1. About This Privacy Policy

This Privacy Policy explains how Pixelly Ltd (“Pixelly”, “we”, “us” or “our”) collects and uses personal information when people browse Pixelly, create Accounts, communicate through the marketplace, make or receive Bookings, subscribe as a Studio, leave reviews, submit enquiries, reports or complaints, contact support or otherwise interact with us. Pixelly Ltd is the controller where we decide how and why personal information is used. References to “you” or “your” mean any person accessing or using Pixelly.

Studios are independent businesses. When a Studio uses personal information to provide its own Creative Services, it is responsible for complying with applicable data protection law in relation to that use.

Pixelly is intended for users aged 18 years and over. You must be at least 18 years old to create an Account or use Pixelly. Pixelly does not knowingly seek personal information from children for marketplace functions.

If you create a Customer Account, the Customer Terms also apply to you. If you create or operate a Studio Account, the Studio Terms also apply to you. The applicable Account Terms will be made available to you before you are asked to accept them.

Other Pixelly terms and policies may also apply depending on how you use Pixelly. Our Website Terms of Use explain the rules for accessing, browsing and using the Pixelly marketplace, and our Cookie Policy explains how we use cookies and similar technologies.

2. Personal Information We Collect

The personal information Pixelly collects depends on how you use the marketplace. It may include:

• Identity: Name**,** display name, profile photo, business or trading name and, where required for Studio verification, identity and address verification information.

• Contact : Email address, phone number, postal or billing address where required, and shoot location.

• Account: Password in hashed form or other sign-in information, authentication details, Account type, notification preferences and other Account settings.

• Studio and business: Studio profile and listing information, availability, pricing, insurance information, business details and verification status, together with information required for applicable legal or tax-reporting obligations.

• Bookings and transactions: Marketplace enquiries, quotes, Booking details, service requirements and briefs, Booking dates and locations, invoices, refunds, payouts, subscriptions, chargebacks and dispute records.

• Payment metadata: Stripe customer, account, payment or transaction identifiers, payment status, amounts and limited card information supplied by Stripe, such as card brand and last four digits. Pixelly does not receive or store full Customer card details or Studio bank account details.

• Location: Postcode, town and approximate location or geocoordinates used for search, distance ranking and relevant marketplace functions.

• Communications and support: Messages and attachments exchanged through Pixelly, general enquiries, support requests, complaints, reports and evidence provided in connection with disputes or investigations.

• Technical and usage: IP address, device and browser information, log timestamps, referrer information, security events, error or crash reports and information about how Pixelly is used.

• Marketing and preferences: Marketing consent, communication preferences, unsubscribe or suppression records, notification preferences and cookie or similar technology choices.

• User Content: Studio portfolio images and other listing content, Booking briefs, deliverables, reviews, ratings and other content uploaded, submitted or published through Pixelly.

• Safety, fraud and Account integrity: Fraud, abuse or risk indicators, reliability or no-show information, verification concerns, Account restrictions or enforcement records and information reasonably required to investigate misuse, security issues or legal claims.

Pixelly does not ordinarily require special-category personal information, such as information about health, ethnicity, religion or sexual orientation, to use the marketplace. However, this type of information may sometimes be included voluntarily in a Booking brief, message, support request, complaint, evidence or other content.

Where Pixelly processes special-category personal information, we will do so only where necessary and where permitted by applicable data-protection law.

Pixelly may also receive information relating to suspected fraud, threats, abuse, illegal content or other offences. Where this constitutes criminal-offence data, we will process it only where permitted by the UK GDPR and Data Protection Act 2018 and apply appropriate access and retention controls.

2.1 Information You Need to Provide

Some personal information is required to create or manage an Account, arrange or administer a Booking, verify a Studio, process payments or payouts, or meet legal requirements. Where this information is required and is not provided, Pixelly may be unable to provide the relevant feature or service, complete verification or process the relevant transaction.

Other information is optional unless we tell you otherwise when it is collected.

3. How We Collect Personal Information

We collect personal information in the following ways:

• Directly from you when you browse, register, create or update a listing, submit a general enquiry to Pixelly, send a marketplace enquiry to a Studio, make or accept a Booking, send a message, upload a file, leave a review, submit a report or complaint, or otherwise contact Pixelly.

• From another Customer, Studio or other person involved in a marketplace enquiry, Booking, review, report or complaint.

• From Stripe and providers used for payments, payouts, security, fraud prevention or verification.

• From a sign-in provider if you choose to use a third-party sign-in option.

• From postcode, location or similar services where used to support search, location or distance features.

• From public or official sources where reasonably necessary for Studio verification, fraud prevention or legal compliance.

• Automatically from your device through logs and cookies or similar technologies described in the Cookie Policy.

4. How and Why We Use Personal Information

We use personal information only where we have a lawful reason to do so and only for purposes connected with operating, protecting and improving Pixelly, providing our marketplace services and meeting our legal obligations.

Some automated analysis may amount to profiling where information about activity, relevance or reliability is used to rank results or generate trust, fraud or risk indicators.

Pixelly does not currently use AI or other automated processing to make solely automated decisions that have legal or similarly significant effects on individuals. If that changes, we will update this Privacy Policy and provide the information and safeguards required by law.

Where Pixelly relies on legitimate interests, we consider whether the processing is necessary and balance those interests against the rights and reasonable expectations of the people affected.

5. Information We Receive About You From Someone Else

Sometimes Pixelly may receive personal information about you from another Customer, Studio, other person, or a public or official source rather than directly from you. This may happen, for example, where you are named in a marketplace enquiry, Booking, review, complaint or report, or where information is checked for Studio verification, fraud prevention or legal compliance. The sources from which we may receive personal information are described in Section 3 above.

Where required by data-protection law, we will provide you with the relevant privacy information within a reasonable period and no later than one month after receiving your information, or earlier where required by law. Certain legal exceptions may apply.

6. Who We Share Information With and What Is Public

We share personal information only where necessary to operate Pixelly, provide marketplace services, process payments, protect the platform, meet legal obligations or where you ask us to. Depending on how you use Pixelly, we may share information with:

• Customers or Studios involved in a marketplace enquiry or Booking, where the information is reasonably necessary to arrange, administer or provide the Creative Service.

• Stripe and related payment, banking, fraud-prevention or verification providers used to process payments, refunds and Studio payouts.

• Technology and infrastructure providers that support hosting, databases, storage, security, communications, development, verification, analytics and, where enabled, AI-assisted analysis.

• Analytics or advertising providers, where those services are enabled and any required consent or privacy choices have been obtained.

• Professional advisers, insurers and auditors, where reasonably necessary for legal, financial, insurance or business purposes.

• HMRC, regulators, courts, law-enforcement bodies and other public authorities, where disclosure is required or permitted by law.

• A purchaser, investor or successor organisation in connection with a genuine sale, restructuring or other corporate transaction, subject to appropriate safeguards.

• Anyone else you ask or authorise us to share information with.

Pixelly does not sell personal information or provide Studio or marketplace data to other organisations for their own unrelated advertising, marketing or commercial use.

Information That Is Public

Some information is intended to be visible to people browsing Pixelly. This may include Studio profiles, portfolio and listing content, team profiles published by a Studio, reviews, ratings, business or trading names and approximate location information.

Identity documents, private verification records, private messages, Booking information and private Booking files are not made publicly available.

Studio Team Profiles

A Studio may choose to publish an optional "Meet the team" area on its profile. Where it does, it may include a photograph, a name or label, a role or title and a short description for each person shown. This content is published by the Studio and is publicly visible to anyone viewing that Studio profile.

The Studio decides what to publish and is responsible for having the agreement of each person shown before publishing their photograph or details, and for keeping that content accurate and up to date. Pixelly hosts and displays the content on the Studio's behalf.

If you appear in a Studio's team area and want your photograph or details changed or removed, you can ask the Studio directly or contact Pixelly using the Enquiries form. Pixelly can remove a team entry where appropriate, including where the person shown has not agreed to appear or has withdrawn their agreement.

Where applicable law requires business identity, address or contact information to be provided in connection with an offer or Booking, Pixelly will provide the information required by law.

7. Messages, Booking Information and Files

Messages, Booking information and files sent through Pixelly may be stored so the marketplace can operate and there is a record of the transaction. Pixelly does not routinely read Customer-Studio communications or inspect Booking files. Authorised Pixelly personnel may access relevant information where reasonably necessary for support, complaints, disputes, safety, fraud prevention, enforcement or legal compliance.

Pixelly does not use private Customer-Studio messages, Booking information or private Booking files for advertising or promotional purposes.

8. Payments and Stripe

Pixelly uses Stripe to process payments, refunds and Studio payouts. Using a specialist payment provider allows these transactions to be handled securely without Pixelly needing to collect or store full Customer card details or Studio bank account details.

Customers provide their payment details directly to Stripe when making a payment. Studios must set up or connect a Stripe account to receive payments and payouts through Pixelly. The underlying card and bank account details required by Stripe are provided directly to Stripe and are not received or stored in full by Pixelly.

Pixelly receives limited information from Stripe where needed to administer transactions and operate the marketplace. This may include:

• Stripe customer, account, payment or transaction identifiers;

• payment amounts and payment status;

• limited card information made available by Stripe, such as the card brand and last four digits;

• refund and chargeback information;

• subscription payment information; and

• Studio payout information and status.

Stripe may collect and use additional personal information in connection with its payment, payout, verification, fraud-prevention and regulatory activities. Depending on the particular service and processing involved, Stripe may process information on Pixelly's behalf or for purposes that Stripe determines itself.

For more information about how Stripe collects and uses personal information, please read the <u>Stripe Privacy Policy</u>. Pixelly’s use of information it receives from Stripe is governed by this Privacy Policy.

9. Where We Store Information and International Transfers

Pixelly uses cloud hosting, database, storage and other technology providers to store and process personal information. Some of these providers operate internationally, which means personal information may be processed in the UK, the EEA or other countries.

Where personal information is transferred outside the UK, Pixelly ensures that the transfer is made in accordance with UK data protection law. This may include relying on UK adequacy regulations or approved contractual safeguards, together with any additional protections required by law.

You can contact Pixelly using the privacy contact details below if you would like more information about the safeguards used for international transfers.

10. How Long We Keep Information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including applicable legal, accounting, security and claims requirements. Our general approach is:

• Account information. Kept while the Account remains active. An Account that has not been accessed for 12 consecutive months may be treated as inactive and closed following the notice process set out in the applicable Customer Terms or Studio Terms. Account profile, role and sign-in records may be retained for up to 12 months after the Account closes. After that, information that is no longer required will be deleted or anonymised, although Pixelly may retain particular records for longer where another retention period or lawful reason applies.

• Studio profiles, listings, reviews and other public content. Studio profile, portfolio and gallery content is generally kept until it is deleted or the relevant Studio Account closes. Reviews may be kept indefinitely and, where appropriate, de-identified after the relevant Account closes. Other public content may be retained for as long as reasonably needed for moderation, disputes, legal obligations or claims.

• General enquiries and support records. Support tickets and general contact messages are generally kept for up to three years after the relevant ticket or enquiry is closed. Booking-related enquiries, quotes and messages may be retained with the related Booking records for up to six years from the date of the relevant Booking.

• Booking and contractual records. Booking records, quotes, Booking-related enquiries and messages, contracts, signed documents and signature evidence may generally be retained for up to six years from the date of the relevant Booking where needed for administration, contractual claims or legal obligations.

• Payment, financial and tax records. Payment and payout records relating to Bookings may generally be retained for up to six years where needed for accounting, contractual claims or legal obligations. Financial and tax records, including invoices and payout records, may be retained for up to six years from the end of the relevant tax year.

• Booking deliverables stored through Pixelly. Unless a different period is shown for the Booking, photo, video and other deliverable files stored through Pixelly are generally retained for 30 days from upload so the Customer can download them, after which they are deleted.

• Digital-platform reporting records. Kept for the period required by applicable reporting law.

• Complaints and disputes. Complaint and dispute records may generally be retained for up to six years after final resolution where needed to evidence the matter, deal with related claims or meet legal obligations.

• Trust, safety and fraud records. Risk profiles, abuse signals and similar trust and safety records may generally be retained for between 24 months and three years, depending on the type of record and the reason it is retained. Particular records may be kept for longer where necessary for an investigation, legal claim or other lawful requirement.

• Technical and security logs. Generally kept for up to 12 months where reasonably necessary for security, troubleshooting, fraud prevention and legal compliance.

• Email sending, delivery and bounce records. Generally kept for up to 24 months.

• Marketing preferences and suppression records. Kept for as long as needed to manage your preferences and, where you opt out, to make sure that preference continues to be respected. Cookie information is kept for the periods stated in the Cookie Policy or relevant cookie information.

• Studio verification and compliance records. Studio verification documents may generally be retained for up to six years after the Studio Account closes. Other verification and compliance records are kept while needed to verify eligibility, prevent fraud, comply with reporting or legal duties and deal with claims, then deleted or anonymised when no longer necessary.

• Studio team and personnel records held through Pixelly. Generally deleted when the relevant Studio Account closes, unless the information needs to be retained under another category above or for another lawful purpose.

• Published team profiles. Removed from public view when the Studio deletes the entry or the Studio Account closes. Residual copies may remain in routine backups for a limited period, or where information must be kept for a legal claim or other lawful purpose.

Pixelly may keep information for longer where necessary for a legal claim, investigation, security incident, fraud prevention, legal or regulatory requirement or other lawful purpose. Where information is no longer required, it will be deleted or anonymised as appropriate.

11. Marketing

Pixelly may send optional marketing about Pixelly where permitted by electronic-marketing law. Where consent is required, we will ask for it before sending the marketing. You can stop optional marketing at any time by using the unsubscribe option in a marketing message or by contacting Pixelly through the Enquiries form.

We may retain a minimal record of an opt-out so that we can continue to respect your preference. Service communications needed to manage an Account, Booking, payment, security issue, complaint or important legal or service change are not marketing and may still be sent where necessary.

12. Your Data Protection Rights and Removing Your Information

Depending on the circumstances and the lawful basis used, you may have the following rights:

• Access. Ask for a copy of personal information Pixelly holds about you.

• Correction. Ask us to correct inaccurate or incomplete personal information.

• Erasure. Ask us to delete personal information where the legal requirements for erasure are met.

• Restriction. Ask us to restrict how personal information is used in certain circumstances.

• Data portability. Receive certain personal information you provided in a portable format where this right applies.

• Withdraw consent. Withdraw consent at any time where consent is the lawful basis. This does not affect processing already carried out lawfully before consent was withdrawn.

• Automated decisions. Where applicable, you may have rights relating to certain solely automated decisions. Pixelly does not currently use AI or other automated processing to make decisions with legal or similarly significant effects on individuals.

Your right to object

You can object at any time to the use of your personal information for direct marketing. Where Pixelly relies on legitimate interests, you may also have the right to object for reasons relating to your particular situation, subject to the legal rules that apply.

12.1 Removing or Deleting Your Information

The right to erasure is not absolute. Pixelly may need to keep information where it has a legal obligation or another lawful reason to do so, including for financial records, fraud prevention, disputes, legal claims or enforcement. If deletion means Pixelly can no longer carry out verification, security, legal or contractual functions required for an Account, some features may no longer be available and the Account may need to be closed.

12.2 How to Exercise Your Rights or Complain

To exercise a data-protection right or raise a privacy complaint, use our Enquiries form, select “Other” and provide details of your request: . We may ask for information reasonably needed to verify your identity. We normally respond within one month and may extend that period where the law allows.

You may also complain to the Information Commissioner’s Office (ICO). Information about making a complaint is available on the <u>ICO website</u>.

13. Changes to This Privacy Policy

We may update this Privacy Policy when Pixelly, our providers, our processing activities or the law changes. The current version and effective date will be published on Pixelly. Where required, we will bring material new uses of personal information to the attention of affected people before the new processing begins.

14. Contact

Pixelly Ltd is the controller for the processing described in this Privacy Policy.

Company name: Pixelly Ltd

Company number: 17224613

Registered in: England and Wales

Privacy contact: Enquiries form (select “Other”)

General contact email: hello@pixelly.uk

Website: www.pixelly.uk