Privacy Policy

1. Introduction

Production Genie ("we", "us", "our") operates the website productiongenie.co.uk and the Production Genie application (together, the "Service"). We are committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR, Regulation 2016/679), and the Data Protection Act 2018.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to your data.

2. Data Controller

The data controller responsible for your personal data is:

Production Genie
Email: [email protected]

If you have any questions about this Privacy Policy or our data practices, please contact us at the email address above.

3. What Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Information you provide directly

• Account registration details (name, email address)
• Profile information (bio, profile photo, contact details)
• Resource listings you create (descriptions, photos, location, pricing)
• Communications you send through the Service

3.2 Information from Google Sign-In

When you sign in using Google OAuth, we receive the following data from your Google account:

• Name — to create and display your profile
• Email address — to identify your account and send essential communications
• Profile picture — to display on your profile (optional)
• Google account ID — to link your account securely

We only request the minimum scopes necessary to authenticate you. We do not access your Google contacts, calendar, drive files, or any other Google services beyond basic profile information.

3.3 Information collected automatically

• IP address and approximate location
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and interactions within the Service
• Referring website or source

4. How We Use Your Data

We process your personal data for the following purposes and legal bases:

Purpose	Legal Basis (GDPR Art. 6)
Creating and managing your account	Performance of a contract
Authenticating you via Google Sign-In	Performance of a contract
Displaying your profile and listings to other users	Performance of a contract
Sending essential service communications (e.g. booking confirmations)	Performance of a contract
Improving and analysing use of the Service	Legitimate interest
Ensuring security and preventing fraud	Legitimate interest
Sending marketing communications	Consent (opt-in)
Complying with legal obligations	Legal obligation

5. Google API Services — Limited Use Disclosure

Production Genie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google user data for the purposes described in this Privacy Policy (account creation and authentication).
• We do not sell Google user data to third parties.
• We do not use Google user data for advertising purposes.
• We do not allow humans to read your Google user data unless we have your explicit consent, it is necessary for security purposes, to comply with applicable law, or our use is limited to internal operations.

6. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with the following categories of recipients:

• Other users — your public profile, listings, and reviews are visible to other users of the Service as necessary for the marketplace to function.
• Hosting and infrastructure providers — who store and process data on our behalf (e.g. cloud hosting). These providers are contractually bound to process data only on our instructions and in compliance with data protection law.
• Analytics providers — to help us understand how the Service is used. Data is aggregated and anonymised where possible.
• Law enforcement or regulators — where required by law or to protect our legal rights.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the UK and European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs
• An adequacy decision by the UK Secretary of State or European Commission

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data — retained while your account is active. After account deletion, we delete or anonymise your data within 30 days, except where retention is required by law.
• Usage and analytics data — retained in anonymised or aggregated form for up to 24 months.
• Legal and compliance records — retained for the period required by applicable law (typically 6 years).

9. Your Rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data where there is no compelling reason to continue processing it.
• Right to restriction of processing — request that we limit how we use your data in certain circumstances.
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making — we do not currently use automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request, as required by law.

10. Revoking Google Account Access

You can revoke Production Genie's access to your Google account data at any time by:

• Visiting your Google Account Permissions page and removing Production Genie.
• Contacting us at [email protected] to request account deletion.

Revoking access will prevent you from signing in via Google, but will not automatically delete your account data. To have your data deleted, please submit a separate deletion request.

11. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies — required for the Service to function (e.g. session authentication, security tokens). These do not require consent.
• Analytics cookies — help us understand how visitors use the Service. These are only set with your consent.

You can manage cookie preferences through your browser settings or through our cookie consent mechanism when you first visit the Service. For more information, see the ICO's guidance on cookies and similar technologies.

12. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), secure authentication, access controls, and regular security reviews.

However, no method of transmission or storage is 100% secure. If you have reason to believe your account has been compromised, please contact us immediately.

14. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint
• EU: Your local Data Protection Authority — see the EDPB members list

We would appreciate the opportunity to address your concerns before you approach a supervisory authority, so please contact us first at [email protected].

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Where changes materially affect how we process your data, we will notify you by email or through the Service.

16. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: [email protected]