CineNova (BFI) Privacy Policy
Your rights and how we use personal information
Updated September 2025
The British Film Institute (the “BFI”, “we”) is a registered charity (number 287780), Royal Charter Body, National Lottery distributor and non-departmental public body funded by the department of Digital, Culture, Media and Sport.
The BFI is committed to respecting and protecting your personal information.
This policy applies to all the BFI’s activities, services, products and platforms.
Who we are and contact details
The BFI is the Data Controller and Ruth Thomson is the Data Protection Officer under the UK’s Data Protection Act 2018 and the EU’s General Data Protection Regulation 2016.
All questions and complaints about the BFI’s use and handling of personal information should be addressed to dpo@bfi.org.uk.
You also have the right of complaint to the UK’s Supervisory Authority for Data, the Information Commissioners Office (the “ICO”). See ico.org.uk/make-a-complaint.
Information about personal data relating to volunteering, working for or applying to work for the BFI can be found here: BFI Privacy Notice: Workforce and Recruitment.
Information we may collect about you
Information you give us
- Your prefix and name, billing and delivery address, postcode, email address, phone numbers, gender, date of birth
- Diversity monitoring information (anonymously unless stated otherwise)
- Job title, personal identification documents
- Data relating to access or dietary requirements
- Payment card information
- If you are making a grant application, your position within the company applying and relevant experience
- If you are a student, your course details, relevant experience, school, college or university
You may provide us with this information when you set up an account (for example BFI Player, membership), apply for a grant (BFI Film Fund), apply for a course (BFI Education), apply to the BFI’s certification unit, buy tickets (BFI Southbank, BFI IMAX, BFI Festivals), fill in a form (competitions and surveys), complete an application form or otherwise apply for a job either directly or via a third party, apply to volunteer, or correspond with us by phone, email or in writing.
Information we collect automatically
- Device IDs, IP addresses and other unique identifiers
- Your activity on our services and platforms such as title selections and browsing history
- Advertising identifiers and information collected by cookies (see cookies section below)
Information we collect about you from other sources
- Service providers that help us determine a location based on your IP address
- Select partners that make our services available on their platform or with whom we offer co-branded services or engage in joint marketing
- Publicly available information such as geo-demographic information and measures of capacity and propensity for giving (for example Companies House)
- Social media, depending on your settings and permissions (for example Facebook and Twitter)
Third parties may collect information about you
When using our websites and platforms third parties may collect information about you. This can be controlled by adjusting the settings in your internet browser. There is more detail about adjusting your browser settings on the Information Commissioner’s Office website.
Why we collect and process your personal information
We use your personal data for the following purposes:
- Carrying out research in the public interest
- Maintaining, preserving and enhancing the BFI National Archive
- Providing customer service when you visit, make use of or access BFI premises, services or platforms
- Administering accounts, applications, contracts, enquiries or complaints
- Processing payments
- Fulfilling ticket, product, donation and membership requests
- Contacting you
- Providing you with information about things we think may interest you
- Using pseudonymised details to show you advertising on social media platforms and other websites, including services such as Meta Custom Audience
- Sharing pseudonymised personal data with advertisers (such as Meta or Google) to help identify similar customers or serve relevant adverts
- Preventing, detecting and investigating illegal activity such as fraud
- Analysing and improving our services based on members, audiences and customers
- Keeping personal information accurate
- Using CCTV recording equipment in and around our premises for security purposes
If fraud is detected, you could be refused certain services, finance, or employment. For more details, see Fair Processing Notices for Cifas’s Databases.
Special categories of personal information
Data protection law recognises certain “special categories” of personal information, including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning a person’s sex life or sexual orientation.
We will only collect and use this information where you have given explicit consent. For example, you may choose to tell us about a health condition before attending an event and we will only use it for that event.
Lawful bases for processing your personal information
Our legal basis depends on the type of personal information and how we use it. There are 6 lawful bases:
- Consent acquiring your agreement for a specific purpose. You can withdraw consent at any time by emailing dpo@bfi.org.uk
- Public task required work as a public charity, for example maintaining and enhancing the BFI National Archive
- Legitimate interests where our interests are not overridden by your rights, for example contacting you after you show active interest
- Contract fulfilling a contract, for example BFI Player subscription or membership
- Legal obligation where we must use data as prescribed by law
- Vital interests protecting your health and personal safety
Transfers outside the EEA
Where we transfer personal information outside of the EEA for processing, this is carried out in accordance with applicable laws and with third parties we trust.
Retention policies and periods
We only keep personal information for as long as necessary for the purpose it was collected. This depends on the category of information and how it is used.
For precise information on retention periods, contact dpo@bfi.org.uk. If you ask us to stop direct marketing, we will keep the minimum information needed to respect that request.
Security
We use administrative, physical, managerial and technical measures to safeguard personal information against loss, theft and unauthorised use.
Fundraising
The BFI may use personal information to administer your relationship with the BFI. We may analyse personal information to create a profile of interests and preferences so we can contact you with relevant information.
To change how we contact you or how we process your personal information, email dpo@bfi.org.uk.
Your rights in personal information
Your personal information is your data and you are in control of it. Where you have an account with us, you can access it and amend the data we hold and marketing preferences.
You can ask us for the information we hold about you, how we use it and why. Contact dpo@bfi.org.uk.
- Ask for incorrect information to be updated (right to rectification)
- Restrict or object to processing in specific ways (right to restrict, right to object, rights related to automated decision making)
- Ask for deletion (right to erasure, sometimes called the right to be forgotten)
- Ask for a digital copy (right to digital portability)
Some rights are limited to defined circumstances and we may not always be able to comply. We will tell you if this is the case. For more information, see ICO guidance.
Changes to this policy
We update this policy from time to time to reflect changes to legal or regulatory requirements and changes in our activities, services or platforms. The date of the last update will be noted at the bottom of this policy.
Definitions
Personal information
Personal data means data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller. This includes any expression of opinion and any indication of intentions in respect of the individual.
Data controller
An individual or organisation which determines the purposes for which, and the manner in which, personal data are processed.
Data processor
An individual or organisation who processes personal data on behalf of the data controller.
Data processing
Anything you do with data including collecting, recording, organising, storing, adapting, or disclosing personal information.
Data Protection Officer
The BFI’s Data Protection Officer, Ruth Thomson (dpo@bfi.org.uk), assists the BFI to monitor internal compliance, informs and advises on obligations, and provides a contact point for data subjects and the ICO.