Last updated: 30 September 2026
This policy explains what personal information I collect when you visit my website, get in touch, work with me or appear in a film I make, and what I do with it. I have tried to keep it short and in plain English. If anything is unclear, just email me.
I am Manuel Pennuto, a sole trader trading as Strength in Motion Films, a video production business based in Edinburgh, Scotland. I am the data controller for the personal information described here, which means I decide how it is used and I am responsible for looking after it. I am registered with the Information Commissioner’s Office (ICO) as a data controller.
You can contact me about anything in this policy at [email protected].
My enquiry form asks for your name, email address, phone number, business name and a message. If you download a brochure or guide from the site, I ask for your name and email address so I can send it. When you send it, the details are stored in my website’s database, emailed to me and copied to a Google Sheet I use to keep track of enquiries. I also record the enquiry in my customer relationship management (CRM) system, Twenty, which I host myself.
I use this information to reply to you, talk through your project and prepare a quote. The legal basis is my legitimate interest in responding to people who contact me, and taking steps you have asked for before we enter into a contract.
The form is protected by Google reCAPTCHA v3, which checks that a real person is using it. To do that, Google receives information such as your IP address and how you interact with the page. This is in my legitimate interest in keeping spam and abuse off the site.
If we work together, I keep the contact details of the people I deal with, project details, emails, invoices and payment records. I need this to deliver the work (contract) and to meet my tax and accounting obligations (legal obligation).
Each client gets a private, password-protected project page on my website. On that page:
If you choose to pay online, the payment is taken through WooCommerce using Stripe (card payments) or GoCardless (bank payments). Your card or bank details are handled by Stripe or GoCardless and are never stored by me. I receive confirmation of the payment and the details needed for my records.
I share project files through Google Drive folders. For video review, I use a platform I host myself at review.strengthinmotion.co.uk (FreeFrame), with the files stored on Backblaze B2 in its EU region. If you leave comments there, you give a name and email address so your comments can be identified. I use this to collect and act on feedback (contract, or my legitimate interest where you are not the client yourself, for example a colleague of the client).
If you appear on camera, your image and voice are personal data. I use release forms to record permission from people who are filmed. Footage is used to make the film the client has commissioned, and in some cases in my portfolio, as set out in clause 18 of my Terms and Conditions.
If you would like to ask about footage you appear in, email me and I will help.
My business email is hosted with SiteGround. I may also use Google services such as Gmail and Google Calendar to arrange calls, in which case your name and email address will appear in a calendar invitation.
To keep on top of projects, I may use a Telegram bot on my own phone that sends me short notifications. These contain client names and a brief project status only.
I sometimes send a personal follow-up email to people who have enquired or clients I have worked with before, for example to check in about a future project. I do this on the basis of my legitimate interest in running my business, and it is aimed at business contacts. If you would rather not hear from me, reply and say so and I will stop. I do not send a newsletter and I never sell your data.
My website uses cookies and similar technologies. When you first visit, a cookie banner (run by the Complianz plugin) asks for your choices. Essential cookies that make the site work are always on. Statistics and marketing cookies are set according to the choices you make in the banner, and you can change your mind at any time.
With your consent, I use:
Some pages load fonts from Google Fonts. When they do, your browser connects to Google’s servers, which means Google receives your IP address.
Videos on the site are shown with a video player plugin called Presto Player. Some videos are hosted on YouTube or Vimeo. When one of those plays, your browser connects to YouTube (Google) or Vimeo, which may set their own cookies and receive your IP address, under their own privacy terms. The site also has a chat button (Chaty) that links to messaging apps. If you use it, you leave my website and the conversation takes place in that app, under its own privacy terms.
My website runs on WordPress and is hosted by SiteGround. A few tools behind the scenes handle personal information as part of keeping the site working and secure:
I rely on my legitimate interest in running a secure, reliable website for these.
I only share personal information where it is needed for the purposes above. The people and companies involved are:
Twenty, my CRM, and FreeFrame, my review platform, are hosted by me, so the information in them stays under my control. I may also share information where the law requires it, for example with HMRC, or with professional advisers such as an accountant.
Some of the providers I use, including Google, Meta, Vimeo, Stripe and Telegram, may process personal information outside the UK. Where that happens, they rely on appropriate safeguards recognised under UK data protection law, such as adequacy regulations or approved contract clauses.
After these periods, I delete the information or make sure it can no longer identify you.
I take sensible steps to protect personal information, including password-protected client pages, secure hosting and regular backups. No system is perfectly secure, but I work to keep the risks low and deal quickly with any problem.
My services are for businesses and adults. I only film anyone under 18 with the consent of a parent or guardian, arranged through the client.
Under UK data protection law (the UK GDPR), you have the right to:
Some of these rights depend on the reason I hold the information. For example, I may need to keep invoices for tax purposes even if you ask me to delete them.
To use any of your rights, email me at [email protected]. I may need to confirm your identity before I act. I will reply within one month, and there is usually no charge.
If you are unhappy with how I have handled your information, please tell me first and I will do my best to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.
I will update this policy when the way I handle personal information changes. The date at the top shows when it was last updated.
