Privacy Policy

Last updated: 26 August 2026

This policy explains how Flayr FX Limited collects, uses and protects personal data when you visit www.flayrfx.com, enquire about our production, post-production, strategy or podcast services, buy a digital product from our shop, or subscribe to our updates.

1. Who we are

Flayr FX Limited is the data controller for the personal data described in this policy.

Flayr FX Limited
Registered in Scotland, company number SC682689
Registered office: 15 Glenorchy Terrace, Newington, Edinburgh, EH9 2DQ, Scotland
VAT registration number: 366694252
Email: studio@flayrfx.com

We are not required to appoint a Data Protection Officer. Data protection questions should be sent to the email address above.

2. The personal data we collect

2.1 When you contact us or enquire about services

Through our contact forms, or by email or phone: your name, email address, telephone number, company or organisation, and whatever you choose to tell us about your project, budget and timescales.

2.2 When you buy a digital product

Your name, billing address, email address, order details, purchase history, download activity, and the currency and amount paid. Card and payment details are entered directly into our payment providers’ systems — we never see or store your full card number. We receive only a confirmation of payment, the card type and the last four digits.

2.3 When you create an account

Your username, email address, password (stored in encrypted form), order history and any details you add to your profile.

2.4 When we work with you on a project

Contract and correspondence records, contributor and crew details, call sheets, invoicing and payment records, and any personal data contained in material you supply to us or that we capture on your behalf, such as footage, stills, audio recordings and contributor release forms.

2.5 When you subscribe to marketing

Your name and email address, plus records of which emails you opened or clicked, so we can tell what is useful and what is not.

2.6 Automatically, when you use the site

Your IP address, browser type and version, device and operating system, referring page, the pages you view and how long you spend on them, and similar technical data collected through cookies, server logs and analytics. See section 6.

We do not deliberately collect special category data (such as health, ethnicity or political opinions). If such data appears in production material you supply, we handle it only as needed to deliver the project and under the terms of our contract with you.

3. Why we use it, and our legal basis

What we do	Why	Legal basis
Respond to your enquiry and prepare a quote or proposal	To answer you and scope the work	Steps taken at your request before entering a contract; our legitimate interest in responding to business enquiries
Deliver production, post-production, strategy and podcast services	To perform the work you engaged us for	Performance of a contract
Process orders, deliver downloads and provide support	To supply what you bought	Performance of a contract
Manage your account	To let you access your orders and downloads	Performance of a contract
Take payment and prevent fraud	To get paid securely	Performance of a contract; our legitimate interest in preventing fraud
Keep accounting, tax and VAT records	Because we must	Legal obligation
Send marketing emails and updates	To tell you about our work and products	Your consent; or our legitimate interest in marketing similar products to existing customers, always with an opt-out
Measure how the site is used and improve it	To make the site work better	Your consent, given through the cookie banner
Protect the site from spam and abuse	To keep it secure and available	Our legitimate interest in site security
Show completed work in our portfolio and showreel	To demonstrate what we do	Our legitimate interest in promoting our business, subject to any confidentiality or embargo agreed with you
Establish, exercise or defend legal claims	To protect our position	Our legitimate interest in protecting our legal rights

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded they are not. You may object at any time — see section 8.

4. Marketing

We send marketing emails only where you have opted in, or where you have bought from us or enquired about our services and we are telling you about similar products and services. Every marketing email carries an unsubscribe link, and you can also email studio@flayrfx.com at any time to be removed. Unsubscribing from marketing does not stop service messages such as order confirmations, download links and invoices.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and only as far as they need it:

• Payment processing — Stripe, Inc. and WooPayments (operated by Automattic Inc.), which handle card payments and fraud checks.
• Website hosting and infrastructure — our hosting provider, who stores the site and its database.
• Email delivery and marketing — Brevo (Sendinblue), which sends our transactional and marketing email.
• Analytics and site management — Google, through Google Site Kit, Google Analytics and Google Tag Manager, where you have consented to statistics cookies.
• Spam and abuse protection — Google reCAPTCHA on our contact forms, and Jetpack (Automattic Inc.) for site security and statistics.
• Embedded media — YouTube (Google) and Vimeo, where video is embedded in a page. See section 6.
• Accountants, bookkeepers and professional advisers — for tax, audit and legal purposes.
• Production partners, crew and freelancers — where they are engaged on your project and need the information to do the work.

We may also disclose personal data where we are legally required to, or to establish or defend legal claims. If our business is sold or reorganised, data may transfer to the buyer under the same protections.

6. Cookies and similar technologies

Cookies are small files placed on your device. We use four categories:

• Functional — strictly necessary for the site to work, including keeping items in your basket, completing checkout, keeping you logged in, and remembering your cookie choices. These do not require consent.
• Preferences — remember settings such as display choices.
• Statistics — help us understand which pages are visited and how people navigate, through Google Analytics and Jetpack.
• Marketing — used to measure campaigns and, where applicable, to build a profile of your interests.

Preferences, statistics and marketing cookies are set only after you consent through our cookie banner. You can change or withdraw your consent at any time using the Manage consent control on the site, and you can block or delete cookies through your browser settings — though blocking functional cookies will stop the shop and checkout working.

Pages containing embedded YouTube or Vimeo video behave as if you had visited those sites directly. Those providers may set their own cookies and collect data about your interaction with the video, including linking it to your account if you are logged in to them. Their own privacy policies govern that processing.

7. Where your data is held, and for how long

Our website and database are hosted in the United Kingdom. Some of our providers — including Stripe, Automattic, Google and Brevo — process data outside the UK, including in the United States and the European Economic Area. Where data leaves the UK, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

We keep personal data only as long as we need it:

• Enquiries that do not become projects — up to 2 years from last contact.
• Client and project records, contracts and correspondence — 6 years from the end of the engagement, to cover the limitation period for claims.
• Orders, invoices and accounting records — 6 years from the end of the relevant accounting period, as required by HMRC and the Companies Act 2006.
• Account details — for as long as your account is open, then deleted or anonymised within 12 months of closure, subject to the accounting retention above.
• Marketing subscriptions — until you unsubscribe, then a minimal suppression record so we do not contact you again by mistake.
• Production masters, rushes and project archives — for the period agreed in the relevant project contract; where nothing is agreed, we archive for 12 months after final delivery and then delete.
• Website analytics — up to 14 months.
• Server and security logs — up to 12 months.

8. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data — this policy.
• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data, where we no longer have grounds to keep it.
• Restrict processing in certain circumstances.
• Data portability — receive data you gave us in a structured, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time, with no exceptions.
• Withdraw consent at any time, where we rely on it. This does not affect processing carried out before you withdrew.

To exercise any of these, email studio@flayrfx.com. We will respond within one month. We may ask you to confirm your identity first. There is normally no charge.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

9. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, restricted administrative accounts and regular software updates. No system is completely secure, but we take these obligations seriously and will notify you and the ICO where we are legally required to do so following a personal data breach.

11. Children

Our website and products are intended for people aged 18 and over. We do not knowingly collect personal data from children. Where a project involves contributors under 18, we handle their data under the terms of the project contract and with appropriate parental or guardian consent.

12. Changes to this policy

We may update this policy as our business or the law changes. The date at the top shows when it was last revised. Where changes are significant, we will bring them to your attention.