This policy explains how we handle personal data when you visit our website, contact us, work with us as a client, apply for a job or supply services to us, and what happens to personal data in the footage we edit for clients.

In this policy, “New Way Work”, “we” and “us” mean MediaTuig B.V., trading as New Way Work. “You” means the person whose personal data we process. “GDPR” means the General Data Protection Regulation (EU) 2016/679.

1. Who we are

New Way Work is a trading name of MediaTuig B.V., a private limited company under Dutch law.

• Registered office: Groenekanseweg 246, 3737 AL Groenekan, the Netherlands

• Chamber of Commerce (KvK): 96665629

• Email for all privacy questions: info@newwaywork.nl

This policy covers our website www.newwaywork.nl, our client portal My NWW (my.newwaywork.nl), our editor chat (chat.nww.agency), our booking and application pages and the other tools we use to deliver our service. Sprint Studio, the video production agency that MediaTuig B.V. also runs, has its own privacy policy.

We have not appointed a data protection officer, as the law does not require one. Send any privacy question to the address above.

2. Our two roles: controller and processor

A controller decides why and how personal data is processed. A processor processes personal data on a controller’s behalf. We have both roles, depending on the data.

We are the controller for the personal data of:

• visitors to our website and other online pages;

• prospects and other business contacts;

• contact persons at our clients, for their accounts, our communication and invoicing;

• people who apply for a job with us;

• contact persons at our suppliers and partners.

We are the processor for the personal data in the footage and project materials that clients give us to edit, such as the people who are visible or audible in the footage. The client decides what the video is for, so the client is the controller. We process this data only on the client’s documented instructions, under our data processing agreement. Section 4 explains how this works.

If you appear in a video we edited and want to exercise your privacy rights, please contact the organisation that made or published the video. If you contact us instead, we will pass your request on to that organisation and help it respond.

3. What we process, why, and on what legal basis

For each activity below, we describe the data, the purpose, the legal basis under Article 6 of the GDPR and how long we keep the data. Our data retention policy contains all retention periods, including those for client footage.

3.1 Visiting our website

Our website runs on Framer. When you visit it, your browser sends technical data to Framer’s servers, such as your IP address, your browser and device type and the page you request. Framer needs this data to deliver the website, including its images and videos, and to keep it secure.

We use Framer’s built-in site analytics. It works without cookies and shows us aggregate figures only, such as the number of visits per page. We do not build profiles of website visitors. See our cookie policy.

• Legal basis: our legitimate interest in a secure, working website and in understanding in general terms how it is used (Article 6(1)(f) GDPR).

• Retention: we only see aggregate statistics, and we do not keep personal data from your visit ourselves.

3.2 Getting in touch and booking a call

When you email us, book a call through our booking page or speak with us, we process your name, business email address, phone number if you give it, your organisation and role, what you tell us about your project and, for a call, the date and time you choose. Appointments are stored in our Google calendar and calls take place on Google Meet. Our booking page and CRM run on our own servers.

• Purpose: answering your questions, holding calls, sending proposals and following up.

• Legal basis: our legitimate interest in responding to enquiries and developing our business (Article 6(1)(f) GDPR). If you ask for a proposal on your own behalf, for example as a sole trader: taking steps at your request before entering into an agreement (Article 6(1)(b) GDPR).

• Retention: up to 5 years after our last contact, unless you ask us to delete your data earlier.

3.3 Business contacts we approach ourselves

We may contact someone at an organisation that we think could use our service. In that case we use business contact details from public business sources, such as the organisation’s website. We process your name, business contact details, role and organisation, and notes about our contact with you. In our first message, we tell you where we found your details.

• Legal basis: our legitimate interest in direct marketing to businesses (Article 6(1)(f) GDPR), within the rules for electronic marketing messages.

• Your choice: you can object at any time. We then stop contacting you and keep a short note of your objection, so that we do not contact you again.

• Retention: up to 5 years after our last contact, or until you object.

3.4 Clients and their contact persons

When your organisation works with us, we process data about the people we work with there: name, business contact details and role; login details and settings for My NWW, the editor chat and our review environment; requests, briefs, messages, feedback and review comments; plan details, points usage and delivery history; and signature details if you sign a document electronically.

• Purpose: performing the agreement, including accounts, communication with your editor, deliveries, feedback rounds, points administration, service emails and support.

• Legal basis: performing the agreement (Article 6(1)(b) GDPR) if you are the contracting party yourself, for example as a sole trader. Otherwise, our legitimate interest in performing the agreement with your organisation (Article 6(1)(f) GDPR).

• Retention: for as long as the agreement runs. After it ends, we delete account data and project communication as set out in our data retention policy. Contracts and related records: 7 years (see 3.6).

3.5 Portfolio and references

We may show work we delivered in our portfolio, unless the client objects in writing. We name a client as a reference, or publish a quote or endorsement, only after the client’s explicit approval. If you appear in a video in our portfolio and do not want it shown, please contact us.

• Legal basis: our legitimate interest in showing our work (Article 6(1)(f) GDPR) and, for references and endorsements, the client’s approval.

• Retention: for as long as we show the work.

3.6 Invoicing, payments and administration

We process your organisation’s name and address, the name and email address of the billing contact, the VAT number, invoices, payments and payment status. Once online payment is available, a payment provider processes the payment details you enter.

• Purpose: invoicing, collecting payments and keeping our accounts.

• Legal basis: performing the agreement, or our legitimate interest in performing it with your organisation (Article 6(1)(b) or (f) GDPR), and our legal obligation to keep accounting records (Article 6(1)(c) GDPR).

• Retention: 7 years, the retention period under Dutch tax law.

3.7 Suppliers and partners

We process the names, business contact details and roles of contact persons at our suppliers and partners, our communication with them, and contracts and invoices, to manage those services and keep our administration. The legal bases are the same as in 3.6. We keep this data while we work together, and contracts and invoices for 7 years.

3.8 Security of our online services

When you use My NWW, the editor chat or our other online tools, our systems process technical data such as your IP address and login attempts, to keep the services secure, for example by blocking repeated failed logins. The legal basis is our legitimate interest in protecting our systems (Article 6(1)(f) GDPR). We keep this data only as long as needed for that purpose.

4. Footage and project data we edit for clients

When we edit for a client, we process the personal data in the client’s material on the client’s behalf, under our data processing agreement. In short:

• We use the material only to carry out the client’s requests.

• Our editors are employed by PT Starianti Administrative Center in Mataram, Indonesia, which acts as our sub-processor. Section 7 explains how we safeguard this transfer.

• The client chooses how footage reaches us. In the Blackmagic Cloud workflow, the client invites us to a project library in its own Blackmagic Cloud account; only lightweight proxy files sync to our editors and the originals stay on the client’s own storage. Blackmagic Cloud is the client’s own service, not our sub-processor. With an upload, the client sends source footage through the link we share, up to 20 GB per project, and we delete it after delivery. With a Mac mini at the client’s office, our editors work through an encrypted remote connection and the footage stays in the building.

• We never use client material to train AI models. External AI services only process client material when this has been agreed for the project, as described in our AI policy.

• We delete source footage and working files after delivery, and final deliverables after the agreement ends, as set out in our data retention policy.

• The client is responsible for having a legal basis for the personal data in its material, including any consent needed from the people in it, and tells us in advance about sensitive footage. See our acceptable use and content rights policy.

5. Applying for a job

Most job applications reach us through our application page on hub.nww.agency. We store applications in our applicant tracking system, which runs on our own servers.

We process where you live, your name and email address, the role you apply for, your experience and skills, your portfolio or showreel link, your motivation, your CV if you upload one and how you found the vacancy (for example through which advertisement). We also process the notes, assessments and messages that are part of the procedure, including the outcome of the pre-screening described in 5.1. We do not ask for sensitive personal data, such as information about your health or religion. Please leave it out of your application.

• Purpose: assessing your application and running the selection procedure.

• Legal basis: our legitimate interest in selecting suitable candidates (Article 6(1)(f) GDPR). For keeping your application for future vacancies: your consent (Article 6(1)(a) GDPR).

• Retention: 4 weeks after the procedure ends. With your consent, we keep your application for 1 year, so that we can contact you about future vacancies.

5.1 AI-assisted pre-screening

We use DeepSeek to support an initial screening of applications. Application and CV content may be sent to this service for that assessment. A person reviews the result and decides about the application; the tool does not select or reject candidates on its own.

5.2 Recruitment advertising on Meta

We advertise vacancies on Facebook and Instagram, aimed at people who live on Lombok. To see whether these ads lead to applications, our application page uses the Meta pixel. It tells Meta when someone opens the page or sends an application, together with technical data such as IP address and browser details. Meta may link this information to a Facebook or Instagram account. We and Meta are jointly responsible for collecting and sending this data; Meta is responsible for what it does with it after that, under its own privacy policy. We only use the pixel with your consent, which you can withdraw at any time (Article 6(1)(a) GDPR). The choice is optional: declining does not prevent an application. You can change it through Privacy settings on the application page.

5.3 Who sees your application

The people involved in the selection can see your application, including members of our team on Lombok. If we offer you a job, we tell you which company your employment contract will be with. Our editors are employed by PT Starianti Administrative Center in Mataram. If you join as an editor, we share your application with PT Starianti for that purpose.

6. Who receives personal data

We do not sell personal data. We share it only with parties that help us deliver our service, under agreements that require them to protect it, and with authorities when the law requires us to. The main categories of recipients are:

• Editing: PT Starianti Administrative Center in Mataram, Indonesia, which employs our editors.

• Hosting: our own tools (client portal, editor chat, review environment, file exchange, CRM, applicant tracking, automation, e-signing, email sending, single sign-on, booking page and project management) run on virtual private servers that we rent from Hostinger, in a data centre in Germany.

• File storage for some tools, and encrypted backups: DigitalOcean object storage in Amsterdam, the Netherlands.

• Email: Strato AG, Germany.

• Calendar and video calls: Google (Google Ireland Ltd).

• Website hosting and site analytics: Framer B.V.

• Invoicing and bookkeeping software and, once online payment is available, a payment provider.

• AI services: only as described in section 5 and in our AI policy.

• Recruitment advertising: Meta (Facebook and Instagram), as described in 5.2.

Our sub-processors page lists the providers that process personal data on our behalf.

7. Transfers outside the European Economic Area

Some recipients process personal data outside the European Economic Area (EEA).

• Indonesia. The European Commission has not adopted an adequacy decision for Indonesia, where our editors work. We therefore transfer personal data to PT Starianti under a data processing and transfer agreement that incorporates the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914). We have assessed the transfer and apply supplementary measures: the proxy-only workflow where possible, encrypted connections, confidentiality obligations for everyone in the team and deletion of local working copies after delivery. PT Starianti must report incidents to us within 24 hours.

• United States and other countries. Google, Framer and Meta may process personal data outside the EEA, including in the United States. The safeguards depend on the provider, service and applicable account terms, as described on our sub-processors page. We do not have Google Workspace and do not claim that its data processing terms apply to our Google accounts.

• Other providers. If another provider processes personal data outside the EEA, we only allow this with a transfer mechanism recognised under the GDPR, such as Standard Contractual Clauses.

You can ask us for a copy of the safeguards for these transfers at info@newwaywork.nl. We may leave out commercially sensitive details.

8. Security

Our technical and organisational measures to protect personal data include:

• encrypted connections (HTTPS) for all our services;

• firewalls, and access to our servers with keys only;

• single sign-on for our internal tools, with multi-factor authentication that we are rolling out as mandatory;

• encrypted backups, stored off-site;

• a weekly maintenance and update round, periodic security scans and rounds in which we rotate passwords and keys;

• confidentiality obligations in the contracts of everyone in our team.

See our information security policy for details.

Where we are the controller, we report a personal data breach to the Autoriteit Persoonsgegevens within 72 hours and inform the people affected, in each case where the law requires this. If a breach affects personal data we process for a client, we notify the client without undue delay, as set out in our data processing agreement.

9. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal effects for you or similarly significantly affect you. Where AI supports a decision, such as the first screening of job applications, a person always makes the decision.

10. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;

• have incorrect data corrected;

• have your data deleted;

• have the processing restricted;

• object to processing based on our legitimate interest, and object at any time to direct marketing;

• receive the data you gave us in a structured, commonly used format, or have it sent to another organisation;

• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To exercise a right, email info@newwaywork.nl. We may ask you to confirm your identity. We respond within one month, the period the GDPR sets. For complex requests, the GDPR allows up to two further months; if we need them, we will tell you why. Some rights have limits. For example, we cannot delete invoices that tax law requires us to keep.

11. Complaints

If you are not satisfied with how we handle your personal data, we would like to hear from you first. You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority. If you live or work in another country in the EEA, you can also complain to the authority there.

12. Changes to this policy

We update this policy when our services, our providers or the law change. The version and date at the top show when it last changed. If a change significantly affects how we process your personal data, we will let our clients know by email or in My NWW.

13. Contact

For questions about this policy or your personal data, email info@newwaywork.nl or write to MediaTuig B.V., trading as New Way Work, Groenekanseweg 246, 3737 AL Groenekan, the Netherlands.