Privacy Policy

Who we are

Latitude Film School is operated by Aram Atkinson, based in the United Kingdom. We provide online filmmaking education through courses, video lessons, workshops, and a newsletter.

For the purposes of UK data protection law, the data controller is Aram Atkinson, trading as Latitude Film School.

Website: latitudefilmschool.com
Email: hello@latitudefootprint.com

What data we collect

We may collect and process the following personal data:

• Account information: your name and email address when you create an account or sign up for our newsletter.
• Payment information: payment details are processed securely by our payment provider, Paddle. We do not store your full card details. We may receive your name, email, country, and transaction reference from Paddle.
• Course progress: which lessons you have completed and your progress through courses, stored in our database.
• Communications: any messages or emails you send to us.
• Technical data: IP address, browser type, device information, and pages visited, collected through server logs and analytics tools.
• Preferences: your light/dark mode preference, stored locally on your device.

How we use your data

We use your personal data for the following purposes:

• Providing our services: to create and manage your account, give you access to courses, and track your learning progress.
• Processing payments: to handle course purchases and refunds through Paddle.
• Newsletter delivery: to send you filmmaking insights, course announcements, and updates via Ghost, if you have subscribed.
• Communication: to respond to your enquiries and provide support.
• Analytics: to understand how our website is used and improve our content and services. We may use Google Analytics or similar tools.
• Legal compliance: to comply with our legal obligations, including tax and accounting requirements.

Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

• Contract: processing necessary to perform a contract with you (e.g., providing access to purchased courses).
• Consent: where you have given clear consent for us to process your data for a specific purpose (e.g., subscribing to our newsletter).
• Legitimate interests: processing necessary for our legitimate interests, such as improving our services, provided these do not override your rights. This includes website analytics and fraud prevention.
• Legal obligation: processing necessary to comply with a legal obligation (e.g., financial record-keeping).

You may withdraw consent at any time by contacting us or using the unsubscribe link in our emails.

Important: Creating an account to access courses and subscribing to our newsletter are separate actions requiring separate consent. Creating an account does not subscribe you to marketing emails. Newsletter subscription is entirely optional and requires you to actively enter your email in a newsletter signup form.

Shared account with Latitude Footprint

Your Latitude account works across both Latitude Film School and Latitude Footprint (our production carbon tracking app). Your email address and password are shared between these services via a single authentication system. However:

• Your course progress (Film School) and production data (Footprint) are kept completely separate.
• Signing up for one service does not automatically create an account on the other — but if you choose to use both, you can log in with the same credentials.
• Each service has its own privacy policy: Latitude Footprint Privacy Policy.

Third-party processors

We share your data with the following third-party service providers who process data on our behalf:

• Supabase (authentication and database) — stores your account data and course progress. Data is stored in the UK (London, eu-west-2 region). Supabase Privacy Policy
• Cloudflare Turnstile (CAPTCHA/bot protection) — processes your IP address to verify you are human during sign-up. No personal data is stored. Cloudflare Privacy Policy
• Vercel (website hosting) — serves our website via a global content delivery network. No personal data is stored by Vercel. Vercel Privacy Policy
• Ghost (blog and newsletter platform) — manages newsletter subscriptions and delivery. When you subscribe to our newsletter, Ghost stores: your email address, subscription date, email open and click activity, and reading history on our blog. You can unsubscribe at any time via the link in every email. Ghost Privacy Policy
• Paddle (payment processor) — handles all payment transactions. We do not have access to your full payment card details. Paddle Privacy Policy
• YouTube (video hosting) — embedded video content on our site. We use YouTube's privacy-enhanced mode (youtube-nocookie.com) which does not set cookies until you play a video. Google Privacy Policy
• Vimeo (course video hosting) — hosts premium course video content. Vimeo Privacy Policy
• Google Analytics (analytics, if enabled) — collects anonymised usage data to help us improve our website. Google Privacy Policy

We do not sell your personal data to any third party.

Cookies

Our website uses cookies and similar technologies (including localStorage) to provide essential functionality, remember your preferences, and understand how our site is used.

For full details about the cookies we use and how to manage them, please see our Cookie Policy.

Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: retained for as long as your account is active. If you request account deletion, we will erase your data within 30 days, except where we are required to retain it by law.
• Course progress: retained for as long as your account is active.
• Newsletter subscriptions: retained until you unsubscribe.
• Payment records: retained for 7 years to comply with UK tax and accounting obligations.
• Analytics data: anonymised analytics data may be retained indefinitely as it cannot be linked to an individual.
• Communications: retained for up to 2 years after your last interaction, unless a longer period is required for legal purposes.

Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct any inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your personal data in certain circumstances.
• Right to restrict processing: you can ask us to limit how we use your data.
• Right to data portability: you can request your data in a structured, commonly used, machine-readable format.
• Right to object: you can object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at hello@latitudefootprint.com. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

Children's data

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact us immediately and we will take steps to delete it.

International transfers

Some of our third-party processors process data outside the United Kingdom:

• Ghost (newsletter platform) — data stored in the United States. Ghost Inc. operates under Standard Contractual Clauses (SCCs) as approved under UK GDPR Article 46.
• YouTube / Google (video embeds) — data may be processed in the United States. We use YouTube's privacy-enhanced mode to minimise data collection. Google operates under SCCs and the EU-US Data Privacy Framework.
• Cloudflare (bot protection) — processes IP addresses globally. Cloudflare operates under SCCs and is certified under the EU-US Data Privacy Framework.

Your account data and course progress are stored in the United Kingdom (Supabase, London region). Payment data is processed by Paddle, a UK/EU-based entity.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK GDPR.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. If we make significant changes, we will notify you by email or through a notice on our website.

Contact us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Aram Atkinson (Latitude Film School)
Email: hello@latitudefootprint.com
Location: United Kingdom