Privacy Policy

1. Data Controller

Beehind The Scene Ltd.(“we”, “us”, or “our”) is the Data Controller responsible for your personal data collected through the beehindthescene.com website, mobile services, and the BeeTalents / BeeEvents ecosystem.

We are committed to respecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Privacy Lead Contact:

Email: beatriz@beehindthescene.com

Beehind The Scene Ltd, London, England, United Kingdom

2. Information We Collect

We collect personal data directly from you when you register, create a profile, interact with other users, or browse our platform:

Identity & Contact Data: Full name, stage/professional name, email address, telephone number, city, and country of residence.
Creative Talent Profile Data: Professional category (model, DJ, actor, dancer, influencer, photographer, stylist, etc.), physical attributes/measurements (height, clothing size, eye/hair color where relevant for casting), bio, languages, hourly/daily rates, and calendar availability.
Media & Portfolio Content: High-resolution photos, videos, showreels, audio clips/DJ sets, and past campaign credits uploaded to showcase creative work.
Brand & Company Data: Company name, registration number, industry, contact person, billing address, brand assets/logos, and job opportunity specifications.
Booking & Transaction Data: Booking contracts, event dates, locations, agreed payment amounts, reviews, and client-talent feedback.
Payment & Payout Data: Bank account and debit/credit card details are collected and processed directly by our payment processor, Stripe Connect. We do not store your full debit or credit card numbers on our servers.
Communications Data: Messages, inquiries, and booking negotiations conducted between users via the platform.
Technical & Usage Data: IP address, device type, browser specifications, operating system, access timestamps, and usage behavior recorded via analytics tools (PostHog).

3. How & Why We Use Your Personal Data

We use your personal data for specific, explicit, and legitimate purposes:

To register, verify, and administer your account.
To display public talent portfolios and brand opportunity postings.
To power predictive search and matchmaking algorithms between brands and creative talent.
To process bookings, generate hiring contracts, and facilitate escrowed payments and payouts.
To provide in-app messaging, notifications, and real-time calendar management.
To monitor platform safety, detect fraud, and resolve disputes.
To comply with statutory legal and accounting obligations in the United Kingdom.

4. Lawful Bases for Processing under UK GDPR

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

Performance of a Contract (Article 6(1)(b))

Processing is necessary to provide our services, maintain your profile, manage bookings, and facilitate payments according to our Terms of Service.

Legitimate Interests (Article 6(1)(f))

Processing necessary for improving our platform, securing our services against fraud, conducting product analytics, and maintaining high standards in our creative community, balanced against your fundamental rights.

Legal Obligation (Article 6(1)(c))

Complying with statutory requirements under UK company law, HMRC tax reporting, and anti-money laundering (AML) / KYC regulations.

Consent (Article 6(1)(a))

Where you have provided clear consent (for instance, subscribing to optional marketing newsletters or permitting non-essential cookies). You can withdraw consent at any time.

5. Sharing & Third-Party Service Providers

We do not sell your personal data. We only share information with:

Other Marketplace Users: When you publish a talent profile, your public bio, portfolio photos, videos, rates, and reviews are visible to brands and visitors. When a booking is confirmed, necessary contact details are shared to fulfill the engagement.
Stripe Payments (Stripe Payments Europe Ltd): For secure card payment processing, escrow services, and talent bank payouts.
Supabase Inc.: For secure database hosting, user authentication, and media storage with row-level security (RLS) policies.
PostHog Inc.: For product analytics to understand platform usage and improve user experience.
Vercel Inc.: For frontend application hosting and edge delivery.
Law Enforcement & Regulatory Bodies: If required by court order, statute, or in good faith to investigate suspected fraud or illegal activity.

6. International Data Transfers

Some of our third-party infrastructure providers operate servers located outside the United Kingdom (such as in the European Economic Area or the United States).

Whenever personal data is transferred outside the UK, we ensure adequate protections are in place in accordance with UK data protection laws, including utilizing:

Countries deemed adequate by the UK Government.
The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs).
Recognized data privacy frameworks and rigorous technical encryption standards.

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, tax, or reporting requirements.

Active Accounts: Profile, portfolio, and messaging data are retained while your account remains active.
Financial Records: Transaction, invoice, and booking records are retained for 6 to 7 years following completion to comply with UK tax (HMRC) statutory regulations.
Account Deletion: Upon account deletion, personal profile information and portfolio media are permanently removed or anonymized within 30 days, subject to legally mandated retention obligations.

8. Your Legal Rights under UK GDPR

Under UK data protection law, you have significant rights regarding your personal data:

Right of Access (Subject Access Request): You can request a copy of the personal data we hold about you.
Right to Rectification: You can edit inaccurate or incomplete data directly in your profile settings or request us to rectify it.
Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data where there is no compelling legal reason for us to keep it.
Right to Restrict Processing: You can ask us to pause processing of your data under certain conditions.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object: You can object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, please email us at beatriz@beehindthescene.com. We will respond within one calendar month in accordance with the UK GDPR.

9. Data Security

We implement robust technical and organizational measures to safeguard your personal data, including:

End-to-end TLS/SSL transport encryption for all platform traffic.
PostgreSQL Row Level Security (RLS) enforcing strict multi-tenant data isolation.
Tokenized authentication and encrypted password storage.
Restricted employee access to production databases on a need-to-know basis.

10. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, maintain session authentication, and analyze platform performance.

Essential Cookies: Required for secure login, session verification, and form security. These cannot be disabled.
Analytics Cookies: Help us measure visitor engagement, page response times, and feature usage via privacy-focused analytics.

11. Contact Us & Complaints to the ICO

If you have any questions or concerns regarding our privacy practices, please contact our Data Privacy Lead:

Beehind The Scene Ltd.

Contact Email: beatriz@beehindthescene.com

You also have the right to lodge a complaint with the UK supervisory authority for data protection issues:

Information Commissioner's Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 | Website: www.ico.org.uk