

6. International Transfers

Some service providers or operational activities may involve processing outside the United Kingdom. Where required, rocketFLOW Studios Ltd will rely on appropriate safeguards, such as adequacy regulations, approved contractual clauses or other lawful transfer mechanisms.

7. How Long We Keep Data

Talent application data is normally retained for two years from the application date, or until a valid deletion request is completed, whichever comes first, unless there is a lawful reason to retain it longer.

At the end of the retention period, records are reviewed and deleted or anonymised in accordance with the company's internal Data Retention & Deletion Policy. Contract, tax, accounting, security, complaint and legal records may be retained for longer where necessary.

8. Your Rights

Depending on the circumstances, you may have the right to:

• be informed about processing;
• access your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• request restriction of processing;
• object to processing;
• receive portable data where applicable;
• withdraw consent at any time;
• request human review of qualifying automated decisions;
• complain to the Information Commissioner's Office.

Send requests to information@rocketflowstudios.com. We normally respond within one calendar month, subject to identity checks, clarification and any lawful extension. Full details of how we handle these requests are set out on our Your Data Rights page.

9. Automated Processing and CineCoord

CineCoord may assist with classification, prioritisation, deadline analysis and operational recommendations. Final talent approval and material production decisions are subject to human review. We do not currently rely on solely automated decision-making that produces legal or similarly significant effects without appropriate safeguards.

10. Cookies and Tracking

Our public website currently does not use analytics, advertising pixels or behavioural-tracking tools. We do not use non-essential cookies for advertising or analytics.

Basic local-storage functionality may be used to remember interface choices, such as dismissing a notice. This does not track users across websites.

11. Security

We use access controls, role-based permissions, authentication, restricted links, security headers and operational procedures intended to protect personal data. Naga has full administrative access. Raja has limited operational access for talent review and India-side coordination.

No system can be guaranteed completely secure. We maintain an internal Data Breach Response Procedure and will assess notification obligations where an incident occurs.

12. Data-Protection Complaints

Email information@rocketflowstudios.com with the subject Data Protection Complaint. Include your name, application ID where applicable, and a description of your concern.

• We aim to acknowledge complaints within 48 hours.
• We aim to provide a full response within 30 days.

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or call 0303 123 1113.

13. Changes to This Policy

We may update this policy as the business, systems or legal requirements develop. The date at the top will show the latest version.

14. Contact