1. Scope and principles

1.1 This policy applies to personal data held by MediaTuig B.V., trading as New Way Work (“we”). It covers two kinds of data:

• client project data that we process on behalf of our clients as processor, under our Data Processing Agreement (the “DPA”); and

• our own business data, for which we are controller, as described in our Privacy Policy.

1.2 For client project data, the periods in this policy are the standard instructions under the DPA. You can give us different instructions in writing, for example to delete data earlier (section 5).

1.3 We keep data no longer than we need it for the purpose for which we hold it. The periods below are maximum periods, except where the law requires us to keep data longer.

2. Client project data (we are processor)

Source footage uploaded to us

• What it is: original footage you send us through our upload link (maximum 20 GB per project). It is stored in our self-hosted file exchange and used by our editors.

• How long we keep it: until delivery. We delete it once the delivery is approved or deemed approved, and no later than 30 days after final delivery.

• What starts the period: approval or deemed approval of the delivery. The 30-day limit runs from final delivery.

• How we delete it: we delete the footage from our file exchange, and our editing team deletes any local working copies on its workstations.

Proxies and working files

• What it is: proxy files, project files, intermediate renders, and review versions with the comments on them in our review environment. This includes proxies that sync to our editors’ workstations from your Blackmagic Cloud library.

• How long we keep it: until the project is closed, and no later than 30 days after final delivery.

• What starts the period: closing of the project. The 30-day limit runs from final delivery.

• How we delete it: we delete the files from our tools, and our editing team deletes the copies on its workstations.

Projects in your own Blackmagic Cloud library

• What it is: the project library you create in your own Blackmagic Cloud account, including the proxies and the assets our editors use, which sync to your library.

• How long it is kept: you decide. The library is under your control, not ours.

• How it is deleted: you delete the project or library in your own account, and you remove our access when the project or the agreement ends. Copies on our side are deleted as described under proxies and working files.

Footage on a Mac mini at your office

• What it is: source footage on a Mac mini at your premises, if you choose that option, and the finals our editors render into a folder for you.

• How long it is kept: you decide. The footage never leaves your building, and we do not copy it to our own systems.

• How it is deleted: you delete it.

Final deliverables in My NWW

• What it is: the final edited files we deliver through our client portal My NWW.

• How long we keep it: available while the agreement runs. We delete the files within 3 months after the agreement ends, unless agreed otherwise in writing.

• What starts the period: the end of the agreement.

• How we delete it: we delete the files from My NWW and from the storage behind it. Download any files you want to keep before they are deleted.

Chat messages and briefs

• What it is: messages in our editor chat (chat.nww.agency), and the briefs and requests you submit in My NWW.

• How long we keep it: while the agreement runs, so that the project history remains available. At the end, we arrange return or deletion of project messages and briefs through the manual close-out procedure without undue delay, following your instructions. We keep a separate record only where it is needed for a legal obligation or an unresolved claim; this does not justify keeping all project communication indefinitely.

• What starts the period: the end of the agreement.

• How we delete it: we delete the messages, briefs and requests from the tools concerned.

Backups

• What it is: backup copies from selected self-hosted systems. The documented routines cover CRM, Hub and onboarding records, plus project-management data. Off-site copies produced by these routines are GPG-encrypted and use DigitalOcean Spaces in Amsterdam. This does not establish backup coverage for every uploaded file or every tool.

• How long we keep it: rotation differs by system. The documented CRM, Hub and onboarding routines use seven daily positions; the project-management routine keeps local copies for 14 days. These settings do not establish one maximum for every off-site copy or object version. We identify the applicable backup copies and retention when carrying out a deletion request and explain any remaining copy instead of claiming immediate deletion from all backups.

• What starts the period: the deletion of the data from our live systems.

• How we delete it: live data is handled through the manual procedure. Backup copies are recorded separately and handled under their verified system-specific retention. Access is restricted to recovery purposes. If a backup is restored, data already due for deletion must be identified and deleted again through the recorded procedure.

3. Our own business data (we are controller)

Contact data of prospects, leads and clients

• What it is: names, business contact details and notes about our contacts with prospects, leads and the contact persons of our clients, kept in our self-hosted CRM.

• How long we keep it: up to 5 years after the last contact.

• What starts the period: the last contact between us and the person or organisation concerned.

• How we delete it: we delete the record from our CRM. Contact details that appear in contracts and invoices are kept with those documents, as described below.

Contracts, invoices and administration

• What it is: signed agreements, invoices, payment records and the other records we must keep for our administration.

• How long we keep it: 7 years, to meet the Dutch tax retention obligation (Article 52 of the Algemene wet inzake rijksbelastingen).

• What starts the period: for contracts, the end of the financial year in which the contract ended; for invoices and other records, the end of the financial year to which they relate.

• How we delete it: we delete the records from our administration and e-signing systems after the period.

Applicants

• What it is: applications, CVs and assessments of people who apply to join our team through hub.nww.agency/apply, kept in our self-hosted applicant tracking system.

• How long we keep it: 4 weeks after the application procedure ends, or 1 year with the applicant’s consent.

• What starts the period: the end of the application procedure.

• How we delete it: we delete the application from our applicant tracking system.

Website visitors

• What it is: our website runs on Framer. Framer’s built-in analytics are cookieless and aggregate, and we do not create personal profiles of visitors.

• How long we keep it: we do not hold personal data of individual visitors from our analytics, so there is nothing to delete per visitor. Framer processes technical data, such as IP addresses, to deliver the website, under its own terms.

4. How deletion works

4.1 We use a manual close-out procedure. A responsible team member records the final delivery date or the end date of the agreement and the applicable deletion deadline. Before deletion, that person checks the data and tools concerned, any request for a copy and any legal obligation to retain a record. The team member then arranges deletion from the relevant tools and confirms deletion of working copies with the editing team. We record the scope and completion of the action. No automatic deletion process is enabled by this policy.

4.2 In services and equipment you control, such as your Blackmagic Cloud library or a Mac mini at your office, you decide when data is deleted and you delete it yourself.

4.3 Backup copies may remain after live data is deleted. We record that limitation and check the applicable copies and system-specific retention as described in section 2; we do not represent an unverified backup rotation as completed deletion.

4.4 On request, we confirm in writing which data has been deleted and when. If a copy must be retained by law or remains in a backup, we explain that limitation and the applicable handling. A retention policy is not confirmation that a particular deletion has already been completed.

5. Earlier deletion or a copy

5.1 As a client, you can ask us at any time to delete client project data earlier than this policy provides, by emailing info@newwaywork.nl. We carry out the request without undue delay and confirm in writing when it is done. If you ask us to delete source footage before delivery, we cannot complete the edit. Records we must keep by law, such as invoices, are kept until the legal period ends.

5.2 You can download your final deliverables from My NWW at any time while they are available. If you want a copy of other client project data we still hold, such as chat messages or briefs, email us and we provide it in a common file format.

5.3 People who appear in your footage should send requests about that footage to you, because you are the controller. If we receive such a request, we forward it to you and help you respond, as described in article 11 of the DPA.

5.4 Anyone whose personal data we hold as controller, such as a prospect or an applicant, can ask for access, a copy or deletion as described in our Privacy Policy.

6. Changes to this policy

6.1 We update this policy when our processes, tools or providers change. The version and date at the top show when it was last changed.

6.2 A change that would extend how long we keep client project data follows the procedure for updates in article 17 of the DPA.