Privacy Notice

This Privacy Notice sets out how Brown Bag Films (“BBF”, “we”, “us” or “our”) as Data Controller collects and processes personal data about: 

• visitors to this website or other related company websites and/or social media accounts (collectively “websites”); 

• individuals who engage with us for recruitment purposes; 

• independent contractors who supply services to us; 

• individuals who are employed or engaged by suppliers of goods or services or parties tendering to provide goods or services; 

• individuals with whom we communicate or interact with in the course of business; 

• individuals who attend events which we organise; and 

• visitors to our studio(s). 

This Privacy Notice is issued pursuant to the EU General Data Protection Regulation (the GDPR) effective from 25 May 2018, supplemented by Irish legislation (primarily the Data Protection Acts 1988 – 2018 and ePrivacy Regulations 2011). 

1. INFORMATION WE COLLECT 

For Visitors to Our Websites, 

 we may process a limited amount of personal data included but not limited to the following: 

• Identity Data – this includes first name, last name, title, date of birth and gender. 

• Contact Data – including any email address which you provide if you subscribe to our newsletter. 

• Technical Data – includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website. As you interact with our website, we may collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please see our cookie policy at the end of this Privacy Notice for further details. 

• Usage Data – includes information about how you use our website. We also use aggregated non-personally identifiable data from certain third parties such as analytics providers such as Google to help us understand how visitors engage with our website.  

For individuals who are engage with us for recruitment purposes:   

we collect and process personal data relating to job applicants (either directly from candidates or sometimes from an employment agency). This includes but is not limited to:  

• name, address and contact details, including email address and telephone number;  

• details of qualifications, skills, experience and employment history;  

•  whether or not you have a disability for which the organisation needs to make reasonable accommodation in accordance to the Employment Equality Acts 1998-2015 and the Equality Act 2004 during the recruitment process; and  

• information about your entitlement to work in Ireland in accordance to Employment Permits Act 2006.  

This data may be collected from application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. We may also collect personal data about you from third parties, such as references supplied by former employers and in some instances we may collect information through background check agencies (which would include information about any previous criminal convictions). 

For Independent Contractors who supply services to us:  

we collect and process personal data such as name, address, contact details, bank account details, payment information, ID documentation such as passport or national ID, tax documentation and in some instances (e.g. if working with children) we may collect information through background check agencies (which would include information about any previous criminal convictions). 

For Individuals who are employed or engaged by suppliers of goods or services  

we collect and process personal information such as: your name, address, telephone, email,  job title, IP address, and any correspondence with you or with the supplier you represent, financial information and other information that is relevant to the receipt of those services or goods.  If we need to provide or allow you to have access to our systems or premises, for security reasons, we may monitor and record that access. 

For Individuals who are employed or engaged by clients to whom we provide services:  

we collect and process personal data (directly or indirectly, including from publicly accessible sources) and including: names, addresses, job titles, contact information and other information that is relevant to the provision of our services.  

For Individuals who register to attend events we organize (“Events”):  

we may request of these individuals to provide us with their personal data, including through our websites or at the Events which may include name, address, telephone, email address. We may have a photographer or a videographer present at the Events and we may collect and use the photographs or recordings on our websites, social media sites or in printed material. If you have any objection to this, you can inform the photographer/videographer at the Events or notify the organizer of the Event(s) in advance. 

With your consent we may retain your contact details on file to notify you about our studio, our community, social and cultural events, provide you with information about our studio, and to reply to emails and reservations or studio tour enquiries/confirmations.  

For Visitors to our Studio(s):

we collect and process personal information such as: your name, address, telephone, email. Your image may be captured on our CCTV system. 

2.  HOW WE USE YOUR PERSONAL DATA 

We will not hold or process any personal data that is not necessary for our stated purposes, including but not limited to recruitment. This means we do not retain sensitive personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, or data concerning health or sexual orientation, unless legally required or explicitly consented to. 

The purposes for which we use personal data and the legal basis for which the processing is necessary or permitted are as follows: 

4. LEGAL BASIS FOR PROCESSING PERSONAL DATA 

3. SHARING OF PERSONAL INFORMATION  

We may disclose personal data to: 

• Third parties, including cloud service providers, who provide a service to us 

• A public authority in the event that we are required to do so by law 

• A third party where we are under a legal obligation to transfer it to that third party or where we provide it to a client who is under such legal obligation 

• In the natural course of business where necessary in line with existing legal basis 

• A prospective seller or buyer of any of our assets or business 

We will not disclose your personal data to any third party except as required by law, pursuant to regulatory obligations, or with your explicit consent. We do not sell, rent, or share your personal data for marketing purposes or any unauthorized use. 

Where it is necessary to transfer personal data outside of the EEA, we will ensure appropriate safeguards are in place to protect the privacy and integrity of such personal data. 

4.  DATA SECURITY 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

5.  DATA RETENTION 

We will retain personal data only for as long as necessary for the purposes for which it was collected; as required by law; and for the purposes of satisfying any legal, accounting or reporting requirements or the exercise or defence of legal claims that may be brought by or against us. 

We will retain personal data about job applicant candidates for no more than one year.  

Our retention practices may be reviewed and updated from time to time in line with legal requirements and best practice. 

6.  DATA SUBJECTS RIGHTS 

Where we, as data controller, process your personal data, you have certain rights as follows: 

• Access: the right to request a copy of your personal data  

• Rectification: the right to request that we correct any inaccurate or incomplete personal information we hold about you 

• Erasure: the right, in certain circumstances, to request that your personal data be deleted  

• Data Portability: the right to request that we transmit your personal data, in an electronic and structured form to you or to another party or to give you a copy of it so that you can transmit it to a third party, where technically feasible. 

• Right to restrict processing: the right to request that we halt or suspend the processing of your personal data in certain circumstances,  

• Right to object: the right to object to us processing your personal data where we are doing so on the basis of a legitimate interest (or those of a third party) 

• Automated processing: the right to not be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects you. 

If you wish to exercise any of the rights set out above, please contact us. Details in the ‘Contact Us’ section below. 

If you have any issues about our handling of your personal information or about our data protection compliance, you have the right to make a complaint at any time to the Data Protection Commission (DPC), which is the Irish supervisory authority for data protection legislation. You also have the right to lodge a complaint with the data protection authority in the Member State of your residence, place of work or place of an alleged infringement. 

Opting Out 

You can ask us to stop sending you newsletters at any time by following the unsubscribe link and edit preferences link in the newsletter mail outs or by contacting us.  Details in the ‘Contact Us’ section below. 

Withdrawing consent 

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please email us. Details in the ‘Contact Us’ section below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. 

7. THIRD-PARTY LINKS 

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit. 

8. COOKIE POLICY

Please see our full Cookie Policy.

9. CHANGES TO THIS PRIVACY NOTICE 

We reserve the right to update this privacy notice from time to time. The most up to date privacy notice will be posted to our website and dated for the date of the last update. We may also notify you in other ways from time to time about the processing of your personal information. 

10. CONTACT US 

If you have any questions about this privacy notice or how we handle your personal information, please email dataprotection@brownbagfilms.com for further information. Or telephone 01-872 1608 and ask for the legal department.

11. COMPLAINTS 

Please also note that you have the right to make a complaint at any time to the Data Protection Commission (DPC), the Irish supervisory authority for data protection issues. Contact details of the DPC are available at www.dataprotection.ie. We would, however, appreciate the chance to deal with your concerns before you approach the DPC. 

12. COPYRIGHT AND TRADEMARK NOTICE

Reproduction of part or all of the contents of this website is prohibited. The information and graphics contained in this site are copyright protected by Brown Bag Films and its respective clients. The trademarks and logos displayed on the site are registered trademarks of Brown Bag Films and other organisations. No part of this site may be permanently stored or copied for further distribution, or transmitted in any form or by any means without written permission from Brown Bag Films. Exceptions are made for use of materials where downloads or embed codes are clearly stated which may be used for non-commercial purposes.

Accessibility

At Brown Bag Films, we understand and appreciate that people with disabilities may have different needs.  Should you require any information from our website in a different format or if you have any questions or feedback about our accessibility standards and policy, please contact us. 

Legal & Regulatory Disclosures

Gender Pay Gap Report 2024 - Ireland

Gender Pay Gap Report 2023 - Ireland

Gender Pay Gap Report 2022 - Ireland

BROWN BAG FILMS Unlimited Company
Company registered in Ireland at: Unit 20, Block C, Smithfield Market, Dublin 7 D07 PV06, Ireland.
Company Registration number: 243929 (Estd. 1994)
VAT Registration number: 8243929P
Brown Bag Films and its logo device are registered trademarks.
Directors: C. Gaffney, D. O'Connell, V. Commisso (Canadian), L. Cornally