PRIVACY NOTICE

IMPORTANT

References to Content may include references to your Personal Data, including Special Category Personal Data and/or Biometric Data relating to you, as the context so requires.

References to Personal Data may include Special Category Personal Data and/or Biometric Data relating to you, as the context so requires.

1. PERSONAL DATA COLLECTED AND OBTAINED

This Privacy Notice ("Notice") sets out the basis on which Wavebreak Media Ltd. ("Wavebreak Media", “,we”, "our" or “us”) of Unit 3, Westpoint Business Centre, Westpoint Business Park, Ballincollig, Co. Cork, P31 HX21, Ireland, will process your Personal Data, which may form part of: (a) Content; and (b) Your Data Labels.

• Content
• Your Data Labels

For the purposes of this Notice, Wavebreak Media is the controller of your Personal Data and will process your Personal Data in accordance with this Notice.

This Notice applies to Models.

Please see the "Definitions" section at the end of this Notice to understand the terms we refer to throughout.

2. TYPES OF PERSONAL DATA WE PROCESS ABOUT YOU

The table lists the categories of Personal Data we will collect about you (depending on the purposes for which it is processed). While intended to be as complete and accurate as reasonably possible, this may be updated from time to time in accordance with this Notice.

We will collect and process some or all of the following Personal Data about you:

Category of Personal Data	Details
Background Data	Name Gender Date of Birth Contact Details
Biometric Data	Appearance Ethnicity Age Gender Identity Heritage Hair and Eye Color Skin Description (e.g., "wrinkles," "freckles," etc) Clothing and Style (e.g. hairstyle, makeup) Emotion and Mood e.g., "happy," "excited," "pensive", "sad")
Health Data	Data concerning visible medical conditions (e.g. use of prosthetics, use of hearing aids, glasses, etc.)

3.SOURCES OF YOUR PERSONAL DATA

Sources of your Personal Data

We will collect your Personal Data either:

Directly from you ("direct collection"): For example, through email interactions with you. From third party sources ("indirect collection"): In certain circumstances, it will be necessary to obtain data from third parties, including: Artists. Content. Publicly available sources (news sources, social media, etc.). AI processing tools (i.e. AI software which can provide textual descriptions of image features such as your appearance)

4. HOW AND WHY WE PROCESS YOUR PERSONAL DATA

We rely on the following lawful bases:

Lawful Basis	Details
We rely on explicit consent for the following processing activities:	We may label the Content with descriptive text and keywords. Certain descriptive text and keywords may be used in relation to the Content which may include special category personal data as outlined in Article 9(1) of the GDPR ("Special Category Personal Data") such as information which may refer to your ethnicity or health. To the extent that any Special Category Personal Data is processed by us, we rely on consent to the processing of such Special Category Personal Data (save for circumstances where you have manifestly made such Special Category Personal Data public). Where You have provided such consent, You have the right to withdraw the consent you have given to such processing of Special Category Personal Data at any time by contacting us at the address provided below. Save for where you have manifestly made such Special Category Personal Data Public, we rely on your explicit consent to the publication of any of your Personal Data which contains Special Category Personal Data. The Content, including descriptive text and keywords which may constitute Special Category Personal Data, may be made publicly available worldwide and may be transferred to countries with different data protection / privacy laws where it may be stored, accessed, and used. We may record certain biometric features of your Personal Data in the Content, such as your race/ethnicity, which may constitute Special Category Personal Data for the purposes of correctly labelling the Content. To the extent we record such information, it is on the basis of your explicit consent. We may process your Biometric Data derived from the Content to identify you so that your consent in the Release and your explicit consent in the Notice can be linked to specific Content containing your Personal Data.
We rely on Legitimate Interests for the following processing activities to the extent that such processing does not involve processing of Special Category Personal Data: IMPORTANT: Before we process your Personal Data to pursue our legitimate interests for the above purposes, we determine if such processing is necessary and we carefully consider the impact of our processing activities on your fundamental rights and freedoms. On balance, we have determined that such processing is necessary for our legitimate interests and that the processing which we conduct does not adversely impact on these rights and freedoms.	Wavebreak Media relies on legitimate interests as a lawful basis for processing your Personal Data for the purposes of using, publishing, licensing or promoting Content. We are in the business of licensing and/or selling Content including stock photography and imagery to third parties and it is a legitimate interest of ours to be able to process your Personal Data insofar as it is required to facilitate these purposes. Content including your Personal Data may be added to datasets comprised of various Content which may be licensed and/or sold to third parties, and/or used by us, in order to develop and improve machine learning algorithms, artificial intelligence, AI systems and models, and other technologies which are currently in existence or which may be developed in the future. As the AI market develops, We, and third parties may require new uses of our Content, and it is in our legitimate interests to use your Personal Data in any Content Data insofar as it is required to facilitate these new market requirements. Content including your Personal Data may be combined with other images, text, graphics, film, audio, and audio-visual works; derivative works may be made from such Content, and such Content may be altered. These are standard industry uses of Content and it is in our legitimate interests to process your Personal Data insofar as it is required to facilitate these business needs. To publish and share any of your Personal Data. Content may be made publicly available worldwide and may be transferred to countries with different data protection / privacy laws where it may be stored, accessed, and used, pursuant to the privacy policy of our customers. This is necessary given the international nature of our business. We may record certain biometric features of your Personal Data in the Content, such as the presence of freckles, hair colour, emotional state for the purposes of correctly labelling the Content. Your biometric information is not used to uniquely identify you and is used as Content Labels. To the extent we record such information, provided that such information is not Special Category Personal Data, we rely on legitimate interests.
Where you have manifestly made certain Special Category Personal Data public:	In these circumstances we may process Special Category Personal Data, which may include descriptive text and keywords associated with the Content related to your gender and/or ethnicity.

IMPORTANT: Providing your consent for us to process your Personal Data consisting of Special Category Personal Data is entirely voluntary and it is for you to freely decide to give it. You have a right to withdraw your consent at any time to the processing of your Personal Data which is comprised of Special Category Personal Data.

5. DISCLOSURE OF YOUR PERSONAL DATA

With whom is your Personal Data Shared?

Wavebreak will share your Personal Data where necessary with the entities and organisations mentioned below (the "Recipients"), to the extent strictly necessary:

Recipient Category	Details
Wavebreak customers, assignees and licensees	Wavebreak may provide your Personal Data as necessary to its customers, assignees and licensees. For example, a customer may require an image of an Asian woman holding flowers, and certain of your Personal Data such as your gender and ethnicity may be attached to the Content containing your image as metadata. Customers may also require your contact details to fulfil data protection requirements for example.
Third Party Service Providers	Adobe Shutterstock Envato Storyblocks Istock Freepik Pond5 Deposit Photos Visual China Group 123rf Dreamstime 4by4 Tongro Alamy Pixta Profimedia Motion Elements Creative Market Zoonar MostPhotos ImagineChina DPA Germany Imago Top Photo Group PlainPicture Amana Mauritiuss Media Bakery Agefotostock Aflo Big Stock Gaopin Images Image DJ Panthermedia Purestock Solid Stock Art Creatigo SuperStock
Third Party Advisors / Professionals	External advisors e.g. lawyers, accountants and auditors (as necessary to protect our legitimate and legal interests).
Prospective Buyers	Prospective buyers of business assets (to facilitate the acquisition of Wavebreak or a substantial portion of our assets by a third party).
Legal/ Regulatory Bodies	Regulatory authorities and law enforcement agencies (where we are under a duty to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request) such as the Revenue Commissioners, Department of Social Protection, the Data Protection Commission, Workplace Relations Commission, the Irish courts, An Garda Síochána.

6. TRANSFER OF PERSONAL DATA

We may transfer your Personal Data outside the European Economic Area ("EEA") to Recipients and when we do, we ensure that only the minimum amount of personal data necessary are transferred.

Where your Personal Data are transferred outside the EEA, it is our policy that that each transfer is subject to: (i) appropriate safeguards that are contractual, technical and/ or organisational in nature; and (ii) an appropriate transfer mechanism including:

• When the third country is deemed adequate by the European Commission (e.g. the UK) or
• Module 1 (controller-to-controller) or Module 2 (controller-to-processor) of the European Commission's standard contractual clauses or
• Other transfer mechanisms (e.g. binding corporate rules, EU-US data privacy framework or derogations under Article 49 of the GDPR).

Wavebreak Media as controller can be contacted at privacy@wavebreakmedia.com for further information on such transfers.

7. HOW LONG WE KEEP YOUR PERSONAL DATA FOR

Wavebreak Media will keep your Personal Data for as long as is necessary to meet the purposes set out in this Notice and in accordance with the Wavebreak Media data retention policy. In each case, Wavebreak Media will not keep your Personal Data for any longer than is necessary in accordance with applicable law.

8. YOUR RIGHTS

This subsection sets out the rights which you have to address any concerns or queries with us about our processing of your Personal Data:

• Right to Withdraw your Consent: Where applicable can withdraw your consent to Wavebreak Media using your Personal Data at any time. Note that if you withdraw your consent, Wavebreak Media' use of your Personal Data with your consent up to that point will be lawful.
• Right to be Informed: You have the right to know whether your Personal Data are being processed by Wavebreak Media, how Wavebreak Media use your Personal Data and your rights in relation to your Personal Data. Wavebreak Media complies with this by way of this Notice.
• Right of Access: You have the right to know the types of your Personal Data Wavebreak Media holds about you and to a copy of your Personal Data.
• Right to Erasure: in certain circumstances, you may request that Wavebreak Media deletes your Personal Data that it holds about you.
• Right to Portability: You may request Wavebreak Media to provide you with your Personal Data in a structured, commonly used and machine-readable format and you may request Wavebreak Media to transmit your Personal Data directly to another controller where this is technically feasible.
• Right to Rectification: You have the right to request that Wavebreak Media amends your Personal Data if it is inaccurate.
• Right to Restriction: You have the right to request that Wavebreak Media stops using your Personal Data in certain circumstances including if you believe that Wavebreak Media' use of your Personal Data is unlawful. If you validly exercise this right, we will store your Personal Data and will not carry out any other processing until the issue is resolved.

You can exercise any of these rights by submitting a request to the privacy@wavebreakmedia.com. We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within one month of receiving your request. We may extend this by up to 2 months if necessary, however we will inform you if this arises.

You have the right to lodge a complaint with the Data Protection Commission with regards to us processing your Personal Data.

9. CHANGES TO THIS NOTICE

We may amend this Notice from time to time, in whole or part, at our sole discretion. This Notice is not contractual in nature. Any changes to this Notice will be effective immediately upon sending the revised Notice to you. If at any time we decide to use your Personal Data in a manner significantly different from that stated in this Notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail, and you will have a choice as to whether or not we use your information in the new manner.

10. DATA PROTECTION OFFICER (DPO):

We have appointed a Data Protection Officer (DPO) to oversee and ensure our compliance with GDPR. If you have questions or concerns regarding our data processing practices, you can contact our DPO, at privacy@wavebreakmedia.com.

11. CROSS-BORDER TRANSFER

If Personal Data is transferred to other countries, Wavebreak Media has appropriate safeguards in place to protect it, ensuring an equivalent level of data protection.

12. CHILDREN

Wavebreak Media does not knowingly collect Personal Information from individuals under the age of 16 without verifiable consent from their legal representative.

13. CONTACT US

If you have questions or concerns about this Notice, or if you wish to exercise any of your rights as a data subject, please contact privacy@wavebreakmedia.com.

14. DEFINITIONS

1. "Artist" means the photographer/filmmaker who captures images/video/representations of the Model.
2. "Biometric Data" means personal data derived from the Content that represents (numerically, geometrically, or otherwise) a natural person's physical, physiological or behavioural features or characteristics.
3. "Content" means photographs, film, audio, or other recording, still or moving, or any other representation fixed in a tangible medium and/or taken of the models as part of a shoot and all associated parts including any descriptive text, keywords or other metadata including algorithmic and/or mathematical representations of same.
4. "Content Labels" means Personal Data and Special Category Personal Data which we collect and process about you for the purposes of appropriately labelling the Content but which do not uniquely identify you.
5. "Model" means the person who is the subject of the Content.
6. "Personal Data" means personal data as defined in the General Data Protection Regulation ("GDPR") which, for the purposes of this Privacy Notice, may include the data listed in section 2 above.
7. "Special Category Personal Data" means Personal Data relating to you which includes your racial or ethnic origin, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.