Privacy policy

This Privacy Notice relates to employees, workers and contractors of Atlantic Managed Services Limited and the companies within the Atlantic group (the “Atlantic Group”) and sets out how we collect and use your personal data.

The purpose of this Privacy Notice is to give you information about what personal data we process, how and why and what your rights are in accordance with the retained version of the EU General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018.

The Atlantic Group company named in your contract of engagement (with their address as set out in that contract) acting in its capacity of data controller, provides this Privacy Notice regarding the processing of your data for the purposes related to the performance of the working relationship (as further described below) with you. You can contact us at the following email address:

privacy@atlanticproductions.co.uk.

This Privacy Notice applies to:

1. any employee, subject to any type of (employment) agreement, including any internship or apprenticeship contract, training programme, access-to-work contract, on-call contract, and, when necessary (for example in emergency situations and for benefits administration), to such employee’s spouse, domestic/civil partner or dependents (together dependents);
2. self-employed workers and independent contractors and freelancers;
3. any other individual performing a work activity or professional performance for the benefit of the Company.

(the above listed individuals are collectively defined as you and the relevant agreement with the Company, whatever form it takes as described under a), b) and c) above, is also defined as the working relationship).

Before entering into a working relationship or in the course of the working relationship with the Company, the Company will collect data or may have data collected about you through the application and recruitment process either directly from you or from a third party such as an employment agency by way of CVs, other identity documents or correspondence or completed personal detail forms. We will collect additional personal data in the course of work-related activities throughout the period of you working for us. We refer to such information as personal data. Personal data, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). Personal data that we collect, store and use may include, for example, the following:

Personal Details: name, employee identification number, work and home contact details (email, phone numbers, physical address), language(s) spoken, gender, date and place of birth, national insurance number, driving licence information, marital/civil partnership status, domestic partners, dependents, emergency contact information and photographs, employment status (e.g., active, inactive, maternity replacement).
Documentation Required under Immigration Laws: Citizenship, passport data, details of residency or any work permit.

Compensation and Payroll: Base salary, bonus, benefits, compensation type, details on stock options, stock grants and other awards, currency, pay frequency, effective date of current compensation, salary reviews, banking details, working time records (including vacation and other absence records, leave status, hours worked), pay data and life insurance beneficiaries.

Position: Description of positions, job title, management category, job code, salary plan, pay grade or level, job function(s) and sub function(s), details of any directorships, company name and code (legal employer entity), branch/unit/department, location, employment status and type, full-time/part-time, terms of employment, employment contract, work history, hire/re-hire and termination date(s) and reason, length of service, business travel details, retirement eligibility, promotions and disciplinary records, date of transfers, and line manager(s) information.

Talent Management Information: Details contained in letters of application and resume/CV (e.g., previous employment background, education history, professional qualifications, language and other relevant skills, certification, certification expiration dates), development programmes planned and attended, e-learning programmes, performance and development reviews, willingness to relocate and information used to populate employee biographies.
Management Records: Details of any shares of common stock or options.

System and Application Access Data: Information required to access company systems and applications such as active directory, email address, employee ID, other system and application user IDs and passwords, electronic content produced using company systems, building access information from any access control card system, office premises CCTV footage, access to documents and other materials, as well as incident response data (to the extent permitted by local legislation and Company policy).

We may also process special categories of data, when permitted by local law. Such data include criminal background checks (if authorised under local laws), health/medical information or disability status, trade union membership information, religion, race or ethnicity when necessary. We collect this information for specific purposes, such as health/medical information in order to accommodate a disability or illness and to provide benefits; and diversity-related personal data (such as gender, race or ethnicity) in order to comply with legal obligations and internal policies relating to diversity and anti-discrimination. We will only use such sensitive information for the purposes as described in paragraph 4 and as provided and permitted by law.

We will process your personal data in compliance with applicable laws for the following purposes:

1. Managing Workforce: HR administration and managing work activities and personnel generally, including recruitment, absence, other types of leave (including maternity, paternity, adoption parental and shared parental leave), performance management, promotions and succession planning, rehiring, salary and payment administration, pension and benefits administration, managing business expenses and reimbursements, planning and monitoring of training requirements and career development activities and skills, providing references, managing sickness absence, recording any disciplinary or grievance processes, making decisions on continued employment or engagement, and checking you are legally entitled to work in the United Kingdom.
2. Communications and Emergencies: facilitating communication with you, ensuring business continuity, protecting the health and safety of employees and others.
3. Business Operations and security: operating and managing IT and communications systems, managing product and service development and improvement, managing and allocating company assets and human resources, strategic planning, project management, business continuity, compilation of audit trails and other reporting tools, maintaining records relating to business activities, budgeting, financial management and reporting, communications, managing mergers, acquisitions, sales, re-organizations or disposals and integrations, building security and crime prevention.
4. Compliance: Complying with legal and other requirements, including audits, inspections and other requests from government or other public authorities.
5. Dispute resolution, responding to legal process such as a court summons, pursuing legal rights and remedies.
6. Health and safety: Complying with legal obligations on occupational safety and health. (defined together as the Contractual Purposes).
7. Intranet: Publishing details of the employee including the photograph on the Company’s intranet where applicable (the Intranet Purposes);
8. Corporate and commercial matters: if the Company is involved in a merger or transfer of all or a material part of its business, the Company may transfer your information to the party or parties involved in the transaction (the Other Purposes);

Some of the above purposes for processing will overlap and there may be several purposes which justify our use of your personal data. If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We process your personal data to perform the obligations under the contract with you, to comply with legal obligations arising in the context of your contract, as well as to pursue the legitimate interests of the Company where your interests and fundamental rights do not override those interests.

The processing of your personal data for Contractual Purposes is mandatory as the refusal to provide the personal data would make it impossible to sign and perform the contract between you and the Company.

The processing of your personal data for Intranet Purposes and Other Purposes, are carried out in compliance with the legitimate interest of the Company which adequately balances the interests of the Company and you. That processing is not mandatory and, for this reason, you may oppose the processing as described in Paragraph 9 of this Privacy Notice. If you object to this data processing, data will not be processed for the legitimate interest purposes, but we will continue to process any relevant data on another legal basis as appropriate.

We process your personal data through both electronic and manual means and it is protected by appropriate security measures.

We will take appropriate administrative, technical, personnel and physical measures designed to protect personal data that are consistent with applicable privacy and data security laws and regulations that in particular include protecting personal data from misuse or accidental, unlawful or unauthorised destruction, loss, alteration, disclosure, acquisition or access.

This includes requiring service providers to use appropriate measures to protect the confidentiality and security of personal data and comply with the law.

All personnel within Atlantic Group will generally have access to your business contact information such as name, position, telephone number, business postal address and email address.

We may share your personal data for the purposes specified in this Privacy Notice with the following categories of entities that can be located within and, in compliance with Paragraph 8 below, outside the United Kingdom as follows:

1. Other entities in the Atlantic group: Companies in Atlantic Group which need access to your personal data in order to manage services and activities coordinated at the group level.
2. Professional Advisors: Accountants, auditors, lawyers, insurers, bankers, and other professional advisors in all of the countries in which Atlantic Group operates.
3. Service Providers and Clients: Companies that provide products and services to the Company or Atlantic Group such as payroll, pension scheme, benefits, human resources, performance management, training, expense management, IT systems supply and support, assistance with equity compensation programmes, credit cards, medical or health services, trade bodies and associations services, travel services and others. Companies which the Company or Atlantic Group provide products or services to such as broadcasters.
4. Public, Judicial, Governmental Authorities and Litigants: Entities that regulate or have jurisdiction over the Company or Atlantic Group such as regulatory authorities, law enforcement, public bodies and judicial bodies or other third parties in connection with judicial or regulatory proceedings.
5. Other Purposes: A third party in connection with any proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of Atlantic Group’s business, assets or stock (including in connection with any bankruptcy or similar proceedings).

The types of data processors appointed by the Company include providers such as PeopleHR providing HR management software to support the Company’s operations. Data processors are required to take appropriate security measures to protect personal data in line with our policies.

Access to personal data within the Company will be limited to those who have the “need to know” for the purposes described in Paragraph 4 of this Privacy Notice, and may include your managers and their designees.

Due to the global nature of Atlantic Group’s operations, the Company may disclose personal data to personnel and departments throughout Atlantic Group (and to some third parties providing services as described above such as PeopleHR (mentioned above) the Company’s pension provider) to fulfil the purposes described in Paragraph 4 of this Privacy Notice. This may include transferring personal data to other countries (including countries other than where you are based that have a different data protection regime than the one existing in the country where you are based). If you are located in the United Kingdom, this may include countries outside of the United Kingdom and in particular countries in the European Economic Area and the United States. We have adopted appropriate safeguards to protect your personal data regardless of where it resides. You can find the list of European Union member states by clicking on the following link: https://european-union.europa.eu/principles-countries-history/eu-countries_en. Further information can be provided by filing a request to the Company as per Paragraph 9 of this Privacy Notice.

You have the right to:

1. Obtain confirmation as to whether or not your personal data exists and to be informed of its content and source, verify its accuracy and request its rectification, update or amendment.
2. Request the deletion, anonymisation or restriction of the processing of your personal data processed in breach of the applicable law.
3. Object to or request the limiting of the processing, in all cases, of your personal data for legitimate reasons.
4. Receive an electronic copy of your personal data, if you would like to port the personal data, which you have provided to us, to yourself or to a different provider (data portability), when the personal data is processed by automatic means and the processing is either (i) based upon your consent or (ii) necessary for the provision of the company service; and
5. lodge a complaint with the relevant data protection regulatory authority.

You may send your request to your local Human Resources representative. Please note, however, that certain personal data may be exempt from such access, correction and deletion requests pursuant to applicable data protection laws or other laws and regulations. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

The personal data collected pursuant to this Privacy Notice is retained for the duration of the working relationship and, after the termination of the working relationship up to seven (7) years, except for longer periods where the retention of the personal data is necessary due to litigation, requests filed by competent authorities or in compliance with applicable laws.

In any case, we will take steps to ensure that the personal data processed is relevant and not excessive for its intended use, and is accurate and complete for carrying out the purposes described in this Privacy Notice. Accordingly, we will retain personal data for the period necessary to fulfil the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. After the applicable retention period has ended, the Company shall securely destroy or delete the personal data or anonymise it.

Please keep personal data up to date and inform us of any significant changes to personal data. You agree to inform your dependents, whose personal data you provide to the Company, about the content of this Privacy Notice, and to obtain their consent (provided they are legally competent to give consent) for the processing of that personal data by the Company as set out in this Privacy Notice. You further agree to follow applicable law and both the Company’s and Atlantic Group’s policies, standards and procedures that are brought to your attention when handling any personal data to which you have access in the course of your working relationship with the Company. You will not access or use any personal data for any purpose other than in connection with and to the extent necessary for your working relationship with the Company. You understand that these obligations continue to exist after termination of your working relationship with the Company.

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data. If you have any questions about this Privacy Notice, please contact privacy@atlanticproductions.co.uk or your line manager.

This privacy notice was last updated on 05 February 2025.