Privacy Policy

UNIT LIST is operated by UNIT LIST LTD, a company registered in England and Wales (company number 17247712), with its registered office at 4 St Georges Road, Sevenoaks, TN13 3ND ("UNIT LIST", "we", "us", "our"). UNIT LIST is a professional crew network for UK Film and High-End Television (HETV) crew.

UNIT LIST LTD is the data controller for personal data processed in connection with the Platform, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For privacy enquiries, data subject requests, or to raise a complaint, contact us at: admin@unitlist.co.uk

We collect and process the following categories of personal data about registered members:

• Account information: Name, email address, authentication identifiers (e.g. Google or Apple sign-in ID).
• Profile information: Professional role, department, location, biography, availability status, years of experience, profile photo, agency contact, awards.
• Professional credits: Production titles, roles held, dates, production companies, and the names and roles of collaborators you choose to list ("worked with").
• CV and documents: PDF CVs you upload to the Platform.
• Work photos: Images you upload to your portfolio gallery.
• Messages: Direct messages sent between members on the Platform. Messages sent through a job enquiry — where you press "Message" on a job posted on UNIT LIST — can be read by our administrators so we can see whether the feature is working and act on abuse. Each such read is recorded in our admin log. Ordinary private conversations between members are not readable this way.
• Endorsements: Endorsements and reviews you give to or receive from other members.
• Contact details: Phone number, Instagram and LinkedIn URLs, and other contact methods you choose to provide.
• Subscription and payment data: Whether you are a paid subscriber, your subscription status, and a reference to your payment provider (Stripe for web, Apple App Store for iOS, Google Play for Android). We do not store full payment card details — these are held by the relevant payment processor.
• Stand-in details: If you list yourself as a stand-in, we collect and display your height and hair colour. These are required for a stand-in profile to appear in the directory, and they are shown on your public profile page.
• Other name: A maiden or former name, where you choose to add one so people who knew you under it can find you.
• Blocked members: A list of members you have blocked, so we can keep their content and messages away from you.
• Usage and technical data: Profile views, search appearances, in-app activity, device type, operating system, push notification token (a device identifier held by our push provider so we can reach your device), IP address (for security and abuse prevention), and error reports.
• Vendor listings: If you list a supplier business in our vendor directory, we hold the business name, trade, locations, photographs, the business contact details you enter for publication, the people you name on the page (see Section 3.5), the date you accepted the Vendor Terms and confirmed that those people agreed, and the state of your listing and its annual payment. Your sign-in email address is never published; the contact details on the listing are, because that is what a listing is for.
• Your website, where you ask us to read it: If you give us your business’s web address when setting up a vendor listing, we fetch that page and up to seven more pages on the same site, and we hold the address, the date we read it, how much text we found, the text itself, and the draft listing we produced from it. Nothing from it is published until you accept it onto your page. Where those pages name other people, see Section 3.7.
• Professional memberships: The professional bodies you tell us you belong to. Most are honorary or professional societies; some are trade unions, which we treat differently — see Section 2.1.
• Agency records: If an agency represents you, we hold the record of that representation — which agency, who requested it, who approved it and when — and a log of changes they make to your profile.

2.1 Professional memberships, and trade unions in particular. The Industry tab of your profile lets you add the professional bodies you belong to. Most of them are honorary or professional societies — the BSC, the ASC, the ACE, the CSC and others — where membership is a craft credential. Some of them are trade unions: IATSE and its locals, BECTU, the DGA, the Directors Guild and Writers Guild of Canada, AQTIS 514 IATSE, MEAA and others.

Trade union membership is special category data under Article 9 of the UK GDPR, and of the EU GDPR for members in the EU. Membership of a society is not. We say so here because the two are not the same thing to us: the general legitimate-interests basis in Section 4 is not what we rely on for a trade union.

Where it appears. Whatever you add is drawn as a silver badge on your crew card and on your profile page. Your profile page can be read without an account and can appear in search engine results, and the body can be used as a filter in Find Crew, so a production looking for crew in a particular union or society can find you. That is what the field is for, and it is why it matters that it is yours to control.

It is yours to remove, at any time. Take the body off in the Industry tab of Edit Profile and it comes off your card, off your public profile and out of the filter. You do not have to give a reason and nothing else about your profile changes. You can also email admin@unitlist.co.uk and we will remove it for you. Where we have asked for and relied on your consent, withdrawing it does not affect the lawfulness of what was published before you withdrew.

Nobody else can agree to it for you. An agency building a profile for a client can bring professional memberships across from the client list it holds (Section 3.3), and an agency representing you can edit your profile. An agency cannot agree on your behalf to our publishing your trade union membership. If a union appears on a profile that was created or edited for you and you would rather it did not, remove it yourself or write to us and we will, and we do not ask the agency first.

UNIT LIST holds personal data about some people who have not signed up. There are seven ways that happens, and they are different from one another, so we describe each.

3.1 People named in a member's credits. When you list a credit on the Platform, you can identify the people you worked with on that production (for example, the 1st AD, Director, or Producer). Some of those people may not themselves be members. We then hold limited data about them: their name, the production, the role they held on it, and their professional association with the member who listed them.

3.2 People who publicly advertise for crew. We use Meta's official Instagram Hashtag Search API to find public posts advertising film and television crew positions, so that we can tell the people posting them that UNIT LIST exists. We store the post's public link and its caption, together with an assessment of whether it is a genuine crew call. We do not collect follower lists, send direct messages, or scrape Instagram. Captions are written by the poster and sometimes contain contact details; where they do, we hold them only for the purpose of that one approach.

3.3 Client lists held for an agency ("pending accounts"). An agency using our Agent Portal can build profiles for the crew they represent before those people have any account here. The information comes from the agency, including from the client list published on the agency's own website. It can include a name, professional role and department, location, biography, credits, awards, skills, professional memberships, the agent who looks after them, the address the agency holds for them, and a link to the source the agency took it from.

A pending account is not a profile on UNIT LIST. It is not shown in Find Crew, is not on the public web, is not in search engines, and is visible only to the agency that entered it and to our administrators. Nothing is sent to the person until the agency chooses to create an account for them.

3.4 Profiles an agency has created for a client. When an agency turns a pending account into a real account, that account is live from the moment it is created. If it has a photograph, a role, a department and at least one credit, it can appear in Find Crew, on a public profile page at unitlist.co.uk, and in search engine results — before the person has signed in, and whether or not they ever do. We think that is what an agency listing their client is for, but it should not come as a surprise, so we say it plainly here.

We email the person at the address the agency gave us on the day the account is created, telling them it exists, that it is theirs, how to take control of it, and how to have it removed. If they never sign in, their agency can send them a reminder from our Agent Portal — at most one a day, and no more than six in all, after which nothing further is sent whether or not they answer. Reminders stop immediately if they sign in. You can stop those emails or have the profile deleted at any time by replying to any of them or emailing admin@unitlist.co.uk. You do not need to sign in to do either.

3.5 People named on a vendor’s listing. A business that pays for a listing in our vendor directory can add the people at that business a production would ring — a photograph, a name, a job title and a direct email address for up to twelve people. That list is part of the listing, so it is published on the public web, readable without an account and indexable by search engines. The people on it are not UNIT LIST members and have no account here.

We publish it because the vendor tells us each person has agreed to appear. That assurance is given by the vendor at the moment they save the list, it is dated, and the section is not published at all unless we hold it. We do not ask the individuals ourselves, and we are not in contact with them — their employer is. We rely on the same basis as the rest of this section, our legitimate interests in running a directory a production can use to reach a supplier (Article 6(1)(f) UK GDPR), and you can object at any time. If your details are on a vendor’s listing and you would rather they were not, write to admin@unitlist.co.uk and we will remove them. You do not need an account, you do not have to give a reason, and we do not ask the vendor first.

The listing is the vendor’s page and your entry is kept while they keep it there. It comes off the page and out of our record of the listing when they remove it, when we remove it, when the listing is taken down, or when the vendor deletes their account. We hold nothing else about you.

3.6 People who write to a supplier through their listing. Every listing in our vendor directory carries an enquiry form, and you do not need an account to use it. What you type — your name, your email address, a phone number if you give one, the production and dates if you give them, and your message — is sent to that business so they can answer you, and we keep a copy so they can see who has been in touch.

It goes to that one business and to nobody else. We do not add you to a mailing list, we do not pass it to any other supplier, and we do not email you at all — what you are shown on screen when you send it is the whole of your receipt. Once we have passed your details on, what that business does with them is their responsibility: our Vendor Terms allow them to use your details to answer you and require your agreement for anything else.

Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): you asked to be put in touch with that business, and passing on what you wrote is the only way to do it. We keep what you sent for twelve months. After that we delete your name, your contact details, the production, the dates and your message, and keep only the fact that an enquiry was made on that date — which is how a business knows what their listing is doing, and is no longer about you. You can ask us to delete yours sooner by writing to admin@unitlist.co.uk. You do not need an account and you do not have to give a reason.

3.7 People named on a website a supplier asked us to read. A business setting up a vendor listing can give us its own web address and ask us to build a first draft of the listing from it. We fetch that page and up to seven more pages on the same website, read the words on them, and use them to write a draft the business then edits. If one of those pages is a contact or team page, what we read can include your name, your job title and your work email address, and we store what we read.

We do not publish any of it about you. Nothing taken from a website reaches a public listing by itself. A person’s name appears on a vendor’s page only when that business adds it themselves and confirms that the person agreed — which is Section 3.5 above, and a separate step. We do not write to you, we do not add you to anything, and we do not pass your details to our members or to anyone else. The words we read are sent to Anthropic, our AI processor, to draft the listing; see Section 5 and Section 7.

Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): a business asked us to read its own website so it could be found by productions looking for a supplier, and reading the site is the only way to do it. We have weighed that against you: what is on the page is professional rather than private, your employer published it, and nothing about you is published by us. You can object at any time, and you do not have to give a reason.

How long we keep it, stated as it actually is. The text of a page we have read is kept with that business’s account, and is deleted when they delete their account. That is longer than it needs to be and we are shortening it; when a fixed limit is in place we will state it here rather than promise it now. Until then, if you would rather we did not hold what we read about you, ask and we will delete it.

If you are named on a page we have read and you want it out, write to admin@unitlist.co.uk with your name and the website it came from. You do not need an account, you do not have to give a reason, and we do not ask the business first. Tell us the address of the site and we can find it; without it we may have to ask you which supplier you work for, because what we hold is filed under their listing and not under your name.

Our lawful basis for this processing is legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is operating a professional network where members can accurately represent their working history, which inherently involves naming the people they worked with. We have balanced this interest against the rights and reasonable expectations of the individuals named. In our view: (a) professional film and television credits are routinely shared publicly and are generally expected to be known within the industry; (b) the data we process about non-members is limited to professional context only; (c) we do not sell or share non-member data with third parties beyond our infrastructure providers, and we do not use it for advertising or to build advertising audiences; and (d) every approach we make carries a way to stop it and a way to have the data deleted, which we act on without requiring an account.

Where we do write to people who are not members. We will contact you if an agency has created a profile for you (Section 3.4), if you have publicly advertised for crew and we are telling you the Platform exists (Section 3.2), or if we write to a supplier business to offer it a listing in the vendor directory — which we do only after speaking to somebody there, and which is one email to a business address that we do not keep. Those are the only three cases. We do not write to people on the basis of being named in someone else's credits, we do not add non-members to a marketing list, and we do not pass their details to our members. If you would rather not hear from us, say so once and we will not contact you again.

Your rights if you are on the Platform but are not a member. These apply to all seven cases above — whether you were named in a credit, found through a public post, entered as a pending account, had a profile created for you by an agency, were named on a vendor's listing, wrote to a supplier through theirs, or were named on a website a supplier asked us to read:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct information about you that is wrong or misleading.
• Right to erasure ("right to be forgotten"): Ask us to remove your name and associated information from the Platform, including a profile an agency created for you and any pending account held for you. We will action valid erasure requests within 30 days, and we do not require you to create an account to make such a request.
• Right to object: Object to our processing on the basis of legitimate interests. Where you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is necessary for legal claims.

To exercise any of these rights, email admin@unitlist.co.uk with your full name and, where possible, an indication of where you appear on the Platform. We will respond within 30 days.

Disputed associations. If you are named on the Platform and you believe the association is inaccurate — for example, you did not work on the production stated, or did not hold the role attributed to you — you may contact us at admin@unitlist.co.uk. We will review credible disputes and may remove, amend, or hide the disputed information pending resolution. We do not independently verify credits or working associations listed by members (see our Terms of Service), and the member who listed the information is responsible for its accuracy. Removing a disputed association is without admission and does not constitute a finding about either party.

We use personal data to:

• Operate and provide the Platform and its features, including authentication, profile display, search, messaging and subscription management.
• Enable members to be discovered by other industry professionals.
• Facilitate direct communication between members.
• Show you relevant productions, jobs, and crew in your professional network.
• Send service-related notifications (e.g. messages received, profile views, important account updates).
• Detect, prevent and address fraud, abuse, security incidents, and Terms of Service violations.
• Improve the Platform's features, performance and stability based on aggregated usage data and error reports.
• Comply with our legal obligations, respond to lawful requests from public authorities, and protect our legal rights.

Lawful bases. We rely on the following lawful bases under UK GDPR Article 6:

• Contract (Art. 6(1)(b)): To provide the Platform and any paid subscription you have signed up for.
• Legitimate interests (Art. 6(1)(f)): To operate, secure, improve and promote a useful professional network; to process data about non-members named by our members; to detect abuse.
• Legal obligation (Art. 6(1)(c)): Where the law requires us to retain or disclose data.
• Consent (Art. 6(1)(a)): Where you have specifically opted in to a feature that requires consent, such as push notifications.

UNIT LIST uses artificial intelligence in a number of places to make the Platform more useful. In every case the provider is Anthropic, acting as our data processor under its standard API terms, under which API inputs are not used to train Anthropic's models. We want to be clear about each use.

Reading documents you give us. When you upload a CV, or import credits from a filmography, the document's text is sent to Anthropic (the maker of the Claude AI assistant) via its standard API to extract structured credit information for your profile. The same applies to a production schedule or call sheet where you ask us to read one. Anthropic acts as our data processor for this task. Under Anthropic's standard API terms, API inputs (including your CV content) are not used to train Anthropic's models. Anthropic processes data in the United States; this international transfer is subject to appropriate safeguards.

Tidying and classifying credits. Credits are passed to the same processor to work out what kind of production they are, to standardise how a production's title and company are written, and to suggest the collaborators a credit might name. This changes how your credits are labelled and sorted; it does not change what you told us.

Reading a supplier’s website to draft their listing. Where a business setting up a vendor listing gives us its web address, the visible text of that page and of up to seven more pages on the same website is sent to the same processor to draft the listing — the business name, what they supply, where they are based and how to reach them. The rule that step is held to is to rewrite the wording and never add a fact, and what comes back is a draft the business reads and edits before anything is published. This is the one place where the text we send is not a document its subject gave us: a contact or team page names other people, and Section 3.7 covers them.

Production news and industry listings. We use the same processor to read publicly published production announcements and news so we can keep our production listings current. This is not about you.

Content moderation. To keep the Platform free of spam and fraud, some content you post (in particular "crewing up" job posts that are broadcast to other members) is automatically screened by AI, via Anthropic acting as our data processor, to check that it is a genuine, good-faith post before it is distributed. This screening may prevent a post from being sent or shown. As with CV parsing, this content is not used to train Anthropic's models, and no automated screening produces a decision with legal or similarly significant effects on you within the meaning of Article 22 UK GDPR.

No third-party AI training on UNIT LIST data. We do not sell or share Platform data with any third party for the purpose of training, fine-tuning or evaluating AI or machine-learning models. Our Terms of Service prohibit other parties from scraping UNIT LIST for AI training purposes.

No solely automated decisions with legal effects. We do not make decisions about you that are solely automated and that have legal or similarly significant effects on you (within the meaning of UK GDPR Article 22). The Platform uses some automated processing for ranking and discovery, but no automated process determines (for example) whether you are hired, suspended, or given access to features without human involvement where consequential.

We do not sell your personal data. We share data only as set out below.

6.1 Other members. Your public profile information (including your name, role, department, location, credits, endorsements and availability) is visible to other authenticated members as intended by the Platform's purpose. Some profile information is visible to non-members visiting public profile pages, but contact details (phone, email) are gated behind authentication or subscription. When you view another member's profile, that view may be recorded and, as part of our "Who Viewed You" feature, shown to that member, including your identity where they are a subscriber.

6.2 Sub-processors. We use the following third-party service providers to operate the Platform. Each of them processes personal data on our behalf under appropriate data protection terms:

• Base44: Backend infrastructure, database, authentication, and first-party usage analytics (aggregated statistics about how the Platform is used, to help us operate and improve it).
• WebToNative (Median): iOS and Android app wrappers that deliver the Platform to your phone.
• Apple Inc.: App Store distribution, in-app purchases, push notifications via APNs (iOS only).
• Google LLC: Google Play Store distribution, in-app purchases (Android), push notifications via Firebase Cloud Messaging, and authentication where you sign in with Google. We do not use Google's advertising or cross-site behavioural tracking products.
• RevenueCat, Inc.: Subscription management and entitlement verification for mobile in-app purchases.
• Stripe Inc.: Payment processing for web subscriptions.
• OneSignal: Push notification delivery.
• Resend: Delivery of the emails we send you — invitations, notifications, digests and account notices. Resend receives your email address and the content of the message.
• Meta Platforms: We use Instagram's official API to publish UNIT LIST's own marketing posts, and to find public posts advertising crew positions (see Section 3.2). We do not send member data to Meta for advertising, and we do not use Meta's advertising or tracking pixels.
• Sentry: Error monitoring and performance diagnostics.
• Anthropic: AI-powered CV parsing (see Section 5).
• Google: Sign-in via Google account where you choose this option.

6.3 Legal disclosure. We may disclose personal data where required by law, court order, or to protect the rights, property or safety of UNIT LIST, our members, or the public.

6.4 Business transfers. If UNIT LIST LTD is involved in a merger, acquisition, restructuring or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and any change to the data controller.

UNIT LIST is operated from the United Kingdom. Some of our sub-processors store or process personal data outside the UK and the European Economic Area, including in the United States (notably Anthropic, Stripe, Apple, Google, RevenueCat, OneSignal, Resend, Meta and Sentry).

Where personal data is transferred internationally, we rely on appropriate safeguards under UK GDPR, which may include: (a) the UK Government's adequacy decision in respect of the country concerned; (b) the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses; or (c) other lawful transfer mechanisms recognised by the Information Commissioner's Office.

For personal information originating in Canada, we rely on the accountability and cross-border transfer requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law. Because UNIT LIST is operated from the United Kingdom and some of our service providers are located in the United Kingdom, the European Economic Area and the United States, personal information about Canadian users may be processed outside Canada and may therefore be subject to the laws of those countries, including lawful access requests by foreign courts, law enforcement and authorities. We use contractual and other means to require a comparable level of protection while your information is processed on our behalf.

We keep personal data only for as long as we need it for the purposes set out in this Policy or as required by law.

• Active accounts: Profile, credits, photos, CV, messages and other Platform content are retained for as long as your account is active.
• Deleted accounts: When you delete your account, we will remove your profile and associated personal data within 30 days. Some content (e.g. messages sent to other members) may remain on the Platform with your name removed or anonymised.
• Vendor listings: A listing, and the people named on it, are kept while the listing exists. Removing somebody from the page removes them from ours; deleting the vendor account deletes the listing and everything on it. A person named on a listing can have their entry removed at any time by writing to us, whether or not the vendor asks.
• Enquiries sent to a vendor: An enquiry sent through a listing is kept in full for twelve months so the business can see who has been in touch. After that the sender’s name, contact details, production, dates and message are deleted and only the date of the enquiry and which listing it went to remain. A sender can ask us to delete theirs sooner, without an account and without giving a reason.
• A website we read for a supplier: The address, the date we read it and the draft we produced are kept with that supplier’s listing. The text of the pages themselves is kept with their account and is deleted when the account is deleted — we are putting a shorter, fixed limit on it and will state it here once it is in place. Anybody named on one of those pages can ask us to delete what we hold about them at any time, without an account and without giving a reason.
• Transaction records: Records relating to paid subscriptions (invoices, payment references) are retained for at least 6 years to comply with HMRC and accounting requirements.
• Support correspondence: Emails to admin@unitlist.co.uk are retained for up to 2 years for service quality and dispute resolution.
• Security and abuse data: IP addresses, error logs and similar diagnostic data are retained for up to 90 days, longer where required for security investigations.
• Backups: Data deleted from the live Platform may persist in encrypted backups for a further short period before being overwritten in the normal backup cycle.

You have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete personal data. Most data can be updated directly in your profile settings.
• Right to erasure: Request deletion of your account and personal data via the Platform or by emailing us.
• Right to data portability: Receive a machine-readable copy of personal data you have provided to us, where processing is based on consent or contract.
• Right to object to processing based on legitimate interests: You have the right to object to processing of your personal data where we rely on legitimate interests (Article 6(1)(f) UK GDPR), including processing about non-members described in Section 3. When you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is necessary for legal claims.
• Right to restrict processing: Ask us to limit how we use your data in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email admin@unitlist.co.uk. We will respond within 30 days (which may be extended by a further 60 days for complex requests, with notice to you).

Right to complain. If you are unhappy with how we handle your personal data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We ask that you contact us first to give us the opportunity to resolve the issue.

If you are located in Canada, your personal information is also protected under Canadian privacy law, principally the Personal Information Protection and Electronic Documents Act (PIPEDA), and, where applicable, substantially similar provincial laws in Quebec, British Columbia and Alberta. We handle personal information in accordance with the fair information principles set out in these laws, including accountability, identifying the purposes of collection, obtaining consent, limiting collection, use and retention, accuracy, safeguards, openness, and individual access.

You have the right to access the personal information we hold about you, to ask us to correct it, and to withdraw your consent to our processing (subject to legal or contractual restrictions). To exercise these rights, contact us at admin@unitlist.co.uk.

Complaints. If you have a privacy concern, please contact us first so we can try to resolve it. You also have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, 30 Victoria Street, Gatineau, Quebec, K1A 1H3. If you are a resident of Quebec, British Columbia or Alberta, you may also have the right to complain to your provincial privacy regulator (in Quebec, the Commission d'accès à l'information).

Quebec residents. If you are resident in Quebec, additional protections apply under the Act respecting the protection of personal information in the private sector ("Law 25"), which may include enhanced rights to data portability and additional obligations on us in relation to transfers of your information outside Quebec. Contact us at admin@unitlist.co.uk to exercise these rights.

The Platform is intended only for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete that data as soon as reasonably practicable.

If you are a parent or guardian and you believe a person under 18 has provided personal data to UNIT LIST, please contact us at admin@unitlist.co.uk.

The Platform allows members to endorse other members, comment on posts, and otherwise create content that may include personal information about other people. When you endorse another member or otherwise create content about another person, you are processing personal data about them.

By creating such content, you confirm that: (a) you have a legitimate professional reason to do so; (b) the content is accurate and given in good faith; and (c) you understand that the subject of your content may have rights to see, correct or object to it under UK GDPR. UNIT LIST acts as a data controller for endorsements and content stored on the Platform, but you remain responsible for the accuracy and legitimacy of the content you create.

We may remove endorsements or other content that is inaccurate, defamatory, or otherwise contrary to our Terms of Service.

We use a small number of essential cookies and similar technologies to operate the Platform:

• Authentication cookies: To keep you signed in.
• Session cookies: To maintain your state during a visit to the Platform.
• Local storage: To remember UI preferences such as theme.

We do not use advertising or third-party tracking cookies. We do not embed Facebook Pixel, Google Ads or similar trackers. You can disable cookies in your browser settings, but this will prevent the Platform from functioning correctly.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, accidental loss or destruction. These include: encryption in transit (HTTPS); access controls limiting which employees and contractors can access personal data; logging and monitoring of administrative actions; secure storage at our infrastructure providers; and regular reviews of our security practices.

No security measure is perfect. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and, where the risk is high, will notify affected individuals without undue delay.

We may send you service-related communications (such as account, security and subscription notices) using the contract lawful basis. These are not marketing and you cannot opt out of receiving them while you have an active account.

We may also send you occasional marketing communications about UNIT LIST features, productions and industry news where you have not opted out. You can opt out of marketing at any time by clicking the unsubscribe link in any marketing email, by adjusting notification preferences in your profile, or by emailing us.

People who are not members. We never write to somebody because they were named in another member's credits. There are two cases where we do write to a non-member, both described in Section 3: where an agency has created a profile for you, and where you have publicly advertised for crew. Every such message tells you how to stop them and how to have your data deleted, and one request is enough — you do not need to sign in, and we do not ask you to give a reason.

We may update this Privacy Policy from time to time. Where changes are material we will notify you by email or by prominent notice on the Platform before the changes take effect. The "Last updated" date at the top of this Policy will always reflect the current version.

For any privacy-related question, data subject request, or to raise a concern, contact us at:

admin@unitlist.co.uk

UNIT LIST LTD, 4 St Georges Road, Sevenoaks, TN13 3ND, United Kingdom