Privacy Policy

UNIT LIST is operated by UNIT LIST LTD, a company registered in England and Wales (company number 17247712), with its registered office at 4 St Georges Road, Sevenoaks, TN13 3ND ("UNIT LIST", "we", "us", "our"). UNIT LIST is a professional crew network for UK Film and High-End Television (HETV) crew.

UNIT LIST LTD is the data controller for personal data processed in connection with the Platform, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For privacy enquiries, data subject requests, or to raise a complaint, contact us at: admin@unitlist.co.uk

We collect and process the following categories of personal data about registered members:

• Account information: Name, email address, authentication identifiers (e.g. Google or Apple sign-in ID).
• Profile information: Professional role, department, location, biography, availability status, years of experience, profile photo, agency contact, awards.
• Professional credits: Production titles, roles held, dates, production companies, and the names and roles of collaborators you choose to list ("worked with").
• CV and documents: PDF CVs you upload to the Platform.
• Work photos: Images you upload to your portfolio gallery.
• Messages: Direct messages sent between members on the Platform.
• Endorsements: Endorsements and reviews you give to or receive from other members.
• Contact details: Phone number, Instagram and LinkedIn URLs, and other contact methods you choose to provide.
• Subscription and payment data: Whether you are a paid subscriber, your subscription status, and a reference to your payment provider (Stripe for web, Apple App Store for iOS, Google Play for Android). We do not store full payment card details — these are held by the relevant payment processor.
• Usage and technical data: Profile views, search appearances, in-app activity, device type, operating system, IP address (for security and abuse prevention), and error reports.

UNIT LIST is a professional network. When you list a credit on the Platform, you can identify the people you worked with on that production (for example, the 1st AD, Director, or Producer). Some of those people may not themselves be members of UNIT LIST.

This means UNIT LIST may hold limited personal data about individuals who have not signed up — typically: their name, the production they worked on, the role they held on it, and their professional association with our member who listed them.

Our lawful basis for this processing is legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is operating a professional network where members can accurately represent their working history, which inherently involves naming the people they worked with. We have balanced this interest against the rights and reasonable expectations of the individuals named. In our view: (a) professional film and television credits are routinely shared publicly and are generally expected to be known within the industry; (b) the data we process about non-members is limited to professional context only; (c) we do not use non-member data for marketing, advertising, or to send unsolicited messages; (d) we do not sell or share non-member data with third parties beyond our infrastructure providers.

Your rights if you are named on the Platform but are not a member. If you are not a member of UNIT LIST and you have been named on someone's credits or in similar professional context, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct information about you that is wrong or misleading.
• Right to erasure ("right to be forgotten"): Ask us to remove your name and associated information from the Platform. We will action valid erasure requests from named non-members within 30 days, and we do not require you to create an account to make such a request.
• Right to object: Object to our processing on the basis of legitimate interests. Where you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is necessary for legal claims.

To exercise any of these rights, email admin@unitlist.co.uk with your full name and, where possible, an indication of where you appear on the Platform. We will respond within 30 days.

Disputed associations. If you are named on the Platform and you believe the association is inaccurate — for example, you did not work on the production stated, or did not hold the role attributed to you — you may contact us at admin@unitlist.co.uk. We will review credible disputes and may remove, amend, or hide the disputed information pending resolution. We do not independently verify credits or working associations listed by members (see our Terms of Service), and the member who listed the information is responsible for its accuracy. Removing a disputed association is without admission and does not constitute a finding about either party.

We use personal data to:

• Operate and provide the Platform and its features, including authentication, profile display, search, messaging and subscription management.
• Enable members to be discovered by other industry professionals.
• Facilitate direct communication between members.
• Show you relevant productions, jobs, and crew in your professional network.
• Send service-related notifications (e.g. messages received, profile views, important account updates).
• Detect, prevent and address fraud, abuse, security incidents, and Terms of Service violations.
• Improve the Platform's features, performance and stability based on aggregated usage data and error reports.
• Comply with our legal obligations, respond to lawful requests from public authorities, and protect our legal rights.

Lawful bases. We rely on the following lawful bases under UK GDPR Article 6:

• Contract (Art. 6(1)(b)): To provide the Platform and any paid subscription you have signed up for.
• Legitimate interests (Art. 6(1)(f)): To operate, secure, improve and promote a useful professional network; to process data about non-members named by our members; to detect abuse.
• Legal obligation (Art. 6(1)(c)): Where the law requires us to retain or disclose data.
• Consent (Art. 6(1)(a)): Where you have specifically opted in to a feature that requires consent, such as push notifications.

UNIT LIST uses artificial intelligence in certain limited ways to make the Platform more useful. We want to be clear about how.

CV parsing. When you upload a CV, the document's text is sent to Anthropic (the maker of the Claude AI assistant) via its standard API to extract structured credit information for your profile. Anthropic acts as our data processor for this task. Under Anthropic's standard API terms, API inputs (including your CV content) are not used to train Anthropic's models. Anthropic processes data in the United States; this international transfer is subject to appropriate safeguards.

Content moderation. To keep the Platform free of spam and fraud, some content you post (in particular "crewing up" job posts that are broadcast to other members) is automatically screened by AI, via Anthropic acting as our data processor, to check that it is a genuine, good-faith post before it is distributed. This screening may prevent a post from being sent or shown. As with CV parsing, this content is not used to train Anthropic's models, and no automated screening produces a decision with legal or similarly significant effects on you within the meaning of Article 22 UK GDPR.

No third-party AI training on UNIT LIST data. We do not sell or share Platform data with any third party for the purpose of training, fine-tuning or evaluating AI or machine-learning models. Our Terms of Service prohibit other parties from scraping UNIT LIST for AI training purposes.

No solely automated decisions with legal effects. We do not make decisions about you that are solely automated and that have legal or similarly significant effects on you (within the meaning of UK GDPR Article 22). The Platform uses some automated processing for ranking and discovery, but no automated process determines (for example) whether you are hired, suspended, or given access to features without human involvement where consequential.

We do not sell your personal data. We share data only as set out below.

6.1 Other members. Your public profile information (including your name, role, department, location, credits, endorsements and availability) is visible to other authenticated members as intended by the Platform's purpose. Some profile information is visible to non-members visiting public profile pages, but contact details (phone, email) are gated behind authentication or subscription. When you view another member's profile, that view may be recorded and, as part of our "Who Viewed You" feature, shown to that member, including your identity where they are a subscriber.

6.2 Sub-processors. We use the following third-party service providers to operate the Platform. Each of them processes personal data on our behalf under appropriate data protection terms:

• Base44: Backend infrastructure, database, authentication, and first-party usage analytics (aggregated statistics about how the Platform is used, to help us operate and improve it).
• WebToNative (Median): iOS and Android app wrappers that deliver the Platform to your phone.
• Apple Inc.: App Store distribution, in-app purchases, push notifications via APNs (iOS only).
• Google LLC: Google Play Store distribution, in-app purchases (Android), push notifications via Firebase Cloud Messaging, and authentication where you sign in with Google. We do not use Google's advertising or cross-site behavioural tracking products.
• RevenueCat, Inc.: Subscription management and entitlement verification for mobile in-app purchases.
• Stripe Inc.: Payment processing for web subscriptions.
• OneSignal: Push notification delivery.
• Sentry: Error monitoring and performance diagnostics.
• Anthropic: AI-powered CV parsing (see Section 5).
• Google: Sign-in via Google account where you choose this option.

6.3 Legal disclosure. We may disclose personal data where required by law, court order, or to protect the rights, property or safety of UNIT LIST, our members, or the public.

6.4 Business transfers. If UNIT LIST LTD is involved in a merger, acquisition, restructuring or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and any change to the data controller.

UNIT LIST is operated from the United Kingdom. Some of our sub-processors store or process personal data outside the UK and the European Economic Area, including in the United States (notably Anthropic, Stripe, Apple, Google, RevenueCat, OneSignal and Sentry).

Where personal data is transferred internationally, we rely on appropriate safeguards under UK GDPR, which may include: (a) the UK Government's adequacy decision in respect of the country concerned; (b) the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses; or (c) other lawful transfer mechanisms recognised by the Information Commissioner's Office.

For personal information originating in Canada, we rely on the accountability and cross-border transfer requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law. Because UNIT LIST is operated from the United Kingdom and some of our service providers are located in the United Kingdom, the European Economic Area and the United States, personal information about Canadian users may be processed outside Canada and may therefore be subject to the laws of those countries, including lawful access requests by foreign courts, law enforcement and authorities. We use contractual and other means to require a comparable level of protection while your information is processed on our behalf.

We keep personal data only for as long as we need it for the purposes set out in this Policy or as required by law.

• Active accounts: Profile, credits, photos, CV, messages and other Platform content are retained for as long as your account is active.
• Deleted accounts: When you delete your account, we will remove your profile and associated personal data within 30 days. Some content (e.g. messages sent to other members) may remain on the Platform with your name removed or anonymised.
• Transaction records: Records relating to paid subscriptions (invoices, payment references) are retained for at least 6 years to comply with HMRC and accounting requirements.
• Support correspondence: Emails to admin@unitlist.co.uk are retained for up to 2 years for service quality and dispute resolution.
• Security and abuse data: IP addresses, error logs and similar diagnostic data are retained for up to 90 days, longer where required for security investigations.
• Backups: Data deleted from the live Platform may persist in encrypted backups for a further short period before being overwritten in the normal backup cycle.

You have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete personal data. Most data can be updated directly in your profile settings.
• Right to erasure: Request deletion of your account and personal data via the Platform or by emailing us.
• Right to data portability: Receive a machine-readable copy of personal data you have provided to us, where processing is based on consent or contract.
• Right to object to processing based on legitimate interests: You have the right to object to processing of your personal data where we rely on legitimate interests (Article 6(1)(f) UK GDPR), including processing about non-members described in Section 3. When you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is necessary for legal claims.
• Right to restrict processing: Ask us to limit how we use your data in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email admin@unitlist.co.uk. We will respond within 30 days (which may be extended by a further 60 days for complex requests, with notice to you).

Right to complain. If you are unhappy with how we handle your personal data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We ask that you contact us first to give us the opportunity to resolve the issue.

If you are located in Canada, your personal information is also protected under Canadian privacy law, principally the Personal Information Protection and Electronic Documents Act (PIPEDA), and, where applicable, substantially similar provincial laws in Quebec, British Columbia and Alberta. We handle personal information in accordance with the fair information principles set out in these laws, including accountability, identifying the purposes of collection, obtaining consent, limiting collection, use and retention, accuracy, safeguards, openness, and individual access.

You have the right to access the personal information we hold about you, to ask us to correct it, and to withdraw your consent to our processing (subject to legal or contractual restrictions). To exercise these rights, contact us at admin@unitlist.co.uk.

Complaints. If you have a privacy concern, please contact us first so we can try to resolve it. You also have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, 30 Victoria Street, Gatineau, Quebec, K1A 1H3. If you are a resident of Quebec, British Columbia or Alberta, you may also have the right to complain to your provincial privacy regulator (in Quebec, the Commission d'accès à l'information).

Quebec residents. If you are resident in Quebec, additional protections apply under the Act respecting the protection of personal information in the private sector ("Law 25"), which may include enhanced rights to data portability and additional obligations on us in relation to transfers of your information outside Quebec. Contact us at admin@unitlist.co.uk to exercise these rights.

The Platform is intended only for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete that data as soon as reasonably practicable.

If you are a parent or guardian and you believe a person under 18 has provided personal data to UNIT LIST, please contact us at admin@unitlist.co.uk.

The Platform allows members to endorse other members, comment on posts, and otherwise create content that may include personal information about other people. When you endorse another member or otherwise create content about another person, you are processing personal data about them.

By creating such content, you confirm that: (a) you have a legitimate professional reason to do so; (b) the content is accurate and given in good faith; and (c) you understand that the subject of your content may have rights to see, correct or object to it under UK GDPR. UNIT LIST acts as a data controller for endorsements and content stored on the Platform, but you remain responsible for the accuracy and legitimacy of the content you create.

We may remove endorsements or other content that is inaccurate, defamatory, or otherwise contrary to our Terms of Service.

We use a small number of essential cookies and similar technologies to operate the Platform:

• Authentication cookies: To keep you signed in.
• Session cookies: To maintain your state during a visit to the Platform.
• Local storage: To remember UI preferences such as theme.

We do not use advertising or third-party tracking cookies. We do not embed Facebook Pixel, Google Ads or similar trackers. You can disable cookies in your browser settings, but this will prevent the Platform from functioning correctly.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, accidental loss or destruction. These include: encryption in transit (HTTPS); access controls limiting which employees and contractors can access personal data; logging and monitoring of administrative actions; secure storage at our infrastructure providers; and regular reviews of our security practices.

No security measure is perfect. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and, where the risk is high, will notify affected individuals without undue delay.

We may send you service-related communications (such as account, security and subscription notices) using the contract lawful basis. These are not marketing and you cannot opt out of receiving them while you have an active account.

We may also send you occasional marketing communications about UNIT LIST features, productions and industry news where you have not opted out. You can opt out of marketing at any time by clicking the unsubscribe link in any marketing email, by adjusting notification preferences in your profile, or by emailing us.

We do not send marketing communications to non-members on the basis of data we hold about them through our members' credits.

We may update this Privacy Policy from time to time. Where changes are material we will notify you by email or by prominent notice on the Platform before the changes take effect. The "Last updated" date at the top of this Policy will always reflect the current version.

For any privacy-related question, data subject request, or to raise a concern, contact us at:

admin@unitlist.co.uk

UNIT LIST LTD, 4 St Georges Road, Sevenoaks, TN13 3ND, United Kingdom