Privacy Policy

100 Platform Ltd ("100", "we", "us") is the data controller for personal data processed in connection with your account and your use of the Platform, and generally acts as a data processor on your behalf for personal data contained within your User Content (e.g. faces or names appearing in your photographs) that you deliver to your own clients. Where these roles differ, we explain this below.

• Registered office: [REGISTERED ADDRESS], England
• Company number: [COMPANY NUMBER]
• UK ICO registration number: [ICO REGISTRATION NUMBER]
• EU representative (Art. 27 GDPR, if applicable): [EU REP NAME/ADDRESS]
• Data Protection contact: [DPO/PRIVACY EMAIL]

This Policy explains how we collect, use, share, and protect personal data when you (a) visit 100platform.uk, (b) create and use a photographer account, (c) as a client, access a gallery or portal shared with you by a photographer, or (d) are an identifiable individual who appears in, or is named in the metadata of, a photograph uploaded to the Platform.

3.1 Account and billing data (you, the photographer/client)

• Identity and contact data: name, email, phone, postal address, business/agency name.
• Account credentials and security data: password hash, two-factor authentication data, login history, IP address, device and browser information.
• Payment data: processed by our payment processor(s) (e.g. Stripe); we receive limited data such as payment status, last 4 digits, and billing address — we do not store full card numbers.
• Communications: support tickets, emails, and other correspondence with us.

3.2 Content and metadata

• Photographs, video, and associated IPTC/XMP/EXIF metadata you upload, including embedded GPS location, capture device, timestamp, and caption/keyword data.
• Automatically generated captions, tags, and public-figure/location flags produced by our auto-captioning tool (see Section 3.3).
• Data about individuals depicted or named within your content, where that content includes personal data of identifiable people (subjects of your photography). For this category, you are generally the controller and 100 acts as your processor — see Section 9.

3.3 Automated recognition ("prominent public figures or locations"). This feature reads image content to flag apparent public figures and locations for captioning purposes. If this analysis involves creating or comparing a unique facial template/faceprint, it constitutes biometric data for the purpose of unique identification and is "special category data" under UK/EU GDPR Article 9 — this requires a specific lawful basis such as explicit consent or the substantial-public-interest/journalism condition (UK DPA 2018 Sch. 1; GDPR Art. 9(2)(g)), on top of an ordinary Article 6 basis, plus a DPIA. If the feature instead only matches against public, non-biometric metadata (e.g. name recognition, EXIF/caption text, reverse-image lookup against public sources) rather than creating a faceprint, it likely does not trigger Article 9, but this technical distinction must be confirmed with your engineering team and documented before this section is finalised.

3.4 Usage and device data

• Log data, IP address, browser/device type, pages viewed, upload/download activity, and approximate location derived from IP.
• Cookies and similar technologies (see Section 11).

3.5 Data about individuals depicted in User Content (data subjects who are not our direct users). Where a photograph contains identifiable individuals (e.g. a person photographed at a public event), that person's image is personal data. As between you and 100, you are the controller of that decision (what/who to photograph and how to license it) and 100 processes it as your processor to provide storage and delivery infrastructure. You are responsible for ensuring you have a lawful basis for capturing and distributing such images (for editorial/journalistic photography, this is typically the journalistic purposes exemption, but this varies by jurisdiction and context — e.g. images of minors, or images taken in a context with a reasonable expectation of privacy, require particular care).

• To provide the Service — create your account, store and deliver your content, operate client portals, process payments (performance of a contract, Art. 6(1)(b)).
• To operate auto-captioning and metadata tools you activate (performance of a contract, and where applicable, explicit consent or the journalism condition for any special category processing under Art. 9 — see 3.3).
• To maintain security, prevent fraud, and enforce our Acceptable Use Policy, including screening for prohibited content such as CSAM (legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f)).
• To communicate with you about the Service, including essential service notices (legitimate interests / performance of a contract).
• For marketing communications, only with your consent where required, and always with an opt-out (consent, Art. 6(1)(a), or soft opt-in for existing customers under PECR/UK GDPR).
• To comply with legal obligations, respond to lawful requests from authorities, and establish, exercise, or defend legal claims (legal obligation and legitimate interests).
• To improve the Platform through aggregated or anonymised analytics (legitimate interests).

• Sub-processors: cloud storage and CDN providers, email delivery providers, customer support tooling, and payment processors, each bound by data processing agreements.
• Your clients: when you configure a client portal or gallery, the content and associated metadata you choose to share becomes visible to that client as you direct — this sharing is controlled by you, not us.
• Professional advisers, regulators, and law enforcement, where required by law, to protect our rights, or to report suspected illegal content (including mandatory CSAM reporting).
• A successor entity in the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections.

We do not sell personal data. We do not share personal data with third parties for their own independent marketing purposes.

We are based in the UK and store data primarily in [DATA CENTRE REGION(S), e.g. UK/EU]. Where we or our sub-processors transfer personal data outside the UK or EEA (for example, to the United States), we rely on an applicable adequacy decision, or on appropriate safeguards such as the UK International Data Transfer Addendum / EU Standard Contractual Clauses, together with supplementary technical and organisational measures. You may request details of the specific safeguard used by contacting [PRIVACY EMAIL].

• Account data: retained for the life of your account and for [6 years] afterwards for legal, accounting, and dispute-resolution purposes.
• User Content (photographs/metadata): retained until you delete it or close your account, subject to a limited backup-purge window of up to [30] days and any legal hold.
• Payment records: retained as required by UK tax law (currently 6 years from the end of the relevant accounting period).
• Security/abuse logs, including any content preserved in connection with a CSAM or illegal-content report: retained as required by law and for as long as necessary to support law enforcement action.

8.1 UK / EEA individuals. If UK GDPR or EU GDPR applies to you, you have the right to: access your personal data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; object to processing based on legitimate interests or for direct marketing; data portability; withdraw consent at any time where processing is consent-based; and avoid decisions based solely on automated processing that produce legal or similarly significant effects (note: our auto-captioning is an assistive draft tool reviewed by the photographer before delivery, and is not used to make such decisions about you). To exercise these rights, contact [PRIVACY EMAIL]. If unsatisfied with our response, UK individuals may complain to the Information Commissioner’s Office (ico.org.uk); EEA individuals may complain to their local supervisory authority.

8.2 California residents (CCPA/CPRA). California residents have the right to know what personal information we collect, use, and disclose; to request deletion; to correct inaccurate information; to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as defined by the CCPA); to limit use of sensitive personal information; and to non-discrimination for exercising these rights. Submit requests via [PRIVACY EMAIL]; we will verify your identity before fulfilling a request.

8.3 Other jurisdictions. 100 is used globally by press photographers and their clients. Where the law of your country of residence grants you data protection rights not otherwise described here — for example under Canada's PIPEDA, Australia's Privacy Act 1988, Brazil's LGPD, South Africa's POPIA, or other comparable regimes — we will honour requests consistent with those rights on a reasonable-efforts basis; contact [PRIVACY EMAIL] and specify your jurisdiction and the right you wish to exercise.

8.4 Rights of individuals depicted in User Content. If you are an individual who appears in a photograph hosted on the Platform and wish to exercise a data protection right (e.g. object to processing, or request erasure), please contact the photographer or agency who captured and controls the image in the first instance, as they are generally the controller of that decision. If you are unable to identify or reach them, contact [PRIVACY EMAIL] and we will assist as the processor's obligations under applicable law require.

For account, billing, and platform-usage data, 100 is the data controller. For personal data embedded within your User Content (e.g. individuals depicted in your photographs, or personal data within captions/metadata you write), 100 acts as your data processor: we process that data only on your documented instructions (as configured through the Platform), under the terms of the Data Processing Addendum incorporated into these Terms by reference. You act as the controller for that content and are responsible for ensuring you have a lawful basis to capture, caption, and distribute it.

We use appropriate technical and organisational measures, including encryption in transit, access controls, and regular security review, to protect personal data. No system is completely secure, and we cannot guarantee absolute security of information transmitted to the Platform. Report suspected security incidents to [SECURITY EMAIL].

We use strictly necessary cookies to operate the Platform (e.g. session/login), and, where you consent via our cookie banner, analytics and functionality cookies. You can manage cookie preferences through our cookie banner or your browser settings. See our separate Cookie Notice at [COOKIE POLICY URL] for the full list of cookies, providers, and durations.

The Platform is not directed at children and we do not knowingly collect account data from anyone under 18. If you believe a child has provided us with personal data, contact [PRIVACY EMAIL] so we can delete it. This does not restrict lawful editorial photography that may depict minors as newsworthy subjects, captured and controlled by a professional photographer in accordance with applicable law and editorial guidelines.

We do not use your personal data to make decisions with legal or similarly significant effects on you based solely on automated processing without human involvement. Auto-captioning suggestions are always reviewed and approved by the photographer before delivery.

We may update this Policy from time to time. Material changes will be notified via the Platform or by email at least [14] days before taking effect.

Data protection queries: [PRIVACY EMAIL]. UK ICO: ico.org.uk. General support: [SUPPORT EMAIL].