PROPERTY PRIVACY NOTICE

This Property Privacy Notice applies when Wavebreak Media (PTY) Ltd, Wavebreak Media Ltd., or a production partner acting for us collects information from or about a property owner, occupier, employee, agent, location representative or other authorised signatory in connection with scouting, booking, photographing, filming, recording, licensing or otherwise using a property or location.

It is intended to be read together with the property release, location agreement, booking confirmation and any project-specific terms. This notice explains privacy and data-handling practices; it does not replace, vary or expand the permissions granted in a signed release or agreement. If there is a conflict about permitted use of production content, the signed release and applicable project or licence terms govern.

Property information is not always personal information. However, an address, contact detail, signature, ownership record, photograph or other property-related information may be personal information when it identifies or can reasonably be linked to a natural person. We handle that information under applicable data-protection law, including South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) and the EU General Data Protection Regulation (GDPR), each where applicable.

Wavebreak Media (PTY) Ltd (Company Registration No. K2012/116289/07) is Wavebreak Media's South African production company. Wavebreak Media Ltd. is its Irish parent company, involved in international licensing and related activities. For any particular activity, the company that determines why and how personal information is processed is the responsible party under POPIA or controller under the GDPR, where applicable. Both companies may be involved in a production or subsequent licensing, but their responsibilities depend on their actual roles.

Other Wavebreak Media group companies, commissioning clients, photographers, filmmakers, production companies, stock-media distributors or dataset customers may also act as independent responsible parties or controllers for their own processing. The full postal addresses for both Wavebreak Media companies and their shared privacy contact details are in section 14.

• Identity and contact information, such as your name, signature, email address, telephone number and preferred contact method.
• Authority and ownership information, such as whether you are an individual owner, corporate owner, occupier, employee, agent or authorised representative; your title or position; company name; and evidence reasonably required to verify your authority.
• Property information, such as the address, city, country, property description, access instructions, availability, restrictions, ownership or occupancy details, photographs used for scouting or identification, and a visual reference attached to a release.
• Booking and payment information, such as negotiated fees, invoices, banking or tax information, payment status and related accounting records.
• Production and safety information, such as parking, access, household or site rules, known hazards, animals, accessibility requirements, emergency contacts, security arrangements and information needed to protect people, equipment and the property.
• Communications and records, including emails, messages, call notes, approvals, complaints, change requests and records showing how consent, authority and usage rights were obtained.
• Production content and metadata, including photographs, video, audio, scans, location references, captions, keywords, annotations, technical data, shoot dates and asset or release identifiers that depict or relate to the property.

Please do not provide personal information about another person unless you are authorised to do so and the information is reasonably necessary for the production. Please alert us before sharing sensitive information, security codes, identity documents or information about children. Providing initial location and contact information is generally voluntary. However, without sufficient details about the location, your authority and how to contact you, we may be unable to assess a proposed shoot or enter into an agreement. Payment, tax or other records may be required under an agreed contract or applicable law; we will explain any specific requirement where relevant.

We may obtain information:

• directly from you when you submit a property, communicate with us, negotiate a booking, sign a release or agreement, provide an invoice or host a production;
• from a location scout, agent, property manager, landlord, tenant, employee, photographer, filmmaker, production partner or other person involved in the booking;
• from our clients, group companies, stock-media distributors, licensing partners and service providers where relevant to a production or rights review;
• from publicly available sources, such as property or business websites, directories, maps, public registers, social media or advertising listings; and
• from the content and records created during scouting, production, post-production, licensing and dataset preparation.

5.1 Location sourcing, booking and production

We use information to identify and assess locations, verify ownership or authority, discuss suitability and restrictions, arrange access, manage schedules and logistics, protect health and safety, obtain permissions, pay agreed fees, manage the shoot and maintain production records.

5.2 Rights, releases and licensing records

We use information to document who authorised the production and the permitted use of content; match releases to assets; respond to legal, rights-management and audit enquiries; prevent misuse; and establish, exercise or defend legal claims. A release may be retained and shared with relevant licensees or advisers even when the signatory's contact details are not made public.

5.3 Stock-media use

Where permitted by the signed release and applicable agreements, content depicting the property may be edited, combined with other material, distributed, displayed, marketed, licensed and sublicensed for commercial, editorial, promotional or other authorised stock-media uses. The property owner's or representative's personal contact details are not ordinarily displayed with the licensed content.

5.4 Dataset and artificial-intelligence use

Wavebreak Media produces and licenses content depicting properties for stock-media and AI or machine-learning purposes. Subject to the signed Property Release and applicable law, photographs, video and associated metadata may be selected, curated, copied, formatted, classified, labelled, annotated, cropped, transformed, quality-checked, combined with other material and supplied as part of a dataset to customers, platforms, distributors and their permitted sublicensees worldwide. Uses may include training, fine-tuning, testing, validation, evaluation, benchmarking, enrichment, retrieval, computer vision, generative AI and other AI or machine-learning workflows, and commercial research or product development.

Wavebreak Media's intended licensing model allows content to be licensed to multiple customers and permitted sublicensees, used repeatedly, and incorporated into technologies now known or developed in the future. AI systems trained on content may generate new or synthetic images, video or other outputs. The rights that may actually be exercised remain subject to the signed Property Release, any specific written restrictions agreed with Wavebreak Media, applicable law and relevant downstream licences. This notice provides clear information about these intended uses; it does not itself amend or extend a signed release.

Where content has already been lawfully licensed, delivered, incorporated into a dataset, used in a model-development workflow or used to train or evaluate a system, it may not be technically or commercially possible to retrieve every copy, reverse completed processing or remove the influence of the content from an existing model. We will nevertheless consider valid privacy and contractual requests and take reasonable steps required by applicable law and the relevant agreements.

5.5 Administration, security and compliance

We may process information for accounting, tax, insurance, recordkeeping, fraud prevention, information security, quality assurance, complaint handling, regulatory compliance and the enforcement or defence of rights.

We process personal information for specific purposes on the lawful grounds applicable to each activity. For location enquiries and sourcing, we generally rely on legitimate interests in assessing locations, communicating with representatives and planning productions, or on steps requested by an individual before entering into a contract. For bookings, payments and verification of authority, we rely, where applicable, on contract performance, legal obligations or legitimate interests in administering productions. We retain signed releases, asset-to-release links and licensing records for legitimate interests in proving and protecting continuing commercial rights, handling rights enquiries and establishing, exercising or defending claims, and to comply with applicable legal duties. Where production content itself contains personal information, the appropriate lawful basis depends on the content and the processing; identifiable people appearing on camera are handled under the applicable model-release and privacy process. We rely on consent where specifically sought for a processing activity. Consent-based processing can be withdrawn for the future without changing the lawfulness of earlier processing, and statutory privacy rights continue to apply alongside contractual rights.

We may disclose relevant information to:

• Wavebreak Media group companies and authorised staff;
• photographers, filmmakers, producers, location scouts, crew, freelancers and production service providers;
• commissioning clients, stock-media distributors, licensing platforms, dataset customers and their authorised affiliates, contractors or sublicensees, to the extent permitted by the relevant agreements;
• hosting, storage, transfer, annotation, metadata, accounting, payment, communication, security and technology providers acting for us;
• insurers, auditors, lawyers and other professional advisers;
• regulators, courts, law-enforcement bodies or other recipients where disclosure is required or permitted by law; and
• a buyer, successor or adviser involved in a proposed or completed corporate transaction, subject to appropriate safeguards.

We do not ordinarily publish the property owner's or representative's signature, telephone number, email address, banking details or identity-document information with the content. Release information may, however, be disclosed confidentially where reasonably required to verify rights, administer licensing, resolve a dispute or comply with law.

Wavebreak Media operates internationally and licenses content and datasets to customers and platforms worldwide. Personal information, production content and rights records may be accessed, stored or processed in South Africa, Ireland and other countries where our partners and service providers operate. Privacy laws and levels of protection differ between countries. Where POPIA or the GDPR applies, we will use an applicable lawful basis or safeguard for cross-border transfers of personal information, such as adequate protection, appropriate contractual safeguards or another legally permitted mechanism. For GDPR-regulated transfers to countries without a relevant adequacy decision, appropriate safeguards may include European Commission standard contractual clauses where applicable. You may contact us using section 14 to ask about the safeguards applicable to a particular transfer.

We use reasonable technical and organisational measures designed to protect personal information and rights records against loss, unauthorised access, misuse, alteration or disclosure. Access is limited according to role and business need. No system or transmission can be guaranteed completely secure.

Before and during production, property owners and representatives should identify areas or items that must not be captured. Where reasonably practicable and consistent with the agreed brief, the production should exclude or obscure unnecessary house numbers, access codes, alarm details, keys, personal documents, family photographs, vehicle registrations, computer screens, medical information, financial information and other private or security-sensitive material. Architectural, decorative or location features required by the production may remain recognisable.

Permission from a property owner does not necessarily clear third-party rights in artwork, designs, trademarks, copyrighted material, private documents or items belonging to an occupier or another person. Such items should be identified before the shoot so that they can be removed, covered, excluded or separately cleared where necessary.

We retain personal information only for as long as reasonably necessary for the purposes described in this notice, subject to legal, tax, accounting, contractual, insurance, rights-management, audit and dispute-resolution requirements. Contact and unsuccessful scouting information may be retained for a limited business period unless there is a continuing relationship or legal reason to keep it.

Executed releases, location agreements, payment records, asset-to-release links and evidence of permissions may be retained for the life of the relevant content, licence or dataset and for an appropriate period afterwards because they establish continuing rights and obligations. Licensed content, archived master files, delivered datasets and records required to verify provenance may also be retained for long periods or indefinitely where permitted by the governing agreements and applicable law. When information is no longer required, we take reasonable steps to delete, destroy or de-identify it.

Subject to applicable law and relevant exceptions, you may ask us to:

• confirm whether we hold personal information about you and provide access to it;
• correct or update inaccurate, incomplete, misleading or outdated personal information;
• delete or destroy personal information that we are no longer authorised to retain;
• object to certain processing, request that processing be restricted, or request data portability where applicable law provides those rights;
• explain the source, purpose or recipients of your personal information where the law requires this; and
• withdraw consent for future consent-based processing.

These privacy rights relate to personal information and do not automatically cancel a property release, reverse a completed licence, require removal of lawfully licensed content, or extinguish rights granted under contract. Requests concerning the use or withdrawal of property content will be assessed under the signed release, applicable licence terms and the law. We may need to verify your identity and authority before acting on a request.

You may lodge a privacy complaint with the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za or https://inforegulator.org.za/complaints/. Where the GDPR applies, you may complain to the Irish Data Protection Commission at https://www.dataprotection.ie/en/contact/how-contact-us or another competent supervisory authority. You do not need to contact us first, although we welcome the opportunity to resolve concerns.

A property release covers the property rights and authority described in that document; it does not replace a model release or other lawful permission for an identifiable person appearing in the content. If children or other people will be recorded at the property, the production must follow the applicable model-release and privacy process. We do not intentionally collect children's personal information through a property booking unless it is necessary, authorised and handled in accordance with applicable law.

We may update this notice to reflect changes in law, technology, production practices or our services. The current version will be published on our website with its last-updated date. Material changes will apply prospectively unless the law or a separate agreement permits otherwise. An updated privacy notice does not retrospectively expand the usage rights in an existing release.

For questions, privacy requests or concerns relating to a property production, contact the relevant company using the shared email addresses below:

Wavebreak Media (PTY) Ltd (South Africa)
Company Registration No. K2012/116289/07
115 Roeland Street
Gardens
Cape Town
South Africa
8001

Wavebreak Media Ltd. (Ireland)
Unit 3, Westpoint Business Centre
Westpoint Business Park
Ballincollig, Co. Cork, P31 KV67
Ireland

Privacy enquiries (both companies): privacy@wavebreakmedia.com
General enquiries (both companies): info@wavebreakmedia.com

Please include the property address or description, shoot date, production reference and your relationship to the property where available. Do not send identity documents by ordinary email unless we request them through an appropriate process.

Content: photographs, video, audio, scans, graphics, metadata, captions, annotations, edits, derivatives and other material created from or in connection with a production.

Dataset: an organised collection of content, data or metadata prepared or supplied for analysis, research, development, training, fine-tuning, testing, validation, evaluation, benchmarking, enrichment, retrieval or related purposes.

Personal information: information relating to an identifiable natural person and, where applicable under POPIA, an identifiable existing juristic person.

Processing: any operation involving information, including collecting, recording, organising, storing, using, altering, sharing, transferring, retrieving, deleting or destroying it.

Property: the real or personal property, interior, exterior, location, controlled asset or intellectual property identified in the applicable property release or agreement.

Property representative: an owner, occupier, employee, agent or other person who represents that they have authority to provide information, arrange access or sign a release or agreement concerning the property.

Release: the signed property release or other written agreement that records permissions relating to the creation and use of content depicting the property.

Wavebreak Media: Wavebreak Media (PTY) Ltd and Wavebreak Media Ltd., together with any relevant group company involved in the production, licensing or personal-information processing.