Privacy Policy

Last updated: 15 October 2026

Who we are and our role as data controller

spotlumy operates as the data controller for the purposes of this privacy notice. We are a commercial organisation based in the United Kingdom specialising in professional video operations, live signal management, content distribution, camera work and the creation of reliable high-quality feeds for news programmes and television broadcasting. We determine the purposes and means of processing personal data collected through our website and related services. Our registered office is at Holmbush Road, Putney, London SW15 3LE, United Kingdom and you can reach us using the contact details published on our website including [email protected] and +44 7575 701535.

Scope of this notice and who it covers

This notice applies to all visitors to our website, individuals who submit enquiries through our contact form, prospective clients, suppliers and any other persons whose personal data we process in connection with our media feed services. It does not cover processing carried out by third parties that operate their own websites or services even if those sites are linked from ours. We process data only to the extent necessary for the legitimate operation of our business and in compliance with UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

Categories of personal data and sources

We collect basic identification data such as name and job title, contact information including email address and telephone number, technical data such as IP address, browser type and device identifiers, and usage data derived from cookies and similar technologies. In limited cases we may receive additional information from professional networks or publicly available industry directories when you engage with us in a business capacity. We do not collect special category data unless you voluntarily provide it in a contact form and we have a clear lawful basis for doing so.

Purposes of processing and legal bases

We process personal data to respond to enquiries submitted via the contact form on the basis of legitimate interest or consent where appropriate. We maintain records of business communications to fulfil contractual obligations or to take steps prior to entering a contract. Technical data is processed to ensure website security and functionality under legitimate interest. Where we send marketing communications we rely on consent or soft opt-in under PECR and you may withdraw that consent at any time. Each purpose is documented internally with the corresponding lawful basis recorded in our processing register.

Whether providing data is required

Providing contact details through our form is voluntary. If you choose not to supply the information we request we may be unable to respond to your enquiry or deliver the services you seek. Certain technical data is collected automatically when you visit the site and you cannot prevent this collection without disabling essential website functions.

Cookies and similar technologies

We use cookies and similar tracking technologies to improve site performance, remember user preferences and analyse traffic. A separate Cookie Policy explains the types of cookies deployed, their purposes and how you can manage your preferences. You should consult that policy for detailed information on cookie categories and consent mechanisms.

Processors, recipients and disclosures required by law

We engage trusted service providers including hosting companies, analytics platforms, email delivery services and professional advisers who act as processors under written contracts. Personal data may be disclosed to law enforcement or regulatory bodies where we are legally required to do so. We do not sell personal data to third parties for marketing purposes.

International transfers and safeguards

Some of our service providers are located outside the United Kingdom. Where personal data is transferred to countries without an adequacy decision we implement appropriate safeguards such as standard contractual clauses approved by the UK Government together with supplementary technical and organisational measures.

Retention periods and criteria

We retain personal data only for as long as necessary to fulfil the purposes described in this notice. Enquiry records are kept for up to three years after the last contact. Technical logs are retained for twelve months. Contractual records are kept for six years to meet statutory accounting and limitation requirements. Retention schedules are reviewed annually and data is securely deleted or anonymised once the period expires.

Security and data minimisation

We apply industry-standard technical and organisational measures to protect personal data against unauthorised access, loss or alteration. These include encryption in transit, access controls and regular staff training. We collect only the minimum data required for each processing activity and conduct periodic reviews to ensure data minimisation principles are observed.

Your data subject rights and how to exercise them

Under UK GDPR you have the right to access, rectify, erase, restrict processing, port data and object to processing. To exercise any of these rights please contact us in writing using the details published on our website. We will respond within one month and may request identification to verify your identity before taking action.

Right to withdraw consent and object to marketing

Where processing is based on consent you may withdraw that consent at any time by contacting us or using the unsubscribe link in any marketing email. You also have the right to object to direct marketing and to any profiling we may undertake for marketing purposes.

Right to complain to the supervisory authority

If you believe we have not handled your personal data in accordance with the law you have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority. Contact details for the ICO are available on its official website.

Children and age restrictions

Our services are intended for professional users in the media and broadcasting industry. We do not knowingly collect personal data from children under the age of eighteen. If we become aware that data from a minor has been collected we will delete it promptly.

Automated decision-making and profiling

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any analytics we perform are used solely for internal service improvement and do not result in automated decisions about individuals.

Changes to this policy

We may update this privacy notice from time to time to reflect changes in law, technology or business practices. The date of the most recent revision appears at the top of the page. Continued use of the website after an update constitutes acceptance of the revised notice.