Privacy Policy
1. About this policy Timbre and Co. ("Timbre", "we", "us", "our") is a video production company. We film, photograph, edit and deliver visual content for clients, and we run a website and social media channels that support that work. Doing this means we handle personal information — about the people who enquire with us, the clients who engage us, the crew and contractors we work with, and the people who appear in front of our cameras. This policy explains what we collect, why, who we share it with, how we protect it, and what you can do about it. It is written to meet our obligations under the *Privacy Act 1988* (Cth) and the 13 Australian Privacy Principles ("APPs"), and it applies to everything we do — our website, our enquiries and sales process, our productions, and the footage and images we hold afterwards. If you deal with us, this policy applies to you. 2. What we mean by "personal information" Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable — whether or not it is true, and whether or not it is recorded in a material form. **Footage and photographs are personal information** when the person in them is reasonably identifiable. This is the part of privacy law that matters most in our line of work, and we treat filmed and photographed material accordingly. **Sensitive information** is a subset that gets extra protection: health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, union membership, and biometric information. We collect sensitive information only where you consent and it is reasonably necessary for our work, or where the law otherwise allows it.
3. The kinds of personal information we collect 3.1 Website visitors and enquirers - Name, email address, phone number, business name and location - The content of your enquiry, brief or message to us - Budget range, event dates and project details you volunteer - Technical data: IP address, browser and device type, pages visited, referring site, and time spent — collected through our website analytics - Cookie and similar identifiers (see section 9) 3.2 Clients - Contact and billing details for you and your nominated team members - Contracts, quotes, proposals, statements of work and signed variations - Payment information — bank account details for invoicing, and transaction records. **We do not store full credit card numbers**; card payments are processed by our payment provider - Correspondence with us across email, phone, messaging platforms and project tools - Brief materials, scripts, shot lists, schedules, call sheets and contact lists you supply, which often contain other people's personal information - Feedback, review notes and approvals 3.3 People who appear in our productions ("subjects") - Image, likeness and voice captured in video and still photography - Name, role or title, and organisation, where these are used in the content or needed for identification - Signed appearance releases, consent forms and any restrictions attached to them - Contact details, where we need to reach you about the material - On some projects only, and always with your consent: information you choose to share on camera, which may include sensitive information 3.4 Talent, crew, contractors and applicants - Name, contact details, ABN, and business or trading name - Rates, availability, invoices and payment details - Showreels, portfolios, CVs and qualifications - Insurance, licences and certifications (for example, drone operator credentials) - Where required for engagement and where you provide them, tax and superannuation details - Notes about our working relationship with you 3.5 Marketing audiences - Name and email address for our mailing list, and your subscription status - Engagement data — whether an email was opened, and which links were clicked - Public interactions on our social media channels 3.6 Government identifiers We do not adopt a government-related identifier — such as a Tax File Number, Medicare number, driver licence number or passport number — as our own way of identifying you. Where we hold one because the law requires it (for example, a contractor's Tax File Number for payment purposes), we use and disclose it only for that legally required purpose.
4. How we collect personal information We collect personal information directly from you wherever it is reasonable and practicable to do so — through our website forms, email, phone calls, meetings, contracts, release forms, and by recording you when you take part in a production you have agreed to. We also collect it from other sources, including: - **From our clients**, when they give us contact lists, call sheets, interview subject details or brief material about their own staff and customers - **Incidentally, during filming** — people who pass through frame in public or semi-public locations, background attendees at events, and crowd footage - **From publicly available sources**, such as a business website or a public social media profile, when researching or verifying a prospective client or collaborator - **From referrers**, when someone recommends you to us or passes on your enquiry - **Through our service providers**, such as analytics and email platforms 4.1 Incidental capture on location Filming in public and at events means some people are recorded without a direct conversation with us. Where this happens, we: - Post signage or ask the event organiser to notify attendees that filming is taking place, wherever the production allows it - Limit our use of incidental footage to the purpose the production was commissioned for - Honour reasonable requests to be excluded or blurred, where the person can be identified in the delivered material and removal is technically feasible If you appeared in our footage and would prefer not to, contact us using the details in section 15. We will tell you honestly whether the material can still be changed, and what has already been published. 4.2 Unsolicited information If we receive personal information we did not ask for, we assess whether we could have collected it lawfully. If we could not, and it is not contained in a Commonwealth record, we destroy or de-identify it as soon as practicable and where lawful to do so.
5. Why we collect, hold, use and disclose it We use personal information for the purposes it was collected for, for related purposes you would reasonably expect, and where you have consented or the law requires or permits it. Specifically: | Purpose | What this involves | | --- | --- | | Responding to enquiries | Answering you, scoping the job, preparing quotes and proposals | | Delivering productions | Planning, scheduling, filming, editing, revising and delivering content | | Producing the content itself | Recording and editing the image, likeness and voice of people who appear in it | | Administration and payment | Contracts, invoicing, collections, accounting and record-keeping | | Engaging crew and talent | Booking, briefing, paying and reviewing contractors | | Support and communication | Project updates, revision rounds, delivery of final files | | Portfolio and marketing | Showing our work on our website, showreel, social media and in pitches — subject to section 6 | | Improving our service | Understanding how our website and communications are used | | Legal and safety | Insurance, dispute resolution, risk management, and meeting our legal obligations | We do not use your personal information for any unrelated purpose without telling you or obtaining your consent.
6. Portfolio, showreel and marketing use of footage This deserves its own section, because it is the use people most often ask about. **Client work.** Our right to show completed work publicly is set by the contract for that project. Where the contract permits portfolio use, we may include the material on our website, showreel, social channels and in pitch documents. Where a project is confidential, embargoed or subject to a client's approval, we honour that. **People in the footage.** We do not use footage of an identifiable person for our own promotion unless a release covering that use has been signed, or the use is otherwise permitted by law or by the contract under which the material was made. **Withdrawing consent.** If you signed a release and later want the material withdrawn, tell us. We will stop using it in our own marketing going forward wherever we can, and remove it from channels we control. We may not be able to recover material already published by a client or third party, already distributed, or already embedded in a delivered edit — and we will tell you plainly which of these applies. **Sensitive contexts.** For productions involving children, health settings, or personal testimony, we obtain consent specific to the intended use and do not rely on a general release.
7. Who we disclose personal information to We disclose personal information only where it is necessary for the purposes above. Recipients may include: - **Our clients** — footage, images and production material, including material featuring people we filmed for them - **Crew and contractors** — camera operators, editors, colourists, sound engineers, drone pilots, stylists and producers engaged on your project, who receive only what they need to do the work - **Technology and cloud providers** — file storage and transfer, project management, email, editing and post-production platforms, and backup services - **Payment and accounting providers** — our payment processor, accounting software and bookkeeper - **Marketing platforms** — our email platform and website analytics provider - **Professional advisers** — our accountant, lawyer and insurer, where relevant - **Venues and event organisers**, where required to gain access or comply with their conditions - **Law enforcement, regulators and courts**, where we are required or authorised by law to do so We do not sell personal information, and we do not disclose it to third parties for their own direct marketing. Where we engage a service provider, we take reasonable steps to ensure they handle personal information consistently with this policy and the Privacy Act.
8. Storage, security and overseas disclosure 8.1 How we hold it Personal information is held in a mix of cloud services and local systems, including production drives and archive storage. We protect it with: - Access controls and individual accounts, restricted to people who need the information - Encryption in transit, and encryption at rest where our providers offer it - Multi-factor authentication on key business accounts - Physical security for drives, cards and archive media - Backups, and periodic review of who has access to what No system is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. 8.2 Overseas disclosure Several of the platforms we rely on store data outside Australia — commonly in the **United States** and the **European Union**, depending on the provider. By dealing with us, you acknowledge that your personal information may be stored or accessed overseas by these providers. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs, unless an exception under APP 8.2 applies. *[Action: list your actual providers and their data locations here — for example your cloud storage, file transfer, email, project management and payment platforms.]* 8.3 Data breaches We have a process for responding to suspected data breaches. Where a breach is likely to result in serious harm to affected individuals, we will assess it promptly (within 30 days) and, if it is an eligible data breach, notify the affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required by the Notifiable Data Breaches scheme. 8.4 How long we keep it We keep personal information only for as long as we need it for the purposes it was collected for, or for as long as the law requires — including tax and business records, which we retain for at least seven years, and insurance and limitation-period considerations. **Production footage is different.** Raw footage, project files and delivered masters are typically retained as part of our archive so that we can service future client requests. Our standard retention period for raw production material is *[e.g. 12 months]* unless the contract says otherwise, after which it may be deleted. Delivered masters are retained *[for the term of the client agreement / indefinitely, as agreed]*. When we no longer need personal information and are not required to keep it, we destroy it or de-identify it. 9. Cookies and website analytics Our website uses cookies and similar technologies to make the site work, remember your preferences and understand how the site is used. - **Essential cookies** keep the site functioning. The site may not work properly without them. - **Analytics cookies** help us see which pages are visited and how people find us. *[Name your analytics provider here.]* - **Marketing cookies**, if we use them, help us measure the performance of advertising. *[Name any advertising pixels here, or delete this line.]* You can set your browser to refuse cookies or alert you when they are being used. If you do, some parts of the site may not function as intended. We do not respond to "Do Not Track" browser signals, as there is no agreed standard for how they should be handled.
10. Direct marketing If you are on our mailing list, we may send you news about our work, availability and services. Every marketing email contains an unsubscribe link, and we act on unsubscribe requests promptly, in line with the *Spam Act 2003* (Cth). You can also ask us at any time to stop sending you direct marketing, or to tell you where we obtained your information. We will action that request within a reasonable period and at no cost. We do not use sensitive information for direct marketing without your consent.
11. Anonymity and pseudonymity You can deal with us anonymously or under a pseudonym where it is lawful and practicable — for example, when making a general enquiry about our services. It is not practicable for most of our work. We cannot contract with you, invoice you, pay you as a contractor, or obtain a valid appearance release without knowing who you are.
12. Automated decision-making We do not use automated processes to make decisions that significantly affect your rights or interests. Our production, editing and business decisions are made by people. We do use software tools, including AI-assisted features within editing, transcription and administrative software, to help us do our work. Where such a tool processes client or subject material, we choose providers whose terms are consistent with our obligations under this policy, and we remain responsible for the output.
13. Accuracy, access and correction 13.0 Keeping your information accurate We take reasonable steps to ensure the personal information we collect is accurate, up to date and complete, and that the information we use or disclose is also relevant to the purpose at hand. Records go stale — production contacts change roles, clients change entity names — so if something we hold about you is wrong, tell us and we will fix it. 13.1 Accessing and correcting your information You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact us using the details in section 15. Please tell us what information you are after, so we can find it. - We will verify your identity before releasing anything. - We aim to respond **within 30 days**. - Access is generally free. If a request is complex or requires substantial retrieval from archive media, we may charge a reasonable cost-based fee, and we will tell you what it is before proceeding. - We may refuse access or correction in limited circumstances set out in the Privacy Act — for example where granting it would unreasonably affect another person's privacy, or where the information relates to a legal dispute with us. If we refuse, we will tell you in writing why, and how to complain. If we correct information we have already disclosed to someone else, you can ask us to notify them, and we will take reasonable steps to do so unless it is impracticable or unlawful. 13.2 Requesting deletion You can ask us to delete personal information we hold about you. We will do so where we are able to, but we may need to keep some information — for example where it forms part of a contract record, a tax record, a signed release, or a delivered production already in the client's hands. We will tell you what we have kept and why.
14. Complaints If you think we have mishandled your personal information or breached the APPs, we want to hear about it first. **Step 1 — Tell us.** Contact us using the details below, with enough detail for us to look into it. We will acknowledge your complaint within **5 business days** and aim to give you a written response within **30 days**. **Step 2 — Escalate if you are not satisfied.** You can refer the matter to the Office of the Australian Information Commissioner: - Website: [oaic.gov.au](https://www.oaic.gov.au) - Phone: 1300 363 992 - Post: GPO Box 5218, Sydney NSW 2001
## 15. Contact us
Wenhao Fan: [Wenhao Fan] Timbre and Co. Email: [contact@timbreandco.com] Phone: 1300 704 388 Post: 34 Immarna Avenue, Lilli Pilli NSW 2229
16. Changes to this policy We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available at [timbreandco.com/privacy], and the effective date at the top tells you when it last changed. Where a change is significant, we will take reasonable steps to notify you.