Privacy Policy

1.1Introduction

M3CA (“we”, “our”, “us”) is committed to protecting the privacy of our clients, users and visitors (“you”, “your”). This Privacy Policy sets out how we collect, use, share and protect personal information when you visit our websites or use our services. By using our services or accessing our websites you agree to the practices described here.

1.2Data controller

M3CA is the trading name of M3CA LTD, 35 Berkeley Square, Berkeley Suite, Mayfair, London, W1J 5BJ, United Kingdom, with M3CA LLC acting as controller for engagements contracted in the United States. The controlling entity for your data is the one named in your contract, quotation or statement of work.

1.3Where this policy applies

• Websites: m3ca.com and the vertical sites operated under the same brand, including m3ca.healthcare, chef.m3ca.com, talent.m3ca.com, edu.m3ca.com, projects.m3ca.com and app.m3ca.com.
• Platforms: M3CA Atlas, M3CA Console, M3CA Academy, M3CA TV and any client or admin portal we host for you.
• Services: media production, IT and managed services, cyber and compliance, education and certification, talent and crew supply, hospitality staffing, healthcare operations, marketing, and CNC and fabrication.
• Where we process personal data on your instructions as part of a service, we act as processor and your own privacy notice governs the underlying data.

1.4Contact us

• Email: info@m3ca.com
• Phone: (+44) 7359 079731
• Address: 35 Berkeley Square, Berkeley Suite, Mayfair, London, W1J 5BJ, United Kingdom
• Privacy requests: mark your message “Privacy request” so it is routed to the team that handles access, correction and deletion.

2.1Personal information

• Name, email address, phone number and mailing address.
• Job title, company name and the sector you work in.
• Billing and payment information, processed by our payment providers rather than stored in full by us.
• Enquiry, brief and quotation content you submit through our forms, including budgets, timelines and requirements.
• Account credentials and profile details for portals, platforms and training accounts.

2.2Technical information

• IP address, browser type and version, operating system and device type.
• Time zone setting, referring and exit pages, clickstream data and log files.
• Performance and error diagnostics used to keep pages, video and platform features working.

2.3Cookies and similar technologies

We use cookies and similar technologies to keep sessions secure, remember preferences and understand how our sites are used. Cookies are small text files stored on your device. You can control them through your browser settings and through our cookie notice; blocking some cookies may limit parts of the service. Our Cookie Policy explains the categories we set.

2.4Media, production and event data

• Footage, stills, audio and contributor releases captured during production, broadcast on M3CA TV or used in showreels, on the basis of a signed release or contract.
• Site and location details, call sheets, and crew or contributor contact information needed to run a shoot safely.

2.5Information from other sources

• Referrals, introductions and publicly available business information used to qualify an enquiry.
• Data from our suppliers and sub-processors, such as hosting, analytics, payment, email and identity providers.
• Where you sign in with a third-party identity provider, the profile fields that provider shares with us.

2.6Special category and sensitive data

We avoid collecting special category data unless a service requires it. Where a healthcare, staffing or compliance engagement does involve health, right-to-work or background information, we collect only what is necessary, restrict access to the staff delivering that service, and process it under a written agreement with an identified lawful basis.

3.1Providing and improving our services

• To deliver the services you request and manage your account.
• To process transactions, quotations, invoices and billing.
• To personalise your experience and improve our websites and platforms.
• To respond to your enquiries and provide client support.
• To send service-related notifications such as project updates, maintenance and incident notices.

3.2Marketing and communications

• To send marketing communications, newsletters and promotional material where you have consented or where we have a legitimate business interest and you have not objected.
• To tell you about new services, verticals, features or updates.
• To run surveys and gather feedback. Every marketing message includes a one-click unsubscribe.

3.3Analytics and research

• To analyse website and platform usage and understand user behaviour.
• To improve our services and develop new products.
• To compile aggregate, de-identified statistics for reporting and case studies.

3.4Security and compliance

• To protect our users, clients and business.
• To detect, investigate and prevent fraud, abuse and unauthorised activity.
• To comply with legal obligations and to establish, exercise or defend legal claims, and to enforce our Terms and Conditions.

3.5Legal bases

• Contract: to deliver services, manage accounts and take payment.
• Legitimate interests: to respond to business enquiries, secure our systems, improve our services and carry out proportionate business-to-business marketing.
• Consent: for optional cookies, marketing to individuals where consent is required, and any use of your likeness in published media.
• Legal obligation: for tax, accounting, employment, safeguarding and regulatory record-keeping.

3.6Automated decisions

We do not make decisions that have legal or similarly significant effects on you by automated means alone. Where a platform feature ranks, matches or scores content, a person reviews the outcome before it is acted on.

4.1Service providers

We share information with trusted third-party providers who help us run our business, such as payment processors, hosting and cloud providers, email and communication services, analytics tools and AI model providers. They may access your information only to perform tasks on our behalf, are bound by contract, and must protect it to a standard at least equal to this policy.

4.2Within the M3CA ecosystem

Where a project spans more than one vertical, we share the minimum necessary information between M3CA teams and between M3CA LTD and M3CA LLC so the work can be delivered and supported. Access is limited to the people working on your engagement.

4.3Legal requirements

We may disclose your information where required by law or in response to valid requests by public authorities, including court orders, subpoenas and regulatory or government requests.

4.4Business transfers

In a merger, acquisition or sale of all or part of our assets, your information may transfer as part of the transaction. We will notify you by email or a prominent notice on our website of any change in ownership or use of your personal information.

4.5Protection of rights

We may disclose information to protect the rights, property or safety of M3CA, our users, clients or others, including exchanging information with other organisations for fraud protection and credit risk reduction.

4.6What we never do

• We do not sell your personal information.
• We do not use client content or prompts to train third-party foundation models.
• We do not share your data with advertisers for their own independent purposes.

5.1Data security

We implement appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse or alteration, including encryption in transit, access controls, least-privilege permissions, patching, monitoring and logging, and hardened hosting. No method of internet transmission or electronic storage is fully secure, so we cannot guarantee absolute security.

5.2Breach response

We maintain an incident response process. Where a personal data breach is likely to result in a risk to your rights and freedoms we notify the relevant supervisory authority within 72 hours of becoming aware of it, and we notify affected individuals and client controllers without undue delay.

5.3Data retention

• We keep personal information only as long as necessary for the purposes it was collected for, or to meet legal obligations.
• Enquiry and quotation data: kept while the conversation is live and for a reasonable period afterwards.
• Client, contract and financial records: kept for the duration of the engagement and then for the period required by tax and company law.
• Platform and portal accounts: kept while the account is active, then deleted or anonymised after a defined dormancy period.
• Production media: retained under the terms of the relevant release or contract.
• When information is no longer needed we securely delete or anonymise it.

5.4International data transfers

Your personal information may be transferred to and processed in countries other than your own, including the United Kingdom, the European Economic Area and the United States, where some of our providers and servers are located. Where data leaves the UK or EEA we rely on lawful transfer mechanisms such as adequacy decisions, the UK International Data Transfer Addendum or standard contractual clauses, together with appropriate technical safeguards.

5.5Third-party links

Our websites contain links to third-party sites we do not operate. We have no control over, and accept no responsibility for, their content, privacy policies or practices. Review their policies before providing personal information.

6.1Access and correction

You have the right to access the personal information we hold about you and to request correction where it is inaccurate or incomplete. Contact us using the details in this policy.

6.2Data portability

You have the right to receive a copy of your personal information in a structured, commonly used, machine-readable format, and to ask us to transmit it to another controller where technically feasible.

6.3Deletion

You have the right to request deletion of your personal information in certain circumstances, such as where it is no longer necessary for the purposes it was collected for, or where you withdraw consent and no other basis applies.

6.4Restriction and objection

You have the right to ask us to restrict processing, for example while you contest the accuracy of data, and to object to processing for direct marketing or on grounds relating to your particular situation.

6.5Withdrawing consent

Where we process on the basis of consent you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

6.6How to exercise a right

Email info@m3ca.com marked “Privacy request”. We may need to verify your identity before acting. We respond within one month and will tell you if we need a permitted extension. There is no charge for a reasonable request.

6.7Complaints

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA. We would prefer the chance to resolve it with you first.

7.1UK and European privacy rights

• Right to access the personal information we hold about you.
• Right to rectification of inaccurate or incomplete information.
• Right to erasure in defined circumstances.
• Right to restriction of processing.
• Right to data portability.
• Right to object, including to direct marketing.
• Right to withdraw consent where processing is based on it.

7.2California privacy rights

• Right to know what personal information we collect, use and disclose.
• Right to delete personal information we hold, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA and CPRA.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising any of these rights.

7.3Children's privacy

Our services are not directed to individuals under 16 and we do not knowingly collect their personal information. Where an education or training programme involves learners under 18, we act on the instructions of the institution or employer under a written agreement and with appropriate consent. If you believe we hold information about a child, contact us and we will delete it promptly.

7.4International users

If you access our services from outside the United Kingdom, your information may be transferred to, stored and processed in the UK, the EEA or the United States. By using our services you consent to that transfer, subject to the safeguards described in this policy.

8.1M3CA Healthcare

Healthcare operations software may process information about staff, rotas, compliance evidence and, where a client configures it, patient-related records. In those engagements M3CA is a processor acting on the client's documented instructions under a data processing agreement, access is role-based and audited, and we do not use that data for our own analytics or marketing.

8.2M3CA Talent and Sous Chef

Talent, crew and hospitality staffing involve candidate profiles, availability, qualifications, right-to-work evidence, references and payment details. We share only what a placement requires with the hiring client, keep verification documents for the period employment and immigration law requires, and delete candidate records on request unless a legal obligation applies.

8.3M3CA Academy and education

Training and certification services process enrolment details, course progress, assessment results and certificates. Where an employer or institution sponsors a learner we report attendance and outcomes to that sponsor. Records needed to evidence a certification are retained for the period the awarding body requires.

8.4M3CA Console, Atlas and client portals

Portals and platforms log sign-ins, actions and content changes so we can secure accounts, support you and maintain an audit trail. Client content stored in a platform remains yours; we process it to run and support the service and under the terms of your agreement.

8.5M3CA TV and published media

Video playback generates technical and engagement data used to measure performance and improve delivery. Contributors appearing in published media are covered by a release, and requests to remove a contribution are reviewed against the terms of that release and any third-party licence.

8.6M3CA AI and assistants

• Prompts and responses may be logged for security, abuse prevention and quality, and are handled under this policy.
• Do not enter confidential information, personal data about others, or credentials into an assistant unless your agreement with us expressly covers it.
• Assistant output is generated and may be inaccurate; it is reviewed by a person before it is relied on and is not legal, medical, clinical or financial advice.
• We use enterprise model providers under contract and do not permit them to train foundation models on your content.

9.1Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, our services or legal requirements. Changes are posted on this page with a revised “last updated” date, and material changes are notified by email or a prominent notice on our website. Please review it periodically.

9.2Related documents

This policy sits alongside our Terms and Conditions and our Cookie Policy. Where a signed agreement or data processing agreement covers the same subject, that agreement takes precedence for the services it describes.

9.3Conclusion

Your privacy matters to us and we are committed to protecting your personal information. If you have any questions or need further information, contact us at info@m3ca.com. Thank you for trusting M3CA with your personal information.