Privacy policy

Last updated: 11 October 2026

This policy explains how Flayr FX Limited collects, uses and protects personal data when you visit www.jamiesteedman.co.uk or get in touch about film, video or motion design work.

1. Who we are

www.jamiesteedman.co.uk is the portfolio site of Jamie Steedman, operated by Flayr FX Limited. Flayr FX Limited is the data controller for the personal data described in this policy.

Flayr FX Limited
Registered in Scotland, company number SC682689
Registered office: 15 Glenorchy Terrace, Newington, Edinburgh, EH9 2DQ, Scotland
VAT registration number: 366694252
Registered with the Information Commissioner’s Office: ZB403112
Email: studio@flayrfx.com

Our shop, customer accounts and digital product downloads are on a separate website, www.flayrfx.com, and are covered by the privacy policy published there. This policy covers this portfolio site only.

We are not required to appoint a Data Protection Officer. Data protection questions should be sent to the email address above.

2. The personal data we collect

2.1 When you contact us or enquire about work

Through the contact form on this site, or by email or phone: your name, email address, and, if you choose to give them, your telephone number and company or organisation, plus whatever you tell us about your project, budget and timescales. When you use the contact form we also record the date and time, your IP address and your browser type, to protect the form from abuse.

2.2 When we work with you on a project

Contract and correspondence records, contributor and crew details, call sheets, invoicing and payment records, and any personal data contained in material you supply to us or that we capture on your behalf, such as footage, stills, audio recordings and contributor release forms.

2.3 Automatically, when you use the site

Your IP address, browser and device type, and the pages you request are recorded in our server and security logs. If you accept analytics cookies, Google Analytics also records how you use the site, such as the pages you view, how long you stay, how you arrived and your approximate location (town or country, not your full IP address). We do not use advertising tools, and we do not build a profile of you.

2.4 Spam protection on the contact form

The contact form is protected by Google reCAPTCHA. When you start filling in the contact form, and when you send a message, reCAPTCHA collects information about your device and how you interact with the page, such as your IP address, browser and device details, and mouse and keyboard activity, and sends it to Google, which returns a score showing how likely the message is to come from a person rather than an automated program. We use that score only to decide whether to accept the message. Nothing is sent to reCAPTCHA if you only view the page. reCAPTCHA runs on the contact form only, and Google’s Privacy Policy and Terms of Service apply to it.

3. Why we use it, and our legal basis

What we do	Why	Legal basis
Respond to your enquiry and prepare a quote or proposal	To answer you and scope the work	Steps taken at your request before entering a contract; our legitimate interest in responding to business enquiries
Deliver editing, motion design, animation and video strategy work	To perform the work you engaged us for	Performance of a contract
Keep accounting, tax and VAT records for work we invoice	Because we must	Legal obligation
Protect the contact form and the site from spam and abuse, including through Google reCAPTCHA	To keep them secure and available	Our legitimate interest in site security
Measure how the site is used, with Google Analytics, so we can improve it	To understand which pages help visitors	Your consent, given through the cookie banner; you can withdraw it at any time
Show completed work in the portfolio, showreels and case studies	To demonstrate what we do	Our legitimate interest in promoting our business, subject to any confidentiality or embargo agreed with you
Establish, exercise or defend legal claims	To protect our position	Our legitimate interest in protecting our legal rights

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded they are not. You may object at any time: see section 8.

4. Marketing

This site does not have a mailing list, and we do not use your contact details to send marketing. If you ask us to keep you updated about our work, we will do so only with your agreement, and you can ask us to stop at any time by emailing studio@flayrfx.com. We do not sell or rent your details to anyone.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and only as far as they need it:

Website hosting and email: 123 Reg (part of the Host Europe group), which stores the site, its database and the messages sent through the contact form on servers in France, and delivers the email that tells us a message has arrived.
Spam protection: Google reCAPTCHA (Google Ireland Limited and Google LLC) on the contact form. See section 2.4.
Analytics: Google Analytics (Google Ireland Limited and Google LLC), only if you accept analytics cookies. See section 6.
Embedded media: YouTube (Google) and Vimeo, when you choose to play a video. See section 6.
Accountants, bookkeepers and professional advisers: for tax, audit and legal purposes.
Production partners, crew and freelancers: where they are engaged on your project and need the information to do the work.

We may also disclose personal data where we are legally required to, or to establish or defend legal claims. If our business is sold or reorganised, data may transfer to the buyer under the same protections.

6. Cookies and similar technologies

Cookies are small files placed on your device. This site uses very few, and none for advertising:

Session cookie (strictly necessary): a single cookie, js_sid, that keeps forms on the site secure. It holds no personal information and is deleted when you close your browser.
Google reCAPTCHA (strictly necessary for security): only once you start filling in the contact form, reCAPTCHA may set or read cookies from Google to tell people apart from automated programs. See section 2.4.
Google Analytics (only with your consent): cookies named _ga that help us see which pages are visited and how people find the site. They are set only if you choose Accept analytics on the cookie banner; if you reject them, or make no choice, Google Analytics does not load at all. Your choice is remembered for a year, and you can change it at any time with Cookie settings at the foot of every page.
Embedded video: videos are shown as a still image until you press play. Only then does the player load from YouTube (in its privacy-enhanced mode, youtube-nocookie.com) or Vimeo, which may set their own cookies under their own privacy policies.

You can clear or block cookies in your browser settings. Blocking the session cookie or reCAPTCHA will stop the contact form from working; you can always email us instead.

7. Where your data is held, and for how long

Our website, database and email are hosted by 123 Reg on servers in France, in the European Economic Area, which the UK recognises as giving adequate protection. Some of our providers, including Google (for reCAPTCHA, Analytics and YouTube) and Vimeo, process data outside the UK, including in the United States and the European Economic Area. Where data leaves the UK, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

We keep personal data only as long as we need it:

Contact form messages: deleted automatically 2 years after they arrive. Enquiries that become projects are kept with the project records below. The IP address and browser details saved with a message are removed automatically after 12 months.
Client and project records, contracts and correspondence: 6 years from the end of the engagement, to cover the limitation period for claims.
Invoices and accounting records: 6 years from the end of the relevant accounting period, as required by HMRC and the Companies Act 2006.
Project masters, rushes and archives: for the period agreed in the relevant project contract; where nothing is agreed, we archive for 12 months after final delivery and then delete.
Server, activity and security logs: deleted automatically after 12 months.
Backups: up to 12 months, after which deleted data is gone from our backups too.
Google Analytics data: 14 months, then deleted by Google.

8. Your rights

Under UK data protection law you have the right to:

Be informed about how we use your data: this policy.
Access a copy of the personal data we hold about you.
Rectification of data that is inaccurate or incomplete.
Erasure of your data, where we no longer have grounds to keep it.
Restrict processing in certain circumstances.
Data portability: receive data you gave us in a structured, machine-readable format.
Object to processing based on legitimate interests.
Withdraw consent at any time, where we rely on it. This does not affect processing carried out before you withdrew.

To exercise any of these, email studio@flayrfx.com. We will respond within one month. We may ask you to confirm your identity first. There is normally no charge.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

9. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, restricted administrative accounts and regular software updates. No system is completely secure, but we take these obligations seriously and will notify you and the ICO where we are legally required to do so following a personal data breach.

11. Children

This website is intended for people aged 18 and over. We do not knowingly collect personal data from children. Where a project involves contributors under 18, we handle their data under the terms of the project contract and with appropriate parental or guardian consent.

12. Changes to this policy

We may update this policy as our business or the law changes. The date at the top shows when it was last revised. Where changes are significant, we will bring them to your attention.