Privacy & Cookies

Who we are

NaF+ Productions (“NaF+”, “we”, “us”) is the controller for personal data collected through this website.

Our main establishment is at Metal Box Factory, 30 Great Guildford Street, London, SE1 0HS, United Kingdom. We also have an establishment in the European Union at Kifisias 44, Marousi, 15125, Athens, Greece, and offices in Dubai and Riyadh.

For anything on this page, including to exercise any of the rights described below, write to info@naf.plus.

What we collect, and why

When you use the contact form

We collect your name, your email address, a subject if you give one, and your message. We use them to answer you and, where the enquiry goes further, to plan the work you are asking about.

Lawful basis: our legitimate interest in responding to enquiries about our work; and, where your enquiry moves towards a booking, taking steps at your request before entering into a contract.

When you sign up to the newsletter

We collect your email address, and nothing else, to send you the newsletter.

Lawful basis: your consent. Every newsletter carries an unsubscribe link, and withdrawing is as easy as giving it was.

Campaign attribution, on both forms

If you reached us from an advertisement or a campaign link, up to six values carried in that link — the campaign source, medium and name, a Google Ads click identifier, a keyword and a campaign id — are stored in your browser and submitted with the form. They tell us which campaign produced an enquiry, which is the only way we can tell whether advertising is worth its cost.

Lawful basis: your consent. These values are read and stored only if you have accepted statistics cookies. If you have not, the fields are submitted empty, and nothing is written to your browser.

Spam protection

Our forms are protected by Google reCAPTCHA v3. The script loads the first time you place the cursor inside a form field — not when the page loads — so if you never use a form, it never runs. When it does run, Google receives your IP address and information about how you interacted with the page in order to score how likely you are to be an automated submission. That processing is governed by Google’s ownprivacy policy and terms of service.

Lawful basis: our legitimate interest in keeping automated submissions out of our inbox.

Analytics and advertising

Where you accept them, we use cookies and similar technologies to understand how the site is used and to measure our advertising. Statistics cookies cover Google Analytics 4 and Microsoft Clarity, which records how visitors move through pages. Marketing cookies cover Google Ads, the Meta pixel and LinkedIn, which let us measure whether an advertisement led to an enquiry and to reach comparable audiences.

Lawful basis: your consent, given separately for statistics and for marketing. Decline either and the corresponding tags are not granted storage; decline marketing and the Meta pixel is never loaded at all.

Hosting and delivery

This site is hosted by Vercel, which processes technical request data including IP addresses in order to serve pages and protect the service. Form submissions are delivered by Formspree, which processes what you send in order to pass it to us by email. Both act as our processors, on our instructions.

Cookies

Nothing beyond what is strictly necessary is set until you choose. Your choice is recorded by Cookiebot, and you can change or withdraw it at any time.

Change your cookie choices

The list below is generated from an automated scan of this site rather than maintained by hand, so it stays accurate as the site changes. It names every cookie, its purpose, its provider and how long it lasts.

Who we share it with

We do not sell personal data. We share it with the processors named above — Vercel, Formspree, Google, Cookiebot — and, where you accept marketing cookies, with Meta and LinkedIn. An enquiry about work in a particular territory may also be handled by our office there.

Some of those providers process data outside the United Kingdom and the European Economic Area, principally in the United States. Where they do, the transfer relies on the safeguards required by Article 46 of the UK and EU GDPR — standard contractual clauses, or an applicable adequacy decision where the provider is certified under one.

How long we keep it

• Enquiries: for as long as we need them to answer you and to run any project that follows, and afterwards in our business records for as long as a commercial or legal claim could still arise from it.
• Newsletter: until you unsubscribe.
• Cookies: for the individual lifetimes shown in the declaration above, which is the accurate source for this.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, where we have no overriding reason to keep it;
• restrict or object to how we use it, including objecting to our legitimate interests;
• receive data you gave us in a portable form; and
• withdraw consent at any time, where we rely on it — which does not affect what was done before you withdrew it.

Write to info@naf.plus and we will answer within one month.

If you are not satisfied with our answer, you can complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Greece, the Hellenic Data Protection Authority (dpa.gr). You may also complain to the authority where you live or work.

Changes to this notice

If we change how we use personal data, we change this page and the date at the top of it.