1. Who we are
This website, modem-studios.com, and the Modem Studios business are operated by Pence Talent Ltd, a company registered in England and Wales under company number 14912106, with its registered office, as filed at Companies House, at Office, 31 Cattle Market Street, Norwich, England, NR1 3DY. We operate from London.
Modem Studios is a trading name of Pence Talent Ltd. Where this policy says “we”, “us” or “our”, it means Pence Talent Ltd trading as Modem Studios.
Pence Talent Ltd is the data controller for the personal data described in this policy. That means we decide why and how your personal data is used, and we are responsible for looking after it.
How to contact us about your data
Email: contact@modem-studios.com
Post: Data Protection, Pence Talent Ltd, Office, 31 Cattle Market Street, Norwich, England, NR1 3DY
We have not appointed a statutory Data Protection Officer, as we are not required to under Article 37 of the UK GDPR. Data protection questions are handled by our co-founders and reach us at the address above.
We are registered with the Information Commissioner’s Office (ICO) as a data controller. Our ICO registration reference is ZB704966.
This policy was last updated on 12 October 2026.
2. Who this policy is for
This policy covers everyone whose personal data we handle. Different parts apply to different people, so we have set out below which group you are likely to be in.
Website visitors. Anyone browsing modem-studios.com.
Creators and talent. Creators we represent, creators we are in conversation with, and creators who apply to us through the form on our site.
Brand, agency and media contacts. People we work with at brands, media agencies, production companies and broadcasters, including those we contact as part of business development.
Suppliers and freelancers. Photographers, editors, producers and other individuals we engage on campaigns and productions.
Applicants. People applying for jobs, placements or freelance work with us.
This policy does not cover:
Third party websites we link to. Clicking through to Instagram, LinkedIn, YouTube, TikTok or a brand’s own site takes you to a service with its own privacy policy, and we are not responsible for it.
Content a creator we represent publishes on their own channels. That relationship is between the creator, the platform and their audience.
If you are a creator we represent, your management agreement with us will also say things about how we handle your information. Where this policy and that agreement differ, the agreement governs the commercial terms and this policy governs your data protection rights.
3. The personal data we collect
If you visit our website
Technical data: IP address (which our hosting provider may truncate or hash), browser type and version, device type, operating system, approximate location derived from IP at country or city level.
Usage data: pages viewed, time on page, the site you arrived from, the links you clicked.
Cookie and consent data: your cookie preferences and when you gave them.
If you fill in the contact or creator enquiry form
Your name.
Your email address.
Your social media handles and links to your channels.
Your phone number, if you give it.
Whether you are a creator, a brand or something else.
Anything else you choose to write in the free text fields. Please do not put sensitive information in a web form.
If you are a creator we represent or are in conversation with
Identity and contact details: name, date of birth where needed for contracts and age verification, email, phone, postal address.
Channel and audience data: handles, follower counts, engagement rates, audience demographics supplied by you or exported from platform analytics, previous brand work and rate history.
Commercial data: fee rates, deal terms, campaign deliverables, exclusivity commitments, usage windows.
Payment data: bank account details, sort code and account number, VAT number, company number if you invoice through a company, self-billing details.
Correspondence: emails, WhatsApp and other messages, call notes, meeting notes.
Contractual documents: signed agreements, briefs, releases and consents.
Content: photos, video and audio of you supplied for campaigns, our website roster pages and pitch materials.
If you are a brand, agency or media contact
Name, job title, employer, business email, business phone, LinkedIn profile.
Records of our conversations with you, including meeting notes, call notes and email history.
Campaign and brief information you send us.
Whether you have opened or clicked our emails.
If you are a supplier, freelancer or applicant
Name, contact details, the services you provide or the role you applied for.
Invoices, payment details, right to work information where we are required to check it.
For applicants: your CV, covering letter, portfolio, interview notes and references.
Special category data
We do not set out to collect special category data, which means data about health, racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetics, biometrics, sex life or sexual orientation. In practice some of this can be inferred from publicly posted content, and brands occasionally ask for diversity information for casting. Where we handle it, we rely on your explicit consent, and we ask for that consent separately and in writing. You can withdraw it at any time.
We do not knowingly collect criminal offence data.
4. Where we get your data from
Most of the personal data we hold comes directly from you: a form submission, an email, a call, a signed contract.
We also obtain personal data from other sources. Under Article 14 of the UK GDPR we have to tell you when we do this and where it came from.
Public social media profiles. Where a creator’s handle, follower count, bio and published content are publicly visible on Instagram, TikTok, YouTube, LinkedIn or X, we may record them to assess a potential fit for representation or a campaign.
Business contact databases. We use Apollo.io, a business contact and sales intelligence provider, to find and verify business contact details for people in relevant roles at brands, agencies and media companies. This typically means name, job title, employer, business email and LinkedIn profile. Apollo compiles this from public sources and its own contributor network.
Company registries and public records. Companies House and similar sources, to verify who we are contracting with.
Referrals. Someone may pass us your details, for example a creator recommending another creator, or a contact introducing a colleague.
Platform and campaign reporting. Brands, agencies and social platforms send us performance reports on campaigns which may include your data.
If we collect your business contact details from a third party source and then contact you, we will tell you where we got them the first time we get in touch, and you can ask us to delete them straight away.
5. Why we use your data, and our lawful basis
Under the UK GDPR we must have a lawful basis for everything we do with your personal data. Here is exactly what we do and why.
Run and secure the website
Technical and usage data
Legitimate interests: keeping the site working, available and safe from abuse
Measure how the site is used
Aggregated page view and traffic source counts, with nothing stored on your device
Legitimate interests: understanding which pages people find useful
Respond to an enquiry from the contact form
Name, email, handles, message
Legitimate interests: answering someone who has asked us to get in touch. Where the enquiry leads towards a contract, taking steps at your request before entering into a contract
Assess a creator for representation
Contact details, channel and audience data, previous work
Legitimate interests: running a talent management business. Where talks are advanced, steps before entering into a contract
Manage a creator we represent, pitch them to brands, negotiate and deliver campaigns
All creator data in section 3
Performance of the management agreement with you
Pay creators, raise invoices, chase payment
Payment and commercial data
Performance of contract, and legal obligation for accounting records
Keep accounting, VAT and statutory records
Transaction and contact data
Legal obligation under the Companies Act 2006, VAT Act 1994 and HMRC rules
Contact people at brands, agencies and media about creator partnerships
Business contact details
Legitimate interests: business to business marketing of a service relevant to the recipient’s job
Send marketing emails, if we start doing so
Name, email, engagement data
Consent, or the PECR soft opt-in where you are an existing client
Publish creator work and campaign case studies on our site and in pitch materials
Name, image, content, campaign results
Performance of contract with the creator, plus the usage rights agreed with the brand. For anyone not under contract with us, consent
Assess a job or freelance application
Application data
Steps before entering into a contract, and legitimate interests in recruiting
Establish, exercise or defend legal claims
Any relevant data
Legitimate interests: protecting the business. For special category data, Article 9(2)(f)
Comply with a legal or regulatory request
Any relevant data
Legal obligation
What we mean by legitimate interests
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that what we are doing is something you would reasonably expect, and that it does not override your interests. In practice that means we keep business to business outreach relevant and low volume, we stop the moment you ask us to, and we do not use legitimate interests to justify anything intrusive.
You can ask us for a copy of the balancing test for any of the activities above by emailing contact@modem-studios.com.
6. Marketing and outreach
We do not currently run a newsletter or send bulk marketing email. If that changes we will update this section before the first send. The rules below are the ones we work to. Marketing emails and texts in the UK are governed by the Privacy and Electronic Communications Regulations 2003 (PECR) as well as the UK GDPR.
If you are an individual or a sole trader
We will only send you marketing by email if you have opted in, or if you have bought a service from us or been in negotiations to and we are marketing a similar service. That second route is the PECR soft opt-in, and you can refuse it at the point we collect your address and in every message after.
If you work at a company, LLP or other corporate body
PECR allows us to send business to business marketing to your corporate email address without prior consent. We rely on legitimate interests under the UK GDPR for this, and we only contact people whose role is relevant to creator partnerships.
However you came to be on our list
Every marketing email carries a working unsubscribe link, and we act on it within three working days.
You can also stop everything by emailing contact@modem-studios.com with the word UNSUBSCRIBE.
We will not sell or rent your details to anyone for their own marketing.
We keep a suppression list of people who have opted out. That is the only way to make sure we do not contact you again by accident, and we keep it indefinitely for that purpose.
Opting out of marketing does not stop service messages. If you are a creator we represent, we will still email you about your deals, your payments and your contracts.
7. Cookies and similar technologies
A cookie is a small file stored on your device. Similar technologies include local storage, pixels and device fingerprinting. Under PECR we need your consent before placing anything on your device that is not strictly necessary for the service you asked for.
Strictly necessary. No consent needed.
Framer (our website host)
Delivers and renders the site, load balancing, security
Session
Modem Studios
Remembers your cookie choice so we stop asking
Up to 6 months
Tally (our form provider)
Keeps your form session and stops duplicate and spam submissions
Session, plus short-lived cookies for spam prevention
Analytics. Nothing stored on your device, so no consent needed.
Framer Analytics
Counts page views, unique visitors and traffic sources so we can see what people read. Nothing is stored on your device
No cookie is set
Framer Analytics is cookieless. It does not place a cookie, write to local storage or create a persistent identifier on your device, which we have tested on the live site. Because nothing is stored on or read from your device, the consent rule in the Privacy and Electronic Communications Regulations is not engaged. The counts it produces are aggregated and are not used to identify anyone, and we rely on our legitimate interest in understanding which pages people find useful. Most browsers and privacy extensions can block it, and you can also email us and we will exclude you.
Embedded content
Video on our site is served from our own hosting rather than from a third party player, so watching it does not expose you to another company’s cookies. The enquiry form is embedded from Tally, which sets only the strictly necessary cookies listed above. If we add an embed from a third party such as YouTube or a social platform in future, we will block it until you consent, and we will update this section first.
How to manage cookies
Use the Cookie settings link in our footer to change your choice at any time.
Every major browser lets you block or delete cookies in its settings. Blocking strictly necessary cookies may break parts of the site.
We do not use advertising or retargeting cookies, and we do not sell behavioural data.
8. Who we share your data with
We name the providers that handle your data directly when you use this site, and describe the rest by category. If you want to know the specific provider behind any category below, email us and we will tell you.
Brands, agencies and production partners
When we pitch a creator or run a campaign, we share the creator’s name, channel data, rate, availability and deliverables with the brand or agency, and we share brand contacts’ details with the creator. This is how a creator management business works. Each of those organisations is a separate controller of the data once they hold it, and their own privacy policy applies.
Our service providers, acting on our instructions
Framer B.V.
Hosts this website and provides its built-in analytics
Netherlands and EU, with a global content delivery network
Cloudflare
Delivers a small animation library our site menu uses. Your device requests the file from Cloudflare, which means Cloudflare sees your IP address. Nothing is stored on your device
United States and a global network
Tally
Runs the enquiry and creator application form on our site
Belgium, EU
Google (Google Workspace)
Our email, and storage of the form submissions, creator records and deal records
EU, UK and United States
Apollo.io
Finds and verifies business contact details at brands and agencies, and sequences our outreach
United States
Our accounting and bookkeeping providers, and our accountants
Invoicing, expense records, statutory accounts, VAT and payroll
United Kingdom, EU and United States
Our banks and payment providers
Receiving client payments and paying creators and suppliers
United Kingdom
Our design and presentation software
Building pitch decks and social assets
Australia and United States
The AI and productivity software we use internally
Drafting, analysis and day to day operations
United Kingdom, EU and United States
We have data processing agreements in place with our processors, or are putting them in place, requiring them to act only on our instructions and to keep your data secure.
Others
Professional advisers: lawyers, insurers and auditors, where needed.
Our banks and payment providers, so that we can receive client payments and pay creators and suppliers. They act as controllers in their own right and their own privacy policies apply.
Authorities: HMRC, the police, regulators and courts, where we are legally required to disclose.
A buyer or successor entity: if the business, or the part of it that relates to you, is sold or reorganised, including the transfer of this business from Pence Talent Ltd into the Modem Studios entity. Your data would move with it and this policy would continue to apply until updated.
We do not sell your personal data.
9. Sending data outside the UK
Some of our providers and partners are outside the United Kingdom. The ICO expects us to name the countries rather than say “outside the UK”, so here they are.
Countries your data may reach
European Economic Area, mainly the Netherlands, Belgium and Ireland, through Framer, Tally and Google. The UK Government has made adequacy regulations covering the EEA, so no extra safeguard is needed.
United States, through Google, Apollo.io, Cloudflare, and our accounting, design and internal software providers. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses where it is not.
Australia, through our design and presentation software provider, under the International Data Transfer Agreement or UK Addendum.
Anywhere a brand partner is based. We work with brands and agencies in the United States and elsewhere. Where we send creator data to a brand outside the UK, we put the appropriate transfer mechanism in the contract for that campaign.
In each case we carry out a transfer risk assessment and apply additional measures such as encryption in transit and at rest where appropriate.
You can ask us for a copy of the safeguards we rely on for a specific transfer by emailing contact@modem-studios.com.
10. How long we keep your data
“As long as necessary” on its own is not good enough for the ICO. These are the periods we work to.
Website analytics
Up to 14 months from collection, in aggregated form only
Enough to compare year on year
Cookie consent record
6 months, then we ask again
PECR good practice
Enquiry that goes nowhere
12 months from the last contact
Gives us a sensible window to follow up, then we delete
Creator we assessed but did not sign
24 months from the last contact, unless you ask us to delete sooner
Creator careers move, and a no today is often a yes in 18 months
Creator management records, contracts, campaign files
7 years from the end of the relationship
Contract claims under the Limitation Act 1980 run for 6 years, plus a year of headroom
Invoices, payments, VAT and accounting records
7 years from the end of the financial year they relate to
HMRC requires 6 years for VAT and company records, we round up
Business contact details for outreach
24 months from the last meaningful engagement, then reviewed or deleted
Keeps the list current and relevant
Marketing consent and the mailing list
Until you unsubscribe, then we move you to suppression
Your choice drives it
Suppression list
Indefinitely
The only reliable way to not contact you again
Unsuccessful job applications
12 months from the decision, unless you agree to us keeping it longer
Enough time to consider you for the next opening
Creator content and campaign assets
For the usage period agreed in the relevant contract, plus our own archive copy for 7 years
Proving what was licensed and when
Email correspondence
7 years
It sits inside the contract and accounting record
When a retention period ends we delete the data or anonymise it so it can no longer identify you. Where data sits in backups it may persist a little longer, but it is isolated and then overwritten on the normal backup cycle.
11. How we keep your data safe
We take appropriate technical and organisational measures to protect personal data, as required by Article 32 of the UK GDPR.
All data in transit to and from our site and systems is encrypted using TLS. Data held by our providers is encrypted at rest.
Access to creator files, contracts and payment details is limited to the people who need it, and is protected by multi-factor authentication.
We use a password manager and do not share credentials.
Laptops and phones used for work are passcode protected and encrypted.
We review who has access to what, and remove access when someone stops working with us.
We choose providers who can show credible security practice, and we hold data processing agreements with them.
No system is perfect. If a personal data breach happens and it is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and we will tell you directly without undue delay where the risk to you is high.
12. Your rights
Under the UK GDPR you have the following rights. They are not all absolute, and some only apply in certain situations. We will tell you if an exemption applies and why.
Be informed. Know what we do with your data. That is what this policy is for.
Access. Get a copy of the personal data we hold about you, and information about how we use it. This is a subject access request.
Rectification. Have inaccurate data corrected and incomplete data completed.
Erasure. Have your data deleted, where there is no good reason for us to keep it. We can refuse where we need it for a contract, for legal obligations such as tax records, or to defend a legal claim.
Restrict processing. Ask us to pause using your data, for example while we check whether it is accurate.
Data portability. Get the data you gave us, in a structured, commonly used, machine readable format, where we process it by automated means on the basis of consent or a contract.
Object. Object to processing based on legitimate interests. For direct marketing this right is absolute, and we will stop immediately.
Withdraw consent. Where we rely on consent, you can withdraw it at any time. That does not make what we did before unlawful.
Rights relating to automated decision making. See section 14.
How to exercise a right
Email contact@modem-studios.com and tell us which right you want to use. You do not need to use a particular form of words.
We respond within one calendar month. If your request is complex or you have made several, we can extend by up to two further months, and we will tell you within the first month if we do.
There is no fee. We can charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive.
We may ask you for proof of identity before releasing data. We will only ask for what we need.
If your request involves data about someone else as well as you, for example an email thread, we may need to redact parts of it.
13. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at contact@modem-studios.com. We would rather fix it than have you go elsewhere.
You also have the right to complain to the UK’s data protection regulator at any time.
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
Complaining to the ICO does not affect any other legal remedy you have, including the right to claim compensation through the courts.
14. Automated decisions, children, and changes
Automated decision making and profiling
We do not make decisions that produce legal or similarly significant effects about you using automated processing alone. A person always makes the call on representation, casting and commercial terms.
We do use software, including AI tools, to help us sort and summarise information, score how well a creator might fit a brief, and draft outreach. These are inputs to a human decision, not the decision itself. If you want to know how a particular shortlist was put together, ask us.
Children
Our website and services are aimed at adults and at businesses. We do not knowingly collect personal data from anyone under 18 through this website.
We do not currently represent any creators under 18. If we ever do, we will deal with a parent or guardian, get their consent in writing, and handle the young person’s data with extra care, including limiting who can see it and refusing brand requests that are not appropriate.
If you believe a child has given us personal data through our site, email contact@modem-studios.com and we will delete it.
Changes to this policy
We review this policy at least once a year and whenever we change how we handle personal data, for example when we take on a new provider.
The date at the top of this page shows when it was last updated. Where a change materially affects you, we will tell you directly rather than relying on you spotting it here. We keep previous versions and can send you one on request.