Privacy policy

Short Overview

The e-shop RippleWorld Merchandise on the website www.rippleworld.com company ID 9654540L based in Ireland processes personal data provided by Customer to fulfil and additionally confirm Terms and Conditions, to process electronic orders and shipments and for the necessary communication during a period required by law.

General provisions

1. Personal data controller, in compliance with GDPR (hereinafter referred to as "Regulation“) is Ripple World Pictures Ltd, company ID 437164, based in M11 Business Campus, Innovation House, Gorey, Wexford (hereinafter referred to as "Controller“);

2. The contact details of the Controller are: e-mail: hello @rippleworld.com ;

3. Personal data is any information that relates to an identified or identifiable natural person.

The source of personal data

1. Controller processes personal data obtained with consent from Customer and collected through the contract to purchase and fulfilment of the electronic order created in the e-shop.;

2. Controller processes only the identifying and contact details of Customer which are necessary for the fulfillment of the contract to purchase;

3. Controller processes personal data for the shipping and accounting purposes and for the necessary communication between the contracting parties for the duration required by law. Personal data will not be made public and will not be transferred to other countries.

Purpose of data processing

Controller processes personal data of the Customer for following purposes:

1. Registration on the website www.rippleworld.com in compliance with Chapter 4, Section 2 of GDPR;

2. For fulfillment of the electronic order created by Customer (name, address, e-mail, telephone number);

3. To observe law and regulations arising from the the contractual relationship between Customer and Controller;

4. Personal data are necessary for the fulfillment of contract to purchase. Contract cannot be concluded without the personal data.

Duration of personal data storage

1. Controller stores personal data for the period necessary for fulfillment of rights and obligations arising from the contractual relationship between Controller and Customer and for the duration of 3 years following the conclusion of contractual relationship;

2. Controller must delete all personal data after the expiration of the period required for the storage of personal data.

Recipients and processors of personal data

Third parties processing personal data of the Customer are subcontractors of the Controller. Services of these subcontractors are indispensable for the successful fulfillment of the contract to purchase and processing of the electronic order between Controller and Customer.

Subcontractors of the Controller are:

Webnode AG (e-shop system);
Shipping company;
Google Analytics (website analytics);

Rights of Customer

In compliance with the Regulation, Customer is entitled to:

1. The right of access to personal data;

2. The right to rectification of personal data;

3. The right to erasure of personal data;

4. The right to object to processing of personal data;

5. The right to data portability;

6. The right to withdraw consent to the processing of personal data in writing or by e-mail sent to hello @rippleworld.com;

7. The right to lodge a complaint with the supervisory authority in case of suspected breach of the Regulation.

Security of personal data

1. Controller declares to take all technical and organizational precautions necessary for the protection of personal data;

2. Controller has taken technical precautions to secure data storage spaces, in particular securing access to computer with a password, using antivirus software and performing regular maintenance of computers.

Final provisions

1. By placing an electronic order on the website www.rippleworld.com Customer confirms to be informed about all the conditions of personal data protection and accepts them to the full extent;

2. Customer accepts these rules by ticking the checkbox in the order purchase form;

3. Controller can update these Rules at any time. New, updated version has to be published on his website.

These Rules come into effect on 14 October 2026

RIPPLE WORLD PICTURES LIMITED PRIVACY NOTICE

1. Introduction

2. Who we are and how to contact us

3. What information we use and what we do with it

4. Your duty to inform us of changes

5. Who we share your information with

6. International transfers

7. How long we keep your information

8. Additional information in relation to COVID-19 testing

9. How to access your information and other rights

1. Introduction

Ripple World Pictures Limited is committed to protecting your personal information. Ripple World Pictures Limited is also committed to protecting the safety and wellbeing of individuals who participate in a production developed and produced by us and we wish to take any necessary steps to contain the spread the effects of COVID-19. This privacy notice explains what we do with your personal information when you participate in a production produced by us and what we do with your personal data, including in the context of our COVID-response efforts.

We may make changes to this privacy notice from time to time, so please check our website periodically at

https://rippleworld.com

You can also email us to ask for a copy.

2. Who we are and how to contact us

Ripple World Pictures Limited is the data controller responsible for your information. We are an Irish company (with company number 437164) and registered office address at 5 Clarinda Park North, Dun Laoghaire, Dublin, Ireland, A96W6N1.

If you have any questions about this notice or want to exercise your rights, please email our privacy officer at hello @rippleworld.com . You can also write to us at our office address, marked for the attention of our privacy officer.

3. What information we use and what we do with it

We ask you for, and use, your personal information when you participate in one of our productions. We use that information in a number of different ways, and the tables below set out what we do with your information if requested by us and provided by you.

Most personal data that we process is collected directly from you. In the event that you test positive for COVID-19, the third party occupational health specialists who we have engaged to carry out the testing process will inform us of your identity.

Pre-production, production and post-production of the production Information we use How we use it Why we use it (and the legal basis) Name, address, phone numbers, email address and other contact details.

To contact you about your participation in the production and to make arrangements for the filming of the production.

To decide whether to enter into a contract with you; and, if you're selected to participate in the production, to perform that contract with you.

Next of Kin Records. To be able to contact your next of kin in the event of an emergency.

It's in our legitimate interests to safeguard your welfare.

Date of Birth, PPS number, and Passport For the administration of the payments system and the administration of benefits. (if applicable).

To perform our contract with you.Health or medical information supplied by you on a confidential Health

Declaration Form and the results of a medical examination if required for production insurance purposes.

We may be supplied with a medical report by the doctor in order to assess or determine your state of health and fitness for engagement on the production or a particular role or task or to assess any risk to your health. We may send these medical reports to our insurers for our own benefit against losses arising from your inability to perform the contract.

Your bank account details, details of any unclaimed payments. For the payment and review of fees and other remuneration and benefits.

Casting notes, CVs, footage from run throughs and auditions (if applicable)

We review this information to assess whether to engage you in connection with the production.

Photographs or audio visual recordings of you and your performances or contribution filmed/recorded during the production process and used to make the production and/or any 'behind the scenes' or 'making of' type pieces .

We use these recordings in order to make and exploit the production and/or any 'behind the scenes' or 'making of' type pieces .

In the case of children, your name, date of birth, address, and other contact details, letter from your doctor and letter from your headmaster.

We use this information to apply to your local council for a child licence to enable you to perform in the production. COVID-19 response efforts

Information we use How we use it

Basic information about you such as your name, position/role, contact details, identifying information (e.g., employee ID), time or date of entry/exit on set, and purpose for attending the set

To identify you and contact you in the event of you or someone else testing positive for COVID-19.

Questionnaire information (e.g., COVID-19 symptoms): the questionnaires are the initial Return to Work form completed by you (i.e. the Irish Health & Safety Authority's recommended form) and our daily online form that we ask you to complete.

To encourage you to identify your own COVID- 19 symptoms. If you have such symptoms, you should not attend the set.

Details of who you may have come in contact with over the previous 48- hours or recent travel history (in circumstances where you have or are suspected to have contracted COVID- 19).

To identify or locate others who may need to self-isolate as a precautionary measure.

Exploitation & licensing of the production

Tests: Temperature test. Positive or inconclusive COVID-19 test result information.

This data would be provided to us by the test provider we have appointed for the production.

How we use it

To protect the wider workforce, enable us to

plan if a positive result impacts production, and

for related HR purposes.

Information we use To safeguard your welfare and make sure you're able to perform the services under our contract with you. If any recommendations are made by the company doctor, it also enables us to make any reasonable adjustments.

To effect insurance on you for our own benefit against losses arising from your inability to perform the contract.

We only use this information if you've given your permission (i.e. explicit consent). You don't have to give your permission, and you can withdraw that permission at any time. But

without your permission, you might not be able to participate or continue to participate, in the production.

To perform our contract with you.

To decide whether to enter into a contract with you.

To perform our contract with you.

To perform our contract with you and to meet our legal obligation to obtain a licence for televised child performances.

Why we use it

To facilitate the safety of individuals and to ensure the continuity of production. Certain aspects of the processing may be undertaken to comply with our legal obligations, in the public interest, or to protect the vital interests of individuals.

Why we use itName, contact details and email address.

We may share your contact details with the broadcaster or our commercial partners or licensees so that they can contact you in relation to press launches, photo calls, interviews and other activity relating to the exploitation of the production.

To perform our contract with you.Information about you as embodied in the production and publicity trails and other content related to the production including material for exploitation on YouTube, Facebook, Instagram or other social media sites.

To broadcast, distribute, publicise and otherwise exploit the production (or parts of it) anywhere in the world, for the duration of your lifetime (if not longer), and by any means, including on television, online, in DVDs, video, books and magazines. We'll share this information with the financier(s) and other licensees of the production including social media platforms and on websites and social media channels operated by our commercial partners.

To perform our contract with you. Name and contact details. To keep for reference purposes on our rights database.

We'll share this information with the financier(s)for inclusion on its own rights databases.

To perform our contract with you Some of the above identified personal data will be health-related, and is therefore regarded as "special category" personal data under the GDPR. Where we collect and process "special categories" of your personal data (formerly known as "sensitive personal data"), which means personal data relating to your trade union membership, health, criminal convictions and history, ethnicity, religion, sexuality or political persuasion, we will only process this on the following basis:

where we have your explicit consent;
where it is necessary for carrying out our obligations and exercising our rights in the field of employment, social security or social protection law or collective agreement (including in circumstances
where we must provide for a safe workplace and in line with Irish Government guidelines on COVID-19 protocols for the workplace);

where it is necessary for the assessment of your working capacity;
where it is necessary for reasons of substantial public interest;
where required under a specific legal obligation;
where you have manifestly made this information available to us;
Where it is necessary for the purposes of preventative or occupational medicine (where the personal data is collected by the test provider's doctors and processed under their supervision); or

Where it is necessary for reasons of public interest in the area of public health.

4. Your duty to inform us of changes

We are required to ensure that the personal data we hold about you is accurate and up-to-date. We therefore request that you notify us as soon as possible if your personal data changes during your relationship with us.

5. Who we share your information with

We share your personal information with certain other companies in relation to our productions.

Companies we'll share your information with include, our co-producers, and the production's commissioning financier(s). Your information may also be shared with our insurers, the production's insurers, with accountants, auditors, lawyers and other outside professional advisers, and to companies who provide products and services to us (such as IT systems suppliers, payroll and intermediaries/brokers, as well as legal and regulatory authorities including Commission for Communications Regulation, Revenue Commission, Irish Naturalisation and Immigration Service, or your local council (in the event we need to obtain a child licence to enable you to perform in the production)) and as required by law.

In relation to our COVID-19 response, we will appoint a test provider to carry out antigen testing of your swab samples in order to identify if individuals have contracted COVID-19, under the supervision of the test provider's doctors. You will be informed of the test provider appointed for the production. The test provider arranges for the tests to be processed and analysed by its designated laboratory (the location of which will be notified to you). We may have cause to share your personal data with them from time to time. See also Section 8 below.We may get information requests from the Health Service Executive or similar public health authority in the relevant jurisdiction in which your services are being provided (the "Health Authority") (for example, in the context of contact tracing for COVID-19). This may involve us sharing personal data with the Health Authority , if we are legally required to do so. Note that, under Irish legislation, doctors who learn of a positive COVID-19 test are also obliged to report this to the Health Authority – this will mean that the test provider's doctors will directly report any positive cases of COVID-19 to the HSE.

Where any health data is shared, it will be done only in circumstances where there is an applicable basis. For example, the identity of any individuals affected by COVID-19 will not be disclosed to any third parties or to their colleagues without a clear justification.

In any event, whenever we share your information, we'll make sure that the party we share it with keeps your information as securely as we do.

6. International transfers

Sometimes the companies and suppliers we need to share personal information with are located outside the European Economic Area (EEA). The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.

Where we do this, we'll make sure your personal information receives the same protection as if it were being processed inside the EEA. If you'd like more information about this, please let us know by contacting our privacy officer.

Please note that we may transfer details of a positive COVID-19 test result(s) to recipients outside the EEA. Such personal data will only be shared on a strictly confidential basis and only in very limited circumstances where the positive test result may significantly affect or close down production. Where possible anonymous or aggregated data only will be shared.

Please also note that any footage in which you might appear is likely to be distributed internationally.

7. How long we keep your information

We don't keep your personal information for longer than is necessary, bearing in mind the purpose for which we collected that information, and any applicable legal or regulatory requirements.

We will delete your personal information within 7 years from the end of production of the production, except for (i) copies of your passport which we will delete 2 years from the end of production of the production (ii) if you are entitled to ongoing payments and unclaimed payment records your bank account details will be kept permanently otherwise your bank details and any information we have collected from you in order to apply for a child performance licence will be deleted 6 months from the end of production of the production, and (iii) any contractual documentation with you (such as the contributor agreement) and information in our rights database which we'll keep for the duration of copyright in the production in order to distribute and exploit it.

We intend to retain any personal data relating to COVID-19 only for as long as you may pose a risk to the cast and crew of the production or other individuals. We will delete (i) Questionnaire (which has an affirmative response to any question), 7 days after the date of completion, (ii) Questionnaire (which has negative responses to all questions), 7 days after the date of completion, (iii) any record of a positive test result, at the end of production of the production and once any applicable insurance claims have been completed, (iv) temperature test results, 2 weeks after completion, and (v) any record of high temperature, at the end of production of the production.

8. Additional information in relation to COVID-19 testing

As outlined we will engaged a third party test provider to carry out COVID-19 testing on all those people attending the set of a production. The third party test provider in turn will likely use a third party laboratory to analyse the tests. The third party test provider will have separate data protection obligations towards you and you should carefully review their data protection notice. The third party test provider will share with us the following information:

▪ positive or inconclusive test results; and

▪ on occasion, previous negative test results.

9. How to access your information and other rights

You have a number of rights in relation to the information we hold about you, which are set out below.

• Your right of access

If you ask us, we'll confirm whether we're processing your personal information and, subject to any applicable exemptions, provide you with a copy of that personal information (along with certain other details) within the timescales or extended timescales provided for by the law for complex requests, or where applicable, provide you with an explanation as to why we will not be complying with your request. If you require additional copies, we may need to charge a reasonable fee.

• Your right to rectification

If the personal information we hold about you is inaccurate or incomplete, you're entitled to have it rectified. If you are entitled to rectification and if we've shared your personal information with others, we'll let them know about the rectification where possible and where this would not involve disproportionate effort. If you ask us, where possible and lawful to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly.

• Your right to erasure

You can ask us to delete or remove your personal information in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable because that was the legal basis on which we were processing your personal information). If you are entitled to erasure and if we've shared your personal information with others, we'll take reasonable steps to inform those others where possible and where this would not involve disproportionate effort. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly.

• Your right to restrict processing

You can ask us to 'block' or suppress the processing of your personal information in certain circumstances such as where you contest the accuracy of that personal information or you object to us. If you are entitled to restriction and if we've shared your personal information with others, we'll let them know about the restriction where it is possible

for us to do so. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly.

• Your right to data portability

You have the right, in certain circumstances, to obtain personal information you've provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

• Your right to object

You can ask us to stop processing your personal information, and we will do so, if we are:

o relying on our own or someone else's legitimate interests to process your personal information except if we can demonstrate compelling legal grounds for the processing; or o processing your personal information for direct marketing.

• Your rights in relation to automated decision-making and profiling

You have the right not to be subject to a decision when it's based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

• Your right to withdraw consent

If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time.

• Your right to lodge a complaint with the supervisory authority

If you have a concern about any aspect of our information management practices, including the way we've handled your personal information, you can contact our privacy offer at the contact details outlined above.

These Rules have been modified and come into effect on 14 October 2026