Privacy Policy and Cookie Notice

1.1 This privacy policy is used by:

(a) We are Helen Marshall Limited, trading as The People’s Picture (Company No. 11423615, registered office 7 Wadeson Street, London, E2 9DR), which is the controller of personal data processed through the Websites and CMS in connection with its UK operations and projects; and

(b) The People’s Picture, Inc., a company incorporated in Delaware, USA, which is the controller of personal data processed in connection with the services and projects it supplies in the United States.

Where both companies jointly determine why and how particular personal data is processed, they act as joint controllers. For a commissioned project, the relevant People’s Picture entity may also act as a joint controller with the Commissioner, as explained in Sections 2 and 5. The relevant campaign page, SoW or account information will identify the People’s Picture entity and Commissioner responsible for that Project.

(together “The People’s Picture”, “we”, “us” or “our”).

1.2 Our websites are thepeoplespicture.com and the MyPhotos content management system at https://myphotos.thepeoplespicture.com/ (the “CMS”) (together, the “Websites”). This policy applies to both. Please read it alongside our Website Terms of Use (thepeoplespicture.com/terms-conditions) and our Contributor Terms (thepeoplespicture.com/contributor-terms-conditions).

1.3 In the UK, Helen Marshall Limited is registered with the Information Commissioner’s Office (ICO), reference ZA575447. For contributor, technical and data protection enquiries (including requests to exercise your rights), contact support@thepeoplespicture.com. For business enquiries, contact admin@thepeoplespicture.com. Our postal addresses are Helen Marshall Limited, 7 Wadeson Street, London, E2 9DR, and The People’s Picture, Inc., 15 Addison Rd, Bergenfield, New Jersey 07621.

“Authorised Partner” means a charity, sponsor, venue, campaign partner or other organisation approved to participate in a Project by the relevant Commissioner and The People’s Picture. An Authorised Partner’s data-protection role will depend on how it accesses and uses personal data.

“Controller” decides why and how personal data is used. Our role differs depending on who you are;

“Commissioner” is the organisation or person commissioning a project;

“Content” means the photographs, videos, stories, captions and other material submitted for the project;

“Database Lock” is the point when the Commissioner signs off the approved Content and artwork production begins.

3.1 Account and contact data: name, email address, phone number, postal address, organisation, login credentials and, where you give them, your age, gender, birthplace and social media handles. Depending on the Project, the Commissioner may request additional information through custom fields. The project information will explain which additional information is collected, why it’s required and the applicable lawful basis before you provide it

3.2 Contributor Content: photographs, video, captions, stories and ideas you submit, the names of people and places in them, and location information. We ask for your first name and email address with each submission and, where you submit on behalf of a child, the child’s name and age. We receive this information directly from you or from Commissioners, parents or guardians.

3.3 Commissioner and moderator data: the names and work emails of Commissioner staff and Authorised Users, and a record of each moderation decision made in the CMS.

3.4 Records of your agreement: the version of the terms you accepted and the date, and the Revoke Button and Database Lock records for your submission.

3.5 Payment data: if a project includes a donation or payment option, you are sent to the Commissioner’s own payment provider (for example Stripe). We record whether a payment was made but we do not receive or hold card details or the funds. For paid prints or books ordered through a private account, a payment provider (for example Stripe or PayPal) processes your payment. If you buy a paid service directly from us (for example, as a private CMS account holder), payment is taken through our own Stripe account. We receive confirmation of the payment but not your card details.

3.6 Communications and technical data: messages you send us, and information collected through cookies and similar tools, such as your IP address, approximate location, browser, device, referral source, pages viewed and how long you stayed.

3.7 We do not routinely request special category data (for example health, religion, ethnicity or sexual orientation) or criminal offence data. Where a project requires special category or criminal offence data, we will only request it where necessary and permitted by applicable Data Protection Laws. Otherwise, photographs, captions or stories may incidentally reveal this type of information. Unless expressly requested, please do not submit such information, or other people’s personal data, in anything you send us beyond what a photograph naturally shows and only where relevant to the Project and you are entitled to provide it, including having obtained explicit consent from each identifiable person concerned. We do not use Content to analyse or infer sensitive characteristics about individuals. Where we become aware that Content contains special category or criminal offence data, we may reject, restrict or remove it. We will only process such information where permitted by Data Protection Laws and an applicable additional legal condition is satisfied.

The table below explains how we use personal data and the lawful basis on which we rely. Where the Commissioner uses personal data for its own purposes, it is responsible for identifying and explaining its own lawful basis in its privacy notice.

4.1 Where we rely on consent you can withdraw it at any time (see Sections 7 and 11). Withdrawing consent does not affect processing already carried out. We will stop the processing that relies on your consent when you withdraw it. You can unsubscribe from marketing using the link in our emails or by contacting us; you do not need to withdraw your project submission to stop marketing.

4.2 We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. We use software to arrange photographs into a mosaic and to send follow-up emails and personalised content. You can opt out of the latter by emailing us.

5.1 For a commissioned project, where we and the Commissioner jointly determine the purpose and means of processing your personal data, we are joint controllers. We determine the technical means of collection (the CMS, the Revoke Button and Database Lock) and the hosting and security of project data. The Commissioner decides the purpose and legal basis of the campaign, moderates the Content and provides its own privacy notice. Each of us is responsible for establishing a lawful basis for our own processing. We have a written arrangement setting out these responsibilities, in accordance with UK GDPR Article 26.

5.2 You can exercise your rights against either of us. In the first instance please contact us at support@thepeoplespicture.com. We will notify the Commissioner and coordinate a reply. Routine questions about a submission may be forwarded to the Commissioner’s moderator but statutory rights requests and privacy complaints are coordinated within the applicable legal deadlines. Each of us remains responsible to you and to regulators, and this arrangement does not limit that.

5.3 Please also read the Commissioner’s own privacy notice, which is linked from the project page.

5.4 Where an Authorised Partner determines its own purposes or makes its own decisions about how Contributor personal data is used, it may act as a separate or joint controller. Where applicable, the project page or privacy information provided when Content is collected will identify the Authorised Partner, explain its role and link to its privacy notice.

6.1 If your Content is selected for a feature or display, we show it with your first name and general location (for example your state or region) and any caption or story you gave, unless the project says otherwise. We do not publicly display other personal details without your consent.

6.2 The finished artwork may be shown through an interactive, zoomable online viewer hosted by Micr.io, on the Commissioner’s channels, and on social media. Because the mosaic is made of individual photographs, anyone who zooms in can see them at full resolution.

6.3 Content that is public can be viewed, copied, screen-captured and shared by other people, and we cannot control this. If you see your Content being misused, or you believe Content on our Websites infringes your rights, email support@thepeoplespicture.com with the details and we will review it promptly.

7.1 Before Database Lock you can withdraw your Content at any time using the Revoke Button in your confirmation email. This removes your submission from the CMS and stops its use in the project, subject to any limited records we are legally entitled or required to retain.

7.2 After Database Lock the photographs have been compiled into one finished artwork. We will consider every request under applicable data protection law and reply within one month (extendable by up to two further months for complex requests where legally permitted), or within the period your US state privacy law requires. For a photograph that is part of a compiled artwork:

• we will permanently remove your photograph and caption from our own CMS and any online searchable gallery;

• we will notify the Commissioner and any other recipients and ask them to take reasonable steps to remove the Content from anywhere it has been made public, including from their own marketing and social media. We cannot guarantee that all copies already shared will be revoked but this does not limit our legal obligations;

• we do not remove your photograph from the finished artwork itself as a standard option. We will assess each request to remove or obscure a photograph on a case-by-case basis, taking account of applicable data protection laws, any lawful exceptions and technical implications.

7.3 If you use a private account, you can add, remove or delete photographs and delete your account at any time before you finalise your mosaic. After you finalise it, deleting your account removes your personal details and stops further processing, and we take the finished mosaic offline, but we cannot remove a single photograph from within it without re-making the whole piece. These practical limitations do not override your statutory rights; we assess any request under the same legal requirements described above.

8.1 We do not sell your personal data. We share it only as follows:

• the Commissioner for your project, and any Authorised Partner it has named, in line with the Contributor Terms and where necessary to administer, moderate or promote the project and as explained when the Content is collected;

• service providers who help us run the Websites and deliver projects, listed in Section 8.2;

• insurers, professional advisers, auditors and, where needed, courts or authorities, where the law requires or to protect our legal rights or the safety of others;

• a buyer or successor if our business is sold or merged, in which case we will tell you of any changes; and

• marketing partners only if you have given your consent.

8.2 Our current service providers, each of which is bound by written data protection terms, include:

8.3 We may change providers, and we may use other print, fabrication and production suppliers on individual projects. We keep a current list and will give it to you or the Commissioner on request. We assess each provider’s role and use data processing terms where required

9.1 We are based in the UK and the US. We may transfer personal data between the UK, the European Economic Area (EEA) and the United States, and to the suppliers listed above where necessary to provide our servcies. If you contribute from outside the UK or the US on a worldwide project, your data may be transferred to and processed in the UK, the US and other countries where we, the Commissioner or our suppliers are located. Those countries may not provide the same level of protection for personal data as the country in which you are located.

9.2 UK law requires us to use a valid transfer mechanism for restricted transfers of personal data outside of the UK. This may be UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework for transfers to participating and appropriately certified US recipients) or other appropriate safeguards, with the required transfer assessment. Where the EU GDPR applies, we will use an applicable EU adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and any required transfer impact assessment. You can contact support@thepeoplespicture.com for information about the safeguards applicable to your data and how to obtain a copy.

• Project data (for example submission records, consents, moderation records and working files) is kept securely for at least five years after the project is completed so that we can respond to Commissioner requests. We may keep it for longer where we need it to evidence the licences and consents for the finished artwork, to keep our records or to deal with legal claims. We review what we keep and delete or anonymise personal details (such as email addresses) we no longer need, and we delete earlier where deletion is agreed or required.

• Published Content (photographs in compressed form, with any first name, general location and caption shown with them) is kept for as long as the finished artwork, online gallery, our portfolio, website or marketing is in use. You can ask us to remove your photograph and caption from any online gallery or marketing at any time (see Section 7). The finished artwork itself continues to exist as described in Section 7.

• If a project has a CMS access period, Content may be compressed and moved to a soft archive when it ends. This does not extend CMS access. Archived project data is kept and reviewed as described above and is securely deleted or anonymised when no longer needed.

• Private account data is kept while your account is active and until you delete it, apart from what the law requires us to keep.

• Records of agreement and accounting, tax and legal records are kept only for as long as the law requires or we need them to deal with claims.

• Marketing details are kept until you opt out or they are no longer needed. We may retain a minimal suppression record to ensure we do not contact you again Anonymised data may be kept longer.

11.1 If you are in the UK or EEA, subject to the applicable legal conditions and exceptions, you have the right to: access your data; correct it; have it erased; restrict or object to our use of it; receive a copy of it in a portable format; and withdraw consent at any time. Our rights as controller to retain data needed for legal claims apply, and Section 7 explains what erasure means once an artwork has been compiled. You have an absolute right to object to direct marketing. Where we rely on legitimate interests, you may object on grounds relating to your particular situation.

11.2 If you are in California, you have the right to know what personal information we collect and how we use it, to request a copy, to request deletion or correction, to opt out of any sale or sharing of personal information, and not to be treated differently for using these rights. We do not sell personal information or share it for cross-context behavioural advertising, and we recognise the Global Privacy Control signal as a valid opt-out request. Residents of other US states have similar rights where state law provides them.

11.3 To exercise any right, email support@thepeoplespicture.com. We reply within one month, or within the period your local law sets. We may ask you to verify your identity first.

11.4 You can complain to the Information Commissioner’s Office (ico.org.uk) in the UK. In the US you can contact the Federal Trade Commission (ftc.gov) or your state attorney general, and in the EEA your local data protection authority. We would appreciate the chance to put things right first. To raise a data protection complaint with us, email support@thepeoplespicture.com. We will acknowledge it within 30 days, investigate appropriately and inform you of the outcome without undue delay. This does not prevent you from contacting the ICO.

12.1 Our Websites are not directed at children under 13. We do not knowingly collect personal information directly from anyone under 13 without verifiable parental consent as required by applicable law, including COPPA. If you learn that a child under 13 has given us personal information without the required consent, please contact us and we will investigate and take appropriate action, which may include restricting or deleting the information. Database Lock does not limit the child’s statutory data-protection rights.

12.2 You must be 18 or over to create an account, submit Content or accept our terms. A parent or legal guardian may submit Content that shows, names or was created by a child under 18, in the circumstances set out in the Contributor Terms. Commissioners must make sure the necessary permissions are in place for each child who appears in Content they supply. Children’s personal data remains protected by applicable data protection law, including after Database Lock. A parent’s acceptance of the terms does not waive the child’s rights.

13.1 We use appropriate technical and organisational measures, including secure servers, two-factor authentication on request, encryption of data in transit, access limited to authorised people, and written agreements with our suppliers. No transmission over the internet is completely secure, so we cannot guarantee the security of data you send us.

14.1 We and our providers use cookies and similar technologies on the Websites. Cookies are small text files placed on your device when you visit a website. Essential cookies keep the CMS login working and support account security, website functionality and your cookie preferences. Analytics cookies, including Google Analytics, tell us how the Websites are used and help us measure and improve their performance. We do not set analytics or other non-essential cookies unless you consent through our cookie banner. You can accept or reject non-essential cookies through our cookie banner, and manage cookies in your browser, including changing or withdrawing your choice at any time. Blocking all cookies may limit how the Websites work. Google provides a tool to opt out of Google Analytics.

15.1 The Websites may link to other sites, and Commissioners and social media platforms have their own privacy policies. We are not responsible for them.

16.1 We may update this policy by publishing a new version with a new date on the Websites. We will give reasonable notice of significant changes where we can. Please check this page from time to time.

Helen Marshall Limited (Company No. 11423615), T/A The People’s Picture, 7 Wadeson Street, London, E2 9DR.

The People’s Picture, Inc., 15 Addison Rd, Bergenfield, New Jersey 07621.

Contributor, technical and data protection enquiries: support@thepeoplespicture.com. Business enquiries: admin@thepeoplespicture.com.