Privacy Policy

This Privacy Policy explains how PicsOfMe Limited ("PicsOfMe", "we", "us", "our"), a company registered in England and Wales, collects, uses, stores, shares and protects information submitted by, or relating to, users of the PicsOfMe mobile application and related services (the "App").

PicsOfMe is an event photo-sharing app. We use facial recognition technology to automatically match the people who appear in event photos with the users who want to find and receive those photos. This involves the processing of biometric data, which is a special category of personal data and is treated as high-risk. We therefore handle your privacy with particular care, and this policy describes those practices in detail (see Section 6).

As a UK-based controller, we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), each as amended by the Data (Use and Access) Act 2025 (DUAA), and with the Privacy and Electronic Communications Regulations 2003 (PECR). Where we offer the App to individuals located in the European Economic Area (for example, participants in an event held in the EEA), the EU GDPR also applies to that processing.

This policy applies to:

• Registered users — people who create an account to find, view, download or share photos, including those who upload a reference selfie so the App can identify them in event photos.
• People who appear in photos — individuals captured in photos uploaded to the App, whether or not they are registered users (see Sections 6.7 and 10).
• Uploaders and event organisers — people and organisations that upload photos or run events using the App.

The above address can be used for any data protection enquiries. Our privacy contact and Data Protection Officer (where appointed) are identified in Section 24.

Where we process the personal data of individuals in the EEA without being established there, we will appoint a representative in the EEA under Article 27 EU GDPR, whose details will be made available in Section 24.

PicsOfMe engages trusted third-party service providers to support the App's operation, including cloud hosting and storage, facial recognition processing, image processing, analytics, communications (such as push notifications and email), payment processing where applicable, and technical maintenance.

All such providers act under our instructions and are bound by written contracts containing the data protection terms required by Article 28 UK GDPR. Where a provider processes biometric data on our behalf, that provider is contractually required to apply equivalent safeguards, to process that data only for the purposes we specify, and to support us in fulfilling deletion requests and data protection complaints. We maintain a record of the categories of recipients with whom we share data, available on request.

This is the core of how PicsOfMe works, and the most sensitive data we handle.

6.1 What we collect

To match you to photos you appear in, we create a facial recognition template ("faceprint"). We may generate templates from:

• a reference selfie or profile photo that you provide; and
• faces detected in event photos uploaded to the App, in order to compare them against reference templates.

A facial recognition template used to uniquely identify you is biometric data and a special category of personal data under Article 9 UK GDPR.

6.2 How matching works

When event photos are uploaded, our system detects faces, converts them into templates, and compares those templates against the reference templates of users who have opted in. When there is a match, the relevant photos are made available to the matched user. This is an automated process designed to save you from searching large photo galleries manually (see also Section 19).

6.3 Our legal basis: your explicit consent

We process your biometric data only on the basis of your explicit, freely given consent (Article 9(2)(a) UK GDPR). We ask for this consent separately and clearly, before we create any facial recognition template from your reference photo. Your consent covers matching across all events you participate in while your consent remains active — you do not need to re-consent for each new event. Consent to face matching is optional: you can use other features of the App, where available, without enabling it.

6.4 What we never do with your face data

6.5 Withdrawing consent

You may withdraw your consent at any time through the App's settings or by contacting us. When you withdraw consent we stop using facial recognition to match you and delete your facial recognition template(s) without undue delay. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not by itself delete photos in which you appear that others have lawfully received or stored (see Sections 10 and 17).

6.6 Retention of biometric templates

Because your consent to face matching applies across all events you participate in, we retain your facial recognition template for as long as your consent remains active and your account is open, so that you can be matched in any new event without needing to re-register your biometric data. Templates are deleted within 30 days of whichever occurs first: your withdrawal of consent or your account deletion. We do not retain biometric templates after that period.

6.7 People who appear in photos but are not registered users

When the App detects faces in uploaded photos, it may temporarily generate templates to perform matching. Where a detected face does not correspond to a consenting registered user, we do not use that data to build a persistent profile, and we delete or do not retain such transient templates beyond what is necessary to perform the match. If you appear in photos and wish to exercise your rights or object, contact us using the details in Section 24.

In addition to biometric data, we collect only what is necessary to operate the App:

• Account information — name, email address, phone number, username and credentials.
• Photos and media you upload, that are uploaded at an event you attend, or that are shared with you, plus associated metadata (such as the time a photo was taken).
• Event information — events you join, your participation, and event codes or invitations.
• Usage data — features used, photos viewed, downloaded or shared, and in-app activity.
• Technical and device data — IP address, device type and identifiers, operating system, app version, push notification tokens, and diagnostic and crash logs.
• Permissions you grant — camera, photo library, notifications and, where you enable it, approximate or precise location.

We process information to:

1. Create and manage your account.
2. Operate the facial recognition matching service, where you have consented (Section 6).
3. Make event photos available to you and enable you to view, download and share them.
4. Send notifications about new matched photos, event updates and service messages.
5. Maintain, secure, troubleshoot and improve the App.
6. Handle your rights requests and complaints.
7. Comply with legal obligations and respond to lawful requests.

We rely on the following legal bases under the UK GDPR:

• Explicit consent (Art. 9(2)(a)) — for biometric data and facial recognition; and consent for optional communications.
• Contract (Art. 6(1)(b)) — to provide the App and fulfil our user agreements.
• Legitimate interests (Art. 6(1)(f)) — to operate, secure and improve the App, where not overridden by your rights.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable legal and regulatory requirements.

You can withdraw consent at any time without affecting the lawfulness of prior processing.

PicsOfMe is a sharing platform, so photos are, by design, made available to other users.

• Photos uploaded at or for an event may be matched and shared with the individuals who appear in them and, depending on event settings, with other event participants.
• Uploaders and organisers are responsible for having an appropriate basis to upload photos and must not upload images they have no right to share.
• If you appear in a photo and want it removed or restricted, or wish to object to its processing, contact us (Section 24) and we will assess your request in line with Section 17 and applicable law.

We may share information with:

• Other users, as inherent to the photo-sharing purpose of the App (Section 10).
• Service providers and processors assisting in operating the App (Section 5).
• Event organisers, where you participate in an event that uses PicsOfMe, limited to what is necessary for that event.
• Professional advisers, such as legal, technical or compliance consultants.
• Regulatory or governmental authorities, where required by law, and parties to a corporate transaction (e.g. a merger) under appropriate safeguards.

We do not share your data for third-party marketing or advertising.

Our users and events may be located in different countries (for example, an EEA event with participants from elsewhere). Transfers from the UK to the EEA are covered by the UK's adequacy framework. Where personal data, including biometric data, is transferred to other countries, we apply an appropriate safeguard recognised under UK law — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — supported by a transfer risk assessment, and we apply the international-transfer standard set out in the UK GDPR (as amended by the DUAA). Where the EU GDPR applies to a transfer, we apply its transfer safeguards.

We apply appropriate technical and organisational measures to protect information against unauthorised access, disclosure, alteration or destruction. Given the sensitivity of biometric data, these include encryption in transit and at rest, strict and logged access controls, pseudonymisation where appropriate, and access restricted to authorised personnel only. We review these measures periodically.

If a personal data breach occurs, we will assess it without undue delay. Where required, we will notify the ICO within 72 hours of becoming aware of it, and we will inform affected individuals where the breach is likely to result in a high risk to their rights and freedoms. We keep an internal record of all breaches.

We retain information only for as long as necessary to provide our services or to meet legal and regulatory requirements:

• Biometric templates — retained while your consent is active and your account is open; deleted within 30 days of consent withdrawal or account deletion (Section 6.6).
• Photos — event album photos remain available to participants for as long as the Service is in operation. We may in the future introduce a retention period after which event photos are removed; if we do, we will give you reasonable advance notice and the opportunity to download any photos you wish to keep before they are deleted. Earlier deletion may be requested by you or an authorised party, and longer retention may apply where legally required.
• Account data — while your account is active and for a reasonable period after closure, subject to legal requirements.
• Complaint and rights-request records — for the period required to demonstrate compliance.

Where no legal obligation requires retention, you may request deletion (Section 17).

Subject to applicable data protection laws, you have the right to:

• Access the information we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, including your facial recognition template(s), where legally permissible (Section 17).
• Withdraw consent to facial recognition at any time (Section 6.5).
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Complain to us (Section 18) and to the ICO (Section 24).

To exercise these rights, contact us using the details in Section 24. We respond within one month (extendable by two further months for complex requests, with notice). We do not charge a fee unless a request is manifestly unfounded or excessive, and we may need to verify your identity first.

You can ask us to remove you from PicsOfMe at any time. Because we process biometric data, we treat removal requests with particular care.

17.1 The choices available to you

We offer distinct options, so you can choose how far to go:

• Stop face matching — we delete your faceprint within 30 days and stop matching you, while your account remains active.
• Delete your account — we close your account and delete the personal data associated with it, including your faceprint.
• Erase all my data — full erasure of your personal data, subject to the limited exceptions below.

17.2 What we guarantee when you ask to be removed

17.3 Photos you appear in

Erasing your faceprint and account stops us matching you, but it does not automatically remove every photo in which you appear, because:

• some photos were uploaded by other people (for example, an event photographer or another attendee), and
• some photos may already have been downloaded or saved by other users, which is outside our technical control.

For photos and content within our control, we will delete, restrict or de-link them at your request where we are required or able to do so. Where data has been disclosed to others, we will, where feasible, take reasonable steps to inform recipients of your erasure request (Article 19 UK GDPR), and we will tell you about those recipients if you ask. For content outside our control, we will explain what we can and cannot do and, where relevant, direct you to the appropriate route.

17.4 What we may lawfully retain

We may retain limited information after a deletion request where the law allows or requires it — for example, to comply with a legal obligation, to establish, exercise or defend legal claims, or to prevent fraud and abuse. We retain only what is necessary for those purposes and for no longer than required.

If you are unhappy with how we handle your personal data, you can complain to us directly. In line with section 164A DPA 2018 (introduced by the DUAA), we maintain an accessible complaints process:

• Submit a complaint using our complaint form, or contact us by email or post. Our complaint form is currently being finalised. In the meantime, you can email us at privacy@picsofme.com.
• We acknowledge receipt within 30 days.
• We investigate without undue delay, keep you informed, and tell you the outcome, including your right to escalate to the ICO.

You can complain to us whether or not you are a registered user, and this does not remove your right to complain to the ICO at any time.

Facial recognition matching is an automated process (Section 6.2). It surfaces photos you appear in and does not produce legal or similarly significant effects on you. Because it relies on special category (biometric) data, we carry it out only with your explicit consent and with appropriate safeguards. You may contact us if you believe a match is incorrect or wish to opt out of automated matching.

PicsOfMe is not intended for use by children under the age of 13 (the age of consent for information society services in the UK under section 9 DPA 2018), and we do not knowingly create accounts for children under that age. We do not process a child's biometric data without a valid legal basis, such as verifiable parental or guardian consent.

Because the App is likely to be accessed by children, and events may include minors who appear in photos, we have regard to the ICO's Age Appropriate Design Code (the "Children's Code") and to the "children's higher protection matters" introduced by the DUAA, applying heightened care to the design of the service and the protection of children's data. Where we become aware that a minor's biometric data has been processed without an appropriate legal basis, we will delete the relevant template(s) and take appropriate steps. If you believe a child's data has been processed inappropriately, contact us immediately.

As a mobile application, the App may use device identifiers, software development kits (SDKs) and similar technologies for essential functionality, security, and to understand and improve how the App is used. Our use of these technologies is governed by PECR alongside the UK GDPR. We rely on essential technologies necessary to provide the service; for analytics and other non-essential technologies, we provide clear information and an accessible means to opt out. Where we operate a website, you can manage preferences through its cookie controls and your browser settings.

We send service messages necessary to operate the App (such as photo-match and event notifications). We only send optional marketing communications where you have consented, and you can opt out at any time through the App settings or the unsubscribe link in the message.

We may update this Privacy Policy periodically. Where changes are material — in particular, any change affecting how we process biometric data — we will take appropriate steps to inform you and, where required, seek renewed consent. The latest version will always be available in the App.

For questions about this policy, to exercise your rights, to make a complaint, or to withdraw consent, contact us:

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO) — ico.org.uk — or, where the EU GDPR applies to you, with your local EEA supervisory authority.