Information Sharing & Disclosure

Our Commitment

At StarWave Entertainment, we believe that trust is the foundation of every relationship — whether with our audiences, partners, talent, or employees. This Information Sharing & Disclosure policy reflects our unwavering commitment to handling all information with integrity, transparency, and the highest level of care.

Policy Objectives

• Ensure transparent communication about how information is shared and disclosed
• Maintain compliance with global data protection regulations including GDPR, CCPA, and emerging frameworks
• Establish clear protocols for third-party information sharing and vendor management
• Protect sensitive production, financial, and personal data throughout its lifecycle
• Provide stakeholders with clear understanding of their rights and available recourse
• Implement robust security measures to prevent unauthorized disclosure

Guiding Philosophy

Our approach to information sharing is guided by three core principles: Transparency First — we believe stakeholders deserve to know how their information is used; Minimal Necessary — we only share what is essential for each specific purpose; and Accountability Always — every information decision is documented and answerable.

Covered Entities

This policy governs information practices across all StarWave Entertainment entities and operational areas:

• StarWave Productions — Film, television, and streaming content production
• StarWave Live — Concerts, award ceremonies, and live event management
• StarWave Studios — VFX, animation, and post-production services
• StarWave Interactive — Gaming, VR experiences, and digital content
• StarWave Talent — Artist management and representation services
• StarWave Distribution — Content licensing and worldwide distribution
• StarWave Music — Music production, publishing, and recording

Applicable Parties

This policy governs information handling for the following groups:

• Employees & Contractors — All personnel working for or on behalf of StarWave
• Talent & Artists — Actors, musicians, directors, writers, and creative professionals
• Audience Members — Customers, subscribers, event attendees, and platform users
• Business Partners — Co-production partners, distributors, and licensees
• Suppliers & Vendors — Technology providers, facility operators, and service providers

Information Types Covered

This policy addresses the handling of multiple categories of information:

• Personal Data — Names, contact details, identification documents, payment information
• Production Data — Scripts, storyboards, unreleased content, production schedules
• Financial Data — Revenue reports, budget details, investment information, royalty structures
• Business Data — Strategic plans, partnership terms, audience analytics, market research
• Technical Data — Source code, proprietary software, security credentials, infrastructure details

Reclassification Process

Information classification may be changed as project phases evolve. For example, a Level 4 (Restricted) script may become Level 1 (Public) after theatrical release. Reclassification requires:

• Written request from the information owner or project lead
• Review and approval by the department head
• Documentation of the reclassification decision and rationale
• Notification to all parties previously granted access

Core Principles

• Principle of Minimal Necessary Disclosure: We share only the minimum amount of information necessary to accomplish a specific, legitimate business purpose. No more, no less.
• Principle of Informed Consent: Whenever personal data is shared, the individual must be informed of what data is being shared, with whom, for what purpose, and must provide explicit consent where required by law.
• Principle of Purpose Limitation: Information shared for one purpose cannot be repurposed or shared for a different purpose without obtaining new, specific consent from the data subject.
• Principle of Data Minimization: We collect and share only data that is directly relevant and necessary. We do not engage in excessive data collection or sharing practices.
• Principle of Accuracy & Currency: We maintain accurate, up-to-date information and correct errors promptly. Sharing inaccurate or outdated information is strictly prohibited.
• Principle of Accountability & Audit: Every information sharing event is logged, documented, and subject to regular audit. We maintain a complete chain of custody for all shared data.

Contextual Sharing Guidelines

Different contexts require different sharing approaches:

• Production Collaboration: Scripts and production materials are shared on a strict need-to-know basis with NDAs required for all external collaborators
• Marketing & Promotion: Content previews and promotional materials are shared only through approved channels and according to approved release schedules
• Talent Management: Artist and performer data is shared only with relevant production teams and always with the talent's awareness and consent
• Business Development: Financial and strategic information shared with potential partners requires board-level approval and formal NDAs
• Audience Engagement: Viewer data is shared with analytics providers only in aggregated, anonymized form unless specific consent for individual-level data is obtained

Standard Disclosure Workflow

Emergency Disclosure

In cases requiring immediate disclosure (e.g., legal mandates, safety concerns, regulatory inquiries), an accelerated process is available:

• Immediate Notification: Contact the Compliance Hotline at +1 (555) 123-HELP immediately
• Verbal Authorization: In urgent situations, verbal authorization from a designated executive is acceptable, to be followed by written confirmation within 24 hours
• Minimal Compliance: Even in emergencies, only the minimum necessary information should be disclosed to fulfill the urgent need
• Retroactive Documentation: All emergency disclosures must be fully documented within 48 hours

Vendor Onboarding Requirements

All third-party vendors and partners must meet the following requirements before receiving any StarWave information:

• Data Protection Agreement (DPA): A comprehensive DPA must be executed before any data sharing begins, outlining specific obligations, security requirements, and breach notification procedures
• Security Assessment: Vendors must pass a security assessment evaluating their data protection practices, security certifications (SOC 2, ISO 27001), and incident response capabilities
• Subprocessor Registry: Vendors must maintain an up-to-date registry of any subprocessors and obtain prior authorization before engaging new subprocessors
• Audit Rights: All third-party agreements include audit rights allowing StarWave to verify ongoing compliance with data protection obligations
• Return/Destruction Certification: Upon contract completion, vendors must certify the secure return or destruction of all StarWave information

Categories of Third-Party Sharing

Ongoing Third-Party Management

• Quarterly vendor compliance reviews
• Annual security reassessment of critical vendors
• Real-time monitoring of vendor security posture where available
• Immediate notification and remediation requirements for vendor security incidents

Primary Regulatory Frameworks

• GDPR (General Data Protection Regulation): Governing personal data processing for EU residents, including rights to access, rectification, erasure, portability, and objection
• CCPA/CPRA (California Consumer Privacy Act): Providing California residents with rights regarding their personal information, including opt-out of sale/sharing
• DMA (Digital Markets Act): EU regulations on digital competition and data access for larger platforms
• SOC 2 / ISO 27001: Industry-standard security certifications that StarWave maintains for its data processing infrastructure
• COPPA (Children's Online Privacy Protection Act): Special protections for personal information collected from children under 13
• Copyright & IP Laws: Protection of creative works and intellectual property under national and international copyright frameworks

Disclosure Under Legal Compulsion

When required by law to disclose information (subpoena, court order, regulatory inquiry), StarWave follows this process:

• Legal Review: All legal requests are reviewed by our legal team to verify validity and scope
• Narrowing: We actively work to limit disclosure to the minimum information legally required
• Notice to Affected Parties: Where legally permitted, we notify affected individuals of mandatory disclosures
• Documentation: All compelled disclosures are fully documented and logged

Technical Security Controls

• Encryption: AES-256 encryption for data at rest; TLS 1.3+ for data in transit; end-to-end encryption for sensitive communications
• Access Controls: Role-based access control (RBAC) with principle of least privilege; multi-factor authentication (MFA) required for all systems
• Network Security: Advanced firewall rules, intrusion detection/prevention systems, network segmentation, and regular penetration testing
• Endpoint Protection: Enterprise-grade endpoint detection and response (EDR), device encryption, and mobile device management (MDM)
• Monitoring & Logging: 24/7 security operations center (SOC) monitoring, comprehensive audit logging, and real-time threat detection
• Secure Development: Secure SDLC practices including code review, static/dynamic analysis, and vulnerability scanning for all software

Physical Security

• Biometric access controls for server rooms and production facilities
• 24/7 security surveillance with 90-day video retention
• Secure document storage with controlled access
• Clean desk and clear screen policies in all workspaces
• Secure destruction of physical media and documents

Incident Response

In the event of a security incident or unauthorized disclosure:

• Detection & Containment: Immediate identification and isolation of affected systems
• Assessment: Determination of scope, impact, and affected data
• Notification: Internal notification within 1 hour; regulatory notification within legally mandated timeframes; affected individual notification as required
• Remediation: Eradication of threats, system restoration, and enhanced security measures
• Post-Incident Review: Root cause analysis and implementation of preventive measures

Secure Deletion Standards

• Digital Data: Multiple-pass overwriting meeting or exceeding NIST 800-88 guidelines; cryptographic erasure for encrypted data
• Physical Media: Industrial shredding or degaussing by certified destruction services
• Cloud Data: Verified deletion through provider APIs with certification of data removal
• Documentation: All deletion activities are logged with date, method, data type, and authorizing individual

Universal Rights

Regardless of location, all individuals interacting with StarWave Entertainment have the right to:

• Transparency: Know what information we collect, how it's used, and with whom it's shared
• Accuracy: Request correction of inaccurate or incomplete personal information
• Security: Expect your information to be protected by industry-standard security measures
• Complaint Resolution: Lodge a complaint about our data practices and receive a timely, substantive response
• Supervisory Authority: Contact applicable data protection authorities regarding any concerns

Additional Rights by Region

• EU/UK (GDPR): Right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection to automated decision-making
• California (CCPA/CPRA): Right to know, delete, correct, opt-out of sale/sharing, limit use of sensitive personal information, and non-discrimination
• Canada (PIPEDA): Right to access, request correction, and challenge handling of personal information
• Brazil (LGPD): Right to confirmation, access, correction, anonymization, deletion, portability, and revocation of consent

How to Exercise Your Rights

Submit a data request through any of these channels:

• Online Portal: Use our Self-Service Data Request Portal at privacy.starwave.com/requests
• Email: Send requests to privacy@starwave.com
• Mail: StarWave Entertainment, Privacy Office, 1234 Sunset Blvd, Hollywood, CA 90028
• Phone: +1 (555) 123-4567 (ask for the Privacy Team)

We respond to all legitimate requests within 30 days of verification. Complex requests may require up to 60 days with notification of the extension and reason.