Privacy & Cookie Policy
Helen Marshall Limited T/A The People’s Picture & The People’s Picture, Inc.
(Rebuilt using the currently live Privacy & Cookie Policy at thepeoplespicture.com/privacy-policy as the base, since it is materially more complete than the standalone AI-drafted “Global Privacy Policy” reviewed earlier — that draft’s inaccurate Article 17 claim does not appear here and should not be reintroduced. The AI draft’s genuinely useful additions are folded in below and marked [ADDED FROM AI DRAFT].)
1. Who We Are
1.1 We are Helen Marshall Limited t/a The People’s Picture (Company No. 11423615, 7 Wadeson Street, London, E2 9DR) and The People’s Picture Inc. (incorporated in Delaware) (together “The People’s Picture”, “we”, “us”, “our”).
1.2–1.6 We are committed to safeguarding Users’ privacy. This policy applies where we act as data controller — i.e. where we determine the purposes and means of processing. Our Services include privacy controls covering marketing preferences and cookies.
1.6a Our Role Depends on the Service You’re Using: for our campaign/fundraising Projects (where you contribute to a Commissioner’s mosaic under our Contributor Terms and Conditions), we and the commissioning organisation are joint data controllers of your personal data. For our Self-Serve CMS service (myphotos.thepeoplespicture.com, where you create your own personal photomosaic under our Self-Serve CMS Terms), there is no separate commissioning organisation — we are the sole data controller of your personal data.
1.7–1.10 Our Websites: thepeoplespicture.com and myphotos.thepeoplespicture.com. Our Website Terms of Use: thepeoplespicture.com/terms-conditions. Our Contributor Terms and Conditions: thepeoplespicture.com/contributor-terms-conditions. This Policy applies to all affiliated websites including myphotos.thepeoplespicture.com.
2. The Personal Data We Collect
2.1–2.2 We may process contact data (name, email, phone, postal address, age, gender, birthplace, social media handles) obtained when you create an account, log in, or request our Services — necessary for us and our sub-contractors/web developers/suppliers to deliver those Services. Where we give sub-contractors or software developers access to your data, we have a Joint Data Processing Agreement in place with them.
2.3 Other content you submit (via hashtags, tagging, uploads) — photographs, video, artwork, images, documents, location, and other material for publication — is submitted on the basis that you expressly grant us permission to crop, alter, and exercise creative control over it, per the Contributor Terms and Conditions (for campaign/fundraising Projects) or the Self-Serve CMS Terms (for your own personal photomosaic via myphotos.thepeoplespicture.com), whichever applies to the Service you’re using.
2.4 We process communication data (content and metadata of messages you send us) and usage data (IP address, location, browser, referral source, visit duration, page views, navigation paths) via Google Analytics.
2.5–2.7 We do not knowingly collect Special Category Data unless you expressly provide it in breach of our request not to; please do not supply another person’s personal data.
2.8 If a parent/guardian becomes aware their child has provided us information without consent, contact support@thepeoplespicture.com and we will delete it while we remain in control of the data — once contained in a permanent artwork, images cannot be removed.
3. Our Use and Collection of Your Personal Information
3.1–3.4 We collect personal information directly (Website submissions) and indirectly (browsing activity) including your name, address, phone, email, age, gender, birthplace, social media handles, and Your Content (photographs and stories you submit or permit us to use). We do not knowingly collect Special Category Data, Criminal Offence Data, or Children’s Data — if you submit content containing any of these, you acknowledge it has been manifestly made public by you and may be made available as part of a Project.
3.5 If a parent/guardian becomes aware their child provided information without consent, contact us and we will delete it promptly unless the project has been finalised, in which case contact the Project Commissioner.
4. Purpose of Processing and Legal Basis
4.1–4.11 We process personal data for: operating the Website and fulfilling Services (contract performance); managing relationships and communications (legitimate interests); personalising content (contract performance); direct marketing, which you may opt out of at any time via support@thepeoplespicture.com (legitimate interests); research and analysis on anonymised data (legitimate interests); record-keeping, security, and fraud prevention (legitimate interests); insurance and risk management (legitimate interests); legal claims (legitimate interests); and legal compliance or vital interests (legal obligation).
ADDED — new, distinct purpose Our own studio promotion — featuring your Contributor Materials in our own portfolio, case studies, website, social media channels, and other marketing/business-development materials, independent of any particular Project (see Clause 3.7 of the Contributor Terms and Conditions in Part 2 above). Where this includes posting to a third-party social media platform, that platform’s own terms and privacy practices also apply to the content once posted, including any use by that platform for its own product development or AI features.
(Full purpose/data-type/legal-basis table retained from the live policy in the final Word file.)
5. Automated Decision-Making
5.1–5.3 We may use automated decision-making for follow-up correspondence and personalised content; you may opt out via the methods in Section 1. Our platform may also use AI-informed suggestions which we improve using your feedback.
6. Providing Your Personal Data to Others
6.1–6.4 We may disclose your data to insurers, suppliers, affiliates, and professional advisers as reasonably necessary; to selected third-party suppliers for marketing purposes (with your consent, opt-out available); and as required by law or to protect vital interests or pursue/defend legal claims.
Sharing with commissioning partners: if you participate in a Project, your Basic Information and Content will be shared with our commissioning partners in accordance with the Contributor Terms and Conditions, subject to their own privacy policies. You affirm this sharing is non-rescindable once the project is completed.
Mergers/acquisitions: your information may transfer as part of a merger, acquisition, or sale; you will be notified of any resulting changes.
Legal requirement: we may disclose information where required by law, court order, or regulator, or to establish/defend legal claims or prevent fraud.
ADDED FROM AI DRAFT Third-party processors currently include Stripe/PayPal (payment processing) and Built By Storm Ltd t/a Storm Digital (development and hosting of the Collaborate/myphotos CMS) — named here for transparency alongside the general list of service providers described in Section 11 below.
7. International Transfers of Your Personal Data
7.1–7.4 We may transfer personal data between the EEA, UK, and USA for the purposes in this Policy under appropriate safeguards (standard contractual clauses or equivalent adequacy mechanisms), and will notify you before any transfer outside the UK/EEA/adequacy framework, ensuring equivalent protection. Our website hosting is based in the UK.
8. Retaining and Deleting Personal Data
8.1–8.4 We do not keep personal data longer than necessary for the purpose collected, except where retention is required by law or to protect vital interests; anonymised data may be retained for longer as required by the business.
8.5 If you use our Self-Serve CMS service, specific retention and deletion mechanics apply to your account and content, including what “delete” does and does not achieve once your mosaic has been compiled — see the Self-Serve CMS Terms, Clause 4, for full detail.
9. Security of Personal Data
9.1–9.4 We take appropriate technical and organisational precautions, including Joint Data Processing Agreements with sub-contractors, secure UK servers with two-factor authentication, and encryption for data in transit. Transmission of unencrypted data over the internet is inherently insecure and we cannot guarantee its security.
10. Your Rights
10.1 UK data subjects may complain to the Information Commissioner’s Office (ico.org.uk). Our ICO membership number is ZA575447. US data subjects may find further information at the Federal Trade Commission (ftc.gov); EEA data subjects via the European Commission’s data protection pages.
10.2–10.13 Your principal rights include access, rectification, erasure, restriction of processing, objection to processing, data portability, the right to complain to a supervisory authority, and the right to withdraw consent. For a photograph that has become part of a finished, compiled Artwork, exercising your erasure or withdrawal right after Database Lock (a) permanently removes your photograph and caption from our own CMS and any online searchable gallery; (b) triggers a request to the Commissioner to remove it from their own marketing and social media, which we cannot guarantee they will act on; but (c) cannot undo any sharing, press coverage, or publication that has already happened in the public realm, which is genuinely outside our control; and (d) does not remove your photograph from the finished, compiled Artwork itself, which remains visible via our interactive hosting provider — we only consider individually obscuring a photograph there in dire circumstances (unlawful content, a court order, or a serious safeguarding concern), at our sole discretion. Full detail on each right, including this specific limitation, is retained from the live policy in the final Word file. You may exercise any right by emailing support@thepeoplespicture.com.
11. Third-Party Websites, Service Providers and Others
11.1–11.3 We are not responsible for third-party privacy policies. Third parties we currently share information with include: Stripe/PayPal (payment processing); Built By Storm Ltd t/a Storm Digital (development and hosting of the Collaborate/My Photos CMS); Micr.io (hosting of the interactive online mosaic — since the mosaic is itself composed of thousands of individual Contributor photographs, this means hosting and serving identifiable Contributor photographs directly, viewable at full resolution by zooming into any tile, on every Project — not only where the separate Interactive Story Markers feature is additionally used; running on Cloudflare’s Western Europe data centres — confirmed via Micr.io’s own Trust Center); Amazon Web Services (AWS) and SiteGround (our own core server infrastructure — SiteGround confirmed to run on Google Cloud infrastructure; specific regions for both to be confirmed); Displayways, Volodymyr Dovbnia, and Studio Ink (UK-based — printing/fabrication, video/production, and graphic design respectively); Slava Lukasevych (Ukraine-based, video/production processing); and Supercool Design (Turkey/Serbia-based, graphic design and creative work) — together with delivery couriers, email marketing providers (e.g. Mailchimp), web developers, and secure storage/software providers (e.g. JotForm, Dropbox, Box, Google Drive, Krystal).
We also use Upwork (a platform sometimes used to engage freelance consultants — see the Sub-Contractor Agreement’s scope clarification; Upwork itself does not typically process Contributor or Content personal data directly, but may process freelancer/consultant personal data where used for engagement and payment), Trello (project and task management), Dropbox (file storage and transfer — in addition to the general reference above), WeTransfer (large file transfer), Fillout (form building), WordPress (website hosting/content management, where used), and Adobe (Creative Cloud tools used in production and design work), and Frame.io (video review and collaboration).
We use Canva (Pro tier) for studio marketing, templates, and design work, including compositing Contributor photographs and campaign Content for public/B2B Projects. The Canva account’s “content used to improve AI-powered features” privacy setting is switched off, so nothing uploaded, including Contributor photographs, is used to train Canva’s AI models.
This list may change over time. We only share your information with marketing companies with your express consent.
12. Personal Data of Children
12.1 Our Website and Services are targeted at persons over the age of 13, consistent with the Children’s Online Privacy Protection Act (COPPA). Commissioners are required to ensure all submissions hold appropriate releases and permissions for all data subjects, including under-18s; we also undertake reasonable due diligence from time to time. Schools participating in a project must provide a blanket permission and retain liability for obtaining appropriate consents.
12.2 If we have reason to believe we hold personal data of a person under 13 without parental/guardian consent, we will delete it.
13. Updating Information
13.1 Let us know if the personal information we hold about you needs correcting or updating.
14. Cookies
14.1–14.4 We and our service providers use cookies, including Google Analytics (opt-out available via Google’s tools) and a tool for device/browser/IP tracking. Further general information on managing cookies is available via allaboutcookies.org and standard browser settings guidance (Chrome, Firefox, Opera, Internet Explorer, Safari, Edge). Blocking all cookies may limit Website functionality.
ADDED FROM AI DRAFT California Privacy Rights (CCPA/CPRA): we do not sell or share personal data for cross-context behavioural advertising. California residents may request data disclosure or deletion via support@thepeoplespicture.com. We recognise the Global Privacy Control (GPC) signal and other legally recognised opt-out preference signals as a valid request to opt out of sale/sharing, where applicable.
15. Legal Information
15.1 This Privacy Statement is prepared with reference to UK Data Protection Act 2018, EU Regulations 2018/1725, GDPR 2016/679, the US Federal and State Privacy Act 1974, the California Consumer Privacy Act 2019 (CCPA), and COPPA.
16. Our Details
16.1–16.2 This Website is owned and operated by Helen Marshall Limited (Company No. 11423615, 7 Wadeson Street, London, E2 9DR) and The People’s Picture Inc. (incorporated in Delaware).
17. Amendments
17.1–17.2 We may update this policy by publishing a new version on the Website; please check this page periodically.