How we handle personal data

This Privacy Policy explains how SPR Glasgow collects, uses and protects personal data when you visit our website, request product information, create an account, or interact with our platform. It is written to help production teams, partners and individual users understand what data enters our systems and why.

We aim to keep data practices proportionate to the service we provide. That means we do not collect information simply because it may be useful later. We collect what is needed to operate the platform, respond to enquiries, maintain security, improve the user experience and comply with legal obligations that apply to us as a UK business.

The information we collect depends on how you use the service. It can include contact details such as your name, email address, company name, billing information, account credentials, support messages, and the production materials or prompts you choose to submit through the platform.

We may also collect technical and usage information such as IP address, browser type, device identifiers, pages viewed, referral source, session timing, feature usage, and high-level analytics events. This information helps us keep the platform stable, understand product demand and investigate misuse or reliability issues.

We use personal data to provide the SPR Glasgow service, including account access, customer support, payment administration, product communications and security monitoring. If you submit prompts, documents or creative briefing material, we use that information to generate the requested outputs and display them back to you inside the platform.

We also use data to improve the service over time. That may include reviewing support trends, understanding which workflows are adopted most often, measuring performance, preventing fraud, and planning product updates. Where possible, we use aggregated or de-identified information for internal analysis rather than relying on directly identifiable records.

Under UK GDPR, we rely on different legal bases depending on the activity. Most core processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, such as opening an account, responding to a sales enquiry, or providing access to the platform.

We may also process data where necessary for our legitimate interests, including protecting the service, improving product quality, preventing abuse and managing the business responsibly, provided those interests are not overridden by your rights and freedoms. Where consent is required, such as for certain cookies or optional marketing, we will ask for it separately and you can withdraw that consent later.

We share personal data only where there is a business need to do so. That includes infrastructure providers, hosting partners, email and support tools, analytics services, payment processors, and other vendors that help us operate the platform on our behalf. Those providers act under contractual terms that limit how they can use the data.

We may also disclose information where required by law, court order or regulatory request, or where disclosure is necessary to establish, exercise or defend legal claims. If our business is reorganised, merged, sold or transferred, relevant data may be part of that transaction subject to appropriate confidentiality safeguards.

We use cookies and similar technologies to keep the site functional, remember session preferences, understand aggregate traffic patterns and improve performance. Some cookies are strictly necessary for the service to operate, while others support analytics or communications features that are not essential.

Where the law requires it, we ask for your consent before placing non-essential cookies on your device. You can also control cookies through your browser settings, though disabling certain categories may affect site performance or limit access to some platform features.

Depending on your circumstances, you may have the right to request access to the personal data we hold about you, ask us to correct inaccurate information, request deletion, restrict certain processing activities, or object to processing carried out on the basis of legitimate interests.

You may also have the right to data portability and the right to withdraw consent where consent is the legal basis for processing. We may need to verify your identity before completing a request. If you believe your data has been handled unlawfully, you also have the right to complain to the UK Information Commissioner's Office.

We keep personal data only for as long as reasonably necessary for the purposes set out in this policy. Retention periods depend on the kind of data involved, the nature of the relationship, whether the account remains active, and any regulatory, accounting or dispute-related requirements that apply.

When data is no longer required, we delete it, anonymise it or place it beyond routine operational use in accordance with our internal retention approach. Backup copies may persist for a limited period until they are rotated out through normal backup cycles.

We use administrative, technical and organisational measures designed to protect personal data against unauthorised access, misuse, accidental loss, disclosure or alteration. Those measures include access controls, role-based permissions, secure infrastructure practices, monitoring and controlled vendor access.

No internet-based system can guarantee absolute security. For that reason, users should also take sensible precautions, including using strong passwords, protecting their devices and reviewing the material they upload. If we become aware of a notifiable personal data breach, we will act in line with applicable legal requirements.

SPR Glasgow is not directed at children and is intended for professional or adult users working in film, TV, branded content and related industries. We do not knowingly collect personal data from children under the age at which consent is legally valid in the relevant jurisdiction.

If you believe a child has provided us with personal data without appropriate consent, please contact us. If we learn that we have collected such data improperly, we will take steps to delete it or otherwise limit its use as quickly as reasonably possible.

Some of our service providers may process personal data outside the United Kingdom. Where that happens, we take steps intended to ensure that the transfer is protected by an appropriate lawful mechanism, such as adequacy regulations, contractual safeguards, or comparable measures recognised under applicable data protection law.

International transfers are assessed in the context of the service being provided, the nature of the data and the safeguards available from the recipient. We review these arrangements periodically to ensure they remain appropriate for the risk involved.

We may update this Privacy Policy from time to time to reflect changes in the platform, legal requirements, security practices, or how we use third-party service providers. When we do, we will revise the “Last updated” date at the top of this page.

If a change is material, we may also provide additional notice through the website, inside the product or by email where appropriate. Continued use of the service after an update means the revised policy applies from its effective date, subject to any rights you may have under data protection law.

If you have questions about this Privacy Policy, want to exercise your rights, or need more information about how personal data is processed, please contact our team by email at support@sprglasgow.com. We will review your request and respond within a reasonable period.

You can also write to us using the registered office address listed below. We may ask for enough information to verify identity before disclosing or changing personal data, particularly where the request concerns account records or billing information.