Privacy Policy

SJF Productions LTD respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how SJF Productions LTD ("SJF Productions", "we", "us" or "our") collects, uses, discloses, stores and otherwise processes personal data in connection with the Sarah Jane Foster education brand, our websites, digital products, programmes and related services, including Become the Face of Your Business.

It also explains the rights that may be available to you under applicable data protection and privacy laws.

This Privacy Policy applies in particular to:

• upskill.sarahjanefoster.com;
• Become the Face of Your Business;
• associated programme and member areas;
• programme and digital product purchases;
• programme communications;
• customer support; and
• related digital education services operated by SJF Productions LTD.

This Privacy Policy should be read together with any applicable Terms and Conditions, Programme Terms, Cookie Notice and other privacy information presented to you when we collect personal data.

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018 and other applicable data protection laws, the data controller is:

SJF Productions LTD operates programmes and digital education services under the Sarah Jane Foster brand.

Privacy and data protection enquiries may be sent to:

info@sjfproductions.com

Our programmes and digital services may be accessed or purchased by individuals located outside Ireland.

SJF Productions LTD is established in Ireland and our principal privacy framework is therefore based upon Irish and European Union data protection law, including the GDPR.

Depending on where you are located, additional mandatory privacy rights may apply under the laws of your jurisdiction.

Nothing in this Privacy Policy is intended to limit or exclude any privacy or data protection right that cannot lawfully be limited or excluded.

Where applicable law provides you with additional mandatory rights, we will respect those rights in accordance with applicable law.

The personal data we process depends upon how you interact with us.

4.1 Information you provide

This may include:

• your name;
• email address;
• contact information;
• information contained in correspondence;
• customer support enquiries;
• programme-related communications;
• information you choose to include in a member profile;
• information you voluntarily post or share within a programme or member environment; and
• other information you voluntarily provide to us.

4.2 Support requests

When you use the support form at upskill.sarahjanefoster.com/support, we currently collect:

• name;
• email address;
• reason for contacting us;
• message; and
• date and time of submission.

The form also uses limited technical anti-spam measures, including a hidden honeypot field and submission timing information.

Support submissions are stored within our website's backend database infrastructure.

Where our support email notification service is enabled, information contained in a support request may also be transmitted to our designated SJF Productions support inbox so that we can respond to the enquiry.

4.3 Purchases and payments

Purchases for Become the Face of Your Business and certain other digital products or programmes may be completed using third-party platforms, including Circle and Stripe.

Information processed in connection with a transaction may include:

• name;
• email address;
• billing information;
• programme or product purchased;
• purchase price;
• currency;
• date and time of transaction;
• payment status;
• promotional or discount code;
• affiliate attribution where applicable;
• transaction or receipt reference; and
• other information reasonably necessary to administer the purchase.

Payment credentials are processed by the relevant payment provider.

SJF Productions LTD does not ordinarily receive or store your complete payment card number, card verification value or equivalent full payment credentials.

4.4 Programme and member information

Where you enrol in or participate in a programme, we may process information concerning:

• enrolment;
• your member account;
• programme access;
• participation;
• progress or activity within the programme;
• content or activities completed;
• communications with us;
• support history;
• comments, posts or other content you choose to contribute; and
• other information reasonably necessary to administer the programme.

4.5 Website and technical information

Our Upskill website currently operates with a deliberately limited tracking footprint.

At the date of this Privacy Policy, the Upskill website does not intentionally deploy Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, Microsoft Clarity or equivalent advertising or behavioural analytics technologies.

Our website hosting and infrastructure providers may nevertheless process standard technical information necessary to deliver, maintain and secure the website, including IP addresses, browser or device information, request information, timestamps and technical logs.

The website currently uses Google Fonts served through Google infrastructure. When those resources are requested, limited technical information such as an IP address and user agent may be transmitted to Google.

We may change the technologies used by our websites from time to time. Where doing so materially changes our processing of personal data, we will update our privacy information and obtain consent where required by applicable law.

We may obtain personal data:

• directly from you;
• when you submit a form;
• when you communicate with us;
• when you purchase a programme or product;
• when you create or use a member account;
• when you participate in a programme;
• from service providers involved in processing a transaction or administering a programme; and
• automatically through the technical operation of our websites and services.

Where we receive personal data from another source, we will process it in accordance with applicable data protection law.

We process personal data only where we have an appropriate lawful basis.

6.1 Programme administration and delivery

We may process personal data to:

• administer purchases;
• confirm enrolment;
• provide programme access;
• create or administer member accounts;
• deliver programme materials;
• administer participation;
• communicate important programme information; and
• provide products or services you have purchased.

Lawful basis:

Performance of a contract with you or taking steps at your request before entering into a contract.

6.2 Payments and transaction administration

We may process relevant information to:

• administer purchases and payments;
• facilitate receipts;
• deal with billing queries;
• reconcile transactions;
• maintain financial records;
• administer promotional codes;
• prevent or investigate payment irregularities; and
• comply with accounting, taxation and other legal requirements.

Lawful bases:

Performance of a contract, compliance with legal obligations and, where applicable, our legitimate interests in properly administering and protecting our business.

6.3 Customer support

We process support information to:

• respond to enquiries;
• investigate problems;
• resolve account or access issues;
• respond to billing or programme questions; and
• maintain appropriate customer service records.

Lawful bases:

Performance of a contract where the enquiry concerns a service you have purchased and our legitimate interests in providing effective customer service and administering our business.

6.4 Website operation and security

We may process limited technical information to:

• operate our websites;
• maintain security;
• prevent abuse;
• identify and resolve technical problems;
• maintain service availability; and
• protect our legal and commercial interests.

Lawful basis:

Our legitimate interests in operating, securing and protecting our services, except where consent is required by law for a particular technology.

6.5 Legal and regulatory requirements

We may process personal data where necessary to:

• comply with applicable law;
• satisfy taxation, accounting or company-law requirements;
• respond to lawful requests from competent authorities;
• establish, exercise or defend legal claims;
• prevent or investigate fraud; or
• protect our legal rights.

Lawful bases:

Compliance with legal obligations and, where appropriate, our legitimate interests in establishing, exercising or defending legal rights.

Where we rely upon legitimate interests, we consider whether our interests are necessary and proportionate and whether those interests are overridden by your interests, fundamental rights or freedoms.

Our legitimate interests may include:

• operating and administering our business;
• providing customer service;
• protecting our systems;
• preventing fraud and misuse;
• maintaining appropriate business records;
• improving operational processes; and
• establishing, exercising or defending legal rights.

Where applicable, you may have a right to object to processing based upon legitimate interests.

If you purchase or participate in a programme, we may communicate with you where reasonably necessary to deliver and administer that programme.

These communications may include:

• order confirmations;
• receipts;
• account information;
• access instructions;
• programme start information;
• schedules;
• operational reminders;
• material programme updates;
• security information;
• service notices; and
• support communications.

Where these communications are necessary to perform our contract with you or provide the service requested, they are distinct from optional promotional marketing.

Opting out of marketing communications will therefore not prevent us from sending communications reasonably necessary to provide a product or service you have purchased.

We distinguish between essential service communications and direct marketing.

Where you separately subscribe to The Green Room or another Sarah Jane Foster marketing communication, we may process your contact information for that purpose.

Where consent is required by applicable law, we will seek a clear affirmative indication of consent.

You may withdraw consent at any time.

Where permitted by applicable Irish electronic communications law, we may communicate with an existing customer about our own similar products or services without obtaining a separate marketing opt-in only where all applicable statutory conditions are satisfied.

Purchasing a programme does not automatically constitute consent to unrestricted future marketing.

You may object to direct marketing at any time.

Marketing emails will contain an appropriate means of unsubscribing where required by law.

Where you unsubscribe or object, we may retain limited suppression information for the purpose of ensuring that your preference continues to be respected.

Our websites may use cookies and similar technologies.

Except where an applicable legal exemption applies, we will obtain any consent required by law before storing information on, or accessing information stored on, your device through non-essential cookies or similar technologies.

10.1 Affiliate attribution

The Upskill website currently contains functionality capable of storing a first-party cookie named affiliate_code for up to 60 days when a visitor arrives through an affiliate link.

Its purpose is to retain the relevant affiliate or partner identifier so that attribution can be carried through to the Circle checkout.

The affiliate cookie does not itself intentionally contain your name, email address or payment card information.

However, cookie and similar-technology rules may apply irrespective of whether the information stored constitutes personal data.

Accordingly, where affiliate attribution technology does not qualify for an applicable legal exemption, it will not be deployed until the consent required by applicable law has been obtained.

Where required, users will be provided with appropriate information and a mechanism for accepting, rejecting or withdrawing consent.

10.2 Future analytics and advertising

If we introduce analytics, advertising, conversion tracking or other non-essential tracking technologies in the future, we will implement appropriate transparency and consent mechanisms before deploying them where required by applicable law.

We may disclose personal data to carefully selected third parties where reasonably necessary to operate our business, provide our programmes and services, process transactions, communicate with customers, maintain our technology infrastructure or comply with legal obligations.

Depending on how you interact with us, recipients may include:

• programme, learning and community platform providers;
• payment processors and financial service providers;
• website, hosting, cloud and database service providers;
• communications and transactional email providers;
• email marketing providers, where you have subscribed to marketing communications;
• IT, security and technical service providers;
• analytics or technology providers, where applicable and lawfully implemented;
• accountants, solicitors, insurers and other professional advisers; and
• other service providers reasonably necessary for the operation, administration and protection of our business and services.

We require service providers acting on our behalf to process personal data only for appropriate purposes and subject to applicable contractual, confidentiality, security and data protection requirements.

Certain third parties may process personal data as independent controllers where they determine the purposes and means of their own processing, including in circumstances involving payment, regulatory or legal obligations. Their processing may also be governed by their own privacy notices.

We may also disclose personal data where reasonably necessary:

• to comply with applicable law, regulation, court order or other legally binding requirement;
• to respond to lawful requests from courts, regulators, law enforcement agencies or other competent authorities;
• to prevent, detect or investigate fraud, security incidents or misuse;
• to establish, exercise or defend legal claims;
• to protect the rights, property, security or legitimate interests of SJF Productions LTD, our customers or others; or
• in connection with an actual or proposed merger, acquisition, investment, financing, restructuring, sale of assets or other corporate transaction, subject to applicable legal requirements.

We do not sell personal data.

Further information about relevant categories of recipients may be requested by contacting info@sjfproductions.com.

Some service providers used to operate our digital services may process personal data outside Ireland or the European Economic Area.

Where GDPR or other applicable law requires safeguards for an international transfer, we will ensure that an appropriate transfer mechanism is relied upon.

Depending upon the provider and destination, this may include:

• an adequacy decision adopted by the European Commission;
• European Commission-approved Standard Contractual Clauses;
• supplementary measures where required;
• another transfer mechanism permitted under Chapter V GDPR; or
• another lawful transfer mechanism recognised under applicable law.

You may contact info@sjfproductions.com for further information about safeguards applicable to relevant transfers.

We retain personal data only for as long as reasonably necessary for the purposes for which it was processed and to satisfy applicable legal, accounting, contractual, regulatory and dispute-resolution requirements.

Our current retention framework is as follows.

13.1 Support enquiries

Support enquiries are ordinarily retained for up to 24 months after an enquiry is resolved.

They may be retained for longer where reasonably necessary because the correspondence relates to a continuing customer relationship, dispute, complaint, legal claim or regulatory obligation.

13.2 Programme and member records

Programme and member information is retained for the period necessary to provide the programme and for an appropriate period afterwards for customer service, account administration, contractual record-keeping and the establishment, exercise or defence of legal claims.

13.3 Financial, transaction and taxation records

Financial and transaction records are retained for the periods required under applicable Irish accounting, taxation and company law.

13.4 Marketing information

Marketing subscription information is retained while you remain subscribed.

Where you unsubscribe or object to marketing, limited suppression information may be retained where necessary to ensure that your preference continues to be respected.

13.5 Cookie consent records

Where applicable, records of cookie or tracking consent choices may be retained for an appropriate period to demonstrate and administer those choices.

13.6 Technical and security records

Technical and security records are retained only for the period reasonably necessary for security, troubleshooting, fraud prevention or legal purposes.

Where a dispute, investigation, complaint or legal claim is anticipated or ongoing, relevant information may be retained for longer where reasonably necessary.

At the end of the applicable retention period, information will be deleted, anonymised or otherwise securely disposed of where appropriate.

Certain programmes may include access to an interactive member or community environment.

Information you voluntarily post in an area visible to other authorised members may be viewed by those members.

You should not post:

• payment credentials;
• passwords;
• confidential business information you do not wish others to see;
• sensitive personal information unless genuinely necessary; or
• information about another person that you are not entitled to disclose.

We may moderate, restrict or remove content where reasonably necessary to administer the programme, enforce applicable terms, protect participants or comply with law.

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include, where appropriate:

• access controls;
• restricted administrative permissions;
• secure infrastructure;
• authentication controls;
• database security;
• data minimisation;
• service-provider controls; and
• appropriate organisational procedures.

No electronic system or internet transmission can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of credentials associated with your member account and should notify us if you reasonably believe your account has been compromised.

Depending upon your location and applicable law, you may have some or all of the following rights.

16.1 Access

You may have the right to request confirmation as to whether we process personal data concerning you and obtain access to relevant personal data.

16.2 Rectification

You may have the right to request correction of inaccurate personal data and completion of incomplete personal data.

16.3 Erasure

You may have the right to request deletion of personal data in circumstances provided by applicable law.

16.4 Restriction

You may have the right to request restriction of processing in certain circumstances.

16.5 Data portability

Where applicable, you may have the right to receive certain personal data in a structured, commonly used and machine-readable format and to have that information transmitted to another controller.

16.6 Objection

You may have the right to object to certain processing based upon legitimate interests.

16.7 Direct marketing

You may object at any time to the processing of your personal data for direct marketing purposes.

16.8 Withdrawal of consent

Where processing is based upon consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.

16.9 Complaints

You may have the right to lodge a complaint with a competent data protection or privacy supervisory authority.

These rights are not absolute and their application depends upon applicable law and the circumstances of the processing.

To exercise a privacy right, contact:

info@sjfproductions.com

We may request information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

Depending upon where you reside, local privacy legislation may provide additional rights or impose additional requirements.

Where such legislation applies to SJF Productions LTD and to the relevant processing, we will comply with applicable mandatory requirements.

These may include rights concerning:

• access to personal information;
• correction;
• deletion;
• portability;
• restriction;
• objection;
• withdrawal of consent;
• information about disclosures;
• complaints; and
• certain uses or disclosures of personal information.

We do not intend this section to represent that every privacy law in every jurisdiction necessarily applies to SJF Productions LTD.

Rather, where a mandatory local privacy law applies to our processing of your personal data, nothing in this Privacy Policy is intended to deprive you of rights that cannot lawfully be waived.

Where the UK GDPR applies to our processing of personal data relating to individuals in the United Kingdom, we will process that personal data in accordance with applicable UK data protection requirements.

Depending upon the circumstances, UK users may have rights broadly corresponding to rights described in Section 16.

Individuals in the United Kingdom may also have the right to complain to the UK Information Commissioner's Office where the ICO is the competent supervisory authority.

Certain US state privacy laws may grant residents additional privacy rights where those laws apply to the relevant business and processing activity.

The applicability of such laws may depend upon factors including the state concerned, the nature of the processing and statutory thresholds.

Where an applicable US state privacy law applies to SJF Productions LTD, we will honour the mandatory rights provided by that law.

We do not state or imply that a particular US state privacy statute applies where its statutory applicability requirements are not satisfied.

SJF Productions LTD does not sell personal data as described in this Privacy Policy.

We do not currently use personal data processed in connection with Become the Face of Your Business to make decisions based solely upon automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

If this changes, we will provide the information and safeguards required by applicable law.

Become the Face of Your Business is intended for adults and business users.

We do not knowingly seek to collect personal data from children through the programme.

If you believe that personal data relating to a child has been provided to us inappropriately, please contact:

info@sjfproductions.com

Our websites and programme environments may contain links to third-party websites or services.

Those third parties may process personal data under their own privacy notices and legal responsibilities.

This Privacy Policy does not govern processing undertaken independently by third parties outside our control.

We encourage you to review the privacy information provided by third-party services you choose to use.

We may amend this Privacy Policy from time to time to reflect:

• changes to our programmes or services;
• new technologies;
• changes to service providers;
• changes to our processing activities;
• legal or regulatory developments; or
• changes to our business operations.

Where a change materially affects how we process personal data, we will take appropriate steps to communicate that change where required by applicable law.

The "Last updated" date at the beginning of this Privacy Policy identifies the current version.

If you have concerns about how we process your personal data, please contact us at info@sjfproductions.com.

You also have the right to lodge a complaint with the Irish Data Protection Commission or, where applicable, another competent supervisory authority.

For questions about this Privacy Policy, our processing of personal data or to exercise a privacy right, contact:

Email:

info@sjfproductions.com