BACKGROUND:
We respect the privacy of our Subscribers, Guest Users and of other individuals who visit and/ or use our web based platform, imagerelease.uk and/ or who use our mobile application (together referred to in this Privacy Notice as Our Platform) and any of our products or services that link to this Privacy Notice (the Services). ImageRelease Ltd (we /us / our) will only collect and use personal data in ways that are described in this Privacy Notice, and that are consistent with our obligations and your rights under the Data Protection Legislation. By using Our Platform and/ or the Services, you understand that we will collect and use your personal information as described in this Privacy Notice.
Our Platform and core Services enable our Subscribers to create, arrange execution of, manage and store image releases and related documentation via Our Platform. Some of these Services are also available to Guest Users. In order to carry out these Services, we collect necessary information such as the names, contact details and electronic signatures of those individuals who execute those documents on behalf of our Subscribers. In this capacity, we act as a data processor, and the relevant Subscriber is the data controller. For further information on our data processing activities, see Section 9 below and our Data Processing Addendum.
Our Platform also keeps a Rights Ledger through our image protection service, IR Protect. Images covered by a release, licence, agreement or registration are recorded in the Rights Ledger with a digital fingerprint, so that anyone can check an image against it: on the Verify page of Our Platform, or from their own systems through our Rights Check API. Subscribers can also register the images uploaded to their own websites through a Site Integration, such as the imageRelease package for Umbraco. Sections 8 to 11 explain what personal data this involves.
1. Definitions and Interpretation
In this Privacy Notice, the following terms shall have the following meanings:
Subscriber: | means an individual or business who has taken out a paid subscription to access digital services for the creation, execution, management and storage of image releases and related documentation via Our Platform, in accordance with our Terms & Conditions (Paid Subscribers); |
Guest User: | means an individual or business who has signed up to access certain features of Our Platform in accordance with our Guest User Terms & Conditions; |
Rights Ledger: | means the record, kept by our IR Protect service, of images registered through Our Platform, each with its digital fingerprint and the rights recorded for it; |
Rights Check API: | means the interface through which a Subscriber's own systems check images against the Rights Ledger and register images in it, using a key we issue to that Subscriber; |
Site Integration: | means software we provide that connects a Subscriber's website to the Rights Check API, such as the imageRelease package for the Umbraco content management system; and |
Data Protection Legislation: | means all applicable data protection and privacy legislation in force from time to time in the UK including the UK GDPR; the Data Protection Act 2018 (DPA 2018) (and regulations made thereunder); the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including the privacy of electronic communications). |
2. Information about us
ImageRelease Ltd is a limited company incorporated in England & Wales with company number 16166644, whose registered office address is at 1 Fisher Lane, Bingham, Nottingham, England, NG13 8BQ.
If you have any questions relating to your personal data or this Privacy Notice, you may contact us at help@imagerelease.uk.
3. Third party links
Our Platform may include links to third-party websites. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for the way in which they handle personal data. We encourage you to read the privacy policy or privacy notice of every website you visit.
4. Your personal data
Personal data is any information about an individual that enables them to be identified. Personal data covers your name and contact details, but also information such as electronic location data and other online identifiers. It does not include data where your identity has been removed (anonymous data).
It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please let us know.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide that data when requested (for example complete information needed for us to arrange delivery of the Services to you), we may not be able to perform that contract. In this case, we may have to cancel a contract you have with us. We will notify you if this is the case.
5. Personal data relating to children
Please note that Our Platform is not intended for children, and we do not knowingly collect personal data relating to children in our capacity as data controller.
However, we may process children's personal data on behalf of a Subscriber or Guest User when such data is submitted through an authorised adult in connection with a model release. This processing is carried out with appropriate safeguards and parental/guardian consent in accordance with data protection laws.
6. Your rights in relation to your personal data
Under the Data Protection Legislation, you have the following rights. More information on how to exercise these rights follows later in this Privacy Notice.
The right to be informed about our collection and use of your personal data.
The right to access your personal data.
The right to rectify your personal data if any of it is inaccurate or incomplete.
The right to request deletion of your personal data(subject to certain legal requirements) or to withdraw consent to us using it.
The right to prevent processing of your personal data.
The right to restrict the use of your personal data for particular purposes.
The right of portability, enabling you to ask for a copy of your personal data to re-use with another business.
Rights relating to automated decision-making and profiling. We do not however use your personal data in this way.
The right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk if you believe your privacy or data protection rights have been breached. We would always appreciate an opportunity to work with you to resolve any issues or complaints you may have before you approach the ICO.
For more information about our use of your personal data or exercising your rights set out above, please contact us at help@imagerelease.uk.
7. When we collect personal data
Depending upon whether you are simply browsing Our Platform, are a Subscriber or Guest User, or are signing a release or other document via Our Platform at the request of a Subscriber or Guest User, we may collect and hold some or all of the personal data set out below.
You provide us with personal data about yourself when you:
Register on Our Platform as a Subscriber or Guest User
Create, review or sign an electronic document via Our Platform
Add or edit the information in your user account as a Subscriber or Guest User
Contact customer support
Sign up for newsletters or other marketing emails
Write a review or provide feedback on Our Platform or Services
Check an image on the Verify page of Our Platform, by uploading it or pasting a link to it
Upload an image to a Subscriber's website that uses one of our Site Integrations (the Subscriber is responsible for that website; see Section 9)
You may also provide us with personal data about other individuals when you use parts of our Services, for example when you:
Create, share or arrange signature by others of an electronic document via Our Platform
Attach images of signatories, for example when arranging the execution of a model release via Our Platform
Invite individuals to create a Guest User account on the Platform
Refer other individuals to Our Platform
Add other individual users to your Subscriber account, in accordance with our Terms & Conditions (Paid Subscribers).
Some of the information referred to in Sections 7 and 8 is collected using cookies, which are text files containing small amounts of information that are downloaded on your device. Please also see our Cookie Policy on Our Platform regarding our use of cookies and similar technologies.
8. Types of personal data we collect
We may collect the following types of personal data:
Identifiers and Contact Information: This may include your name, email address, postal address, telephone number and other similar contact details, for example when you create a Subscriber or Guest User account, contact us through Our Platform, or by email. Our Subscribers or Guest Users may also give us your personal data, for example if they want you to sign an image release via Our Platform they will give us your name and email address.
Biographical Information: We collect the date of birth of any models who sign a model release created, shared and signed via Our Platform.
Account Information: If you create a Subscriber or Guest User account on Our Platform, we will collect information associated with your account, such as your username, password, and profile details. If you are Subscriber, We will also collect the names and email addresses of any authorised users who are authorised to use your Subscriber account in accordance with our Terms & Conditions (Paid Subscribers).
Images: When an image release is signed via Our Platform, we do not store the images to which that release relates. However, Subscribers and Guest Users have the option of storing a photograph of the model who has signed a model image release on the Platform, with the model’s consent, for identification purposes. We may also store a low resolution version of any images included by Subscribers’ in their image rights requests submitted via Our Platform. We act as a data processor in relation to these stored images.
Rights Ledger records: When an image is registered in the Rights Ledger (for example when an image rights request is approved, a media licence is sent, photography deliverables are uploaded, or a Subscriber's website registers an image through the Rights Check API), IR Protect keeps a digital fingerprint of the image (a short code calculated from its pixels, from which the image cannot be recreated), a small thumbnail, a larger copy (1600 pixels on its long edge, with embedded details such as location removed) that helps us improve how images are matched, the rights recorded for it, the name of the image file, and encrypted references to the Subscriber and the document it came from. Images delivered under a photography agreement are also stored for the download period the Subscriber has chosen. When the recipient of a media licence accepts it, or the client of a photography agreement has signed it and the photographs are delivered, the ledger also records that acceptance: the email address it was sent to (encrypted), their account if they have one, and the date. This lets their own checks show the licence as theirs. If the person who accepted asks us to erase their details, we remove their email address and any account link from the acceptance; the record that the licence was accepted stays, as the licensee's evidence. We act as a data processor for these records.
Site Integration records: When a Subscriber's website registers an image through a Site Integration, we record where the image came from (for example a member upload, an editor or a news feed), what its uploader declared about their rights (for example that they own it or have the owner's permission, that they were given it to promote an event, or that they aren't sure), or what the Subscriber said itself, recorded as whichever it is; anything said about who holds the rights or where the image came from; when the image was used; any credit; and a reference the Subscriber chooses for the uploader, such as a member number. We do not accept uploaders' names or email addresses: the Subscriber alone knows who a reference belongs to. If an answer changes, the earlier one is kept as history. We act as a data processor for these records.
Images you check: When you check an image, on the Verify page or through the Rights Check API, we compare it with the Rights Ledger and then discard it. If you paste a link, we fetch the image from that link once, check it and discard it; we record only the website's name and the outcome, not the full link.
Review copies of borderline matches: If an image you check matches a registered image only weakly, we may keep a small copy of it (512 pixels across) so that a member of our team can compare the two by eye and confirm whether it really was a match. This helps us avoid telling anyone that an image belongs to someone else when it does not. The copy is not linked to you or your organisation, is seen only by our administrators, and is deleted as soon as it has been reviewed, and in any case within 90 days.
Check records and reports of wrong matches: When you check an image, we keep a record of the check for 90 days: its digital fingerprints (short codes calculated from the image, from which it cannot be recreated), what it matched, and who made the check (your account, or the Subscriber whose systems made it). We do not keep the image, your IP address or the file name with it. This lets us explain a match if it is questioned. If you tell us that a match is wrong, we keep your report, including any reason you give and the link to your image if you give one (we look at the image at that address when we review the report, and do not keep a copy), so that our team can review it and improve our matching; the owner of the matched image is not told. Reports are kept for up to two years.
Rights Check API records: When a Subscriber's systems use the Rights Check API, we log each call: the time, the key used, the Subscriber, the type of request, its outcome and the calling IP address. We use these records to keep the service secure, apply usage limits and help with support.
Transaction Information: If you purchase a paid subscription from us, or any other associated products or Services, we will collect information regarding the subscriptions and any related products or Services you have purchased. However, please note that we do not collect payment information such as full credit card details, as this function is carried out by our third-party payment processor.
Release Information: We may collect the IP addresses and actions that individuals take (such as creating, reviewing and signing releases) via Our Platform, as well as information about those individuals’ devices.
Communication Data: This includes any correspondence or communication between you and us, including customer support enquiries and interactions, reviews and feedback, submitted via email, telephone, any online forms or chat function on Our Platform.
Usage Information: We automatically collect information about your usage of Our Platform, including pages visited, time spent on Our Platform and on particular pages, clickstream data, and referring URL, the dates and times and how frequently you used Our Platform and/ or Services, error logs. We use analytics software to collect this data and to help us analyse the performance of Our Platform and user preferences.
Technical Information: We may collect technical information about your device and browser, using analytics software, including your IP address, unique device identifiers, browser type and version, device type and operating system.
Social Media Data: If you interact with our social media channels or use social media features integrated into Our Platform, we may collect information from your social media profiles, such as your social media handles and activities.
Cookies and Tracking Technologies: We may use cookies and similar tracking technologies to collect information about your browsing behavior and preferences using analytics and advertising cookies. For more details, please see our Cookie Policy.
Marketing Data: We may collect information about your interests and preferences based on your use of Our Platform as well as other websites, your preferences as regards receiving marketing communications from us, and the types of Services you may be interested in.
Sensitive or special category data: We do not collect any ‘special category’ or ‘sensitive’ personal data in relation to our Subscribers or Guest Users, or data relating to criminal convictions and/or offences. If you sign a model release via Our Platform, you may be given the option to share with the Subscriber that created that release, and us as their data processor, certain sensitive or special category data, for example relating to your ethnicity, gender, sexual orientation or any disability. The purpose of collecting this information is so that our Subscribers can ensure authentic and diverse representation across their commercial photography which reflects our society, and so you can be contacted (if you consent to this) in relation to future opportunities that may be of interest to you. We will only collect and process this information on the Subscriber’s behalf with your explicit consent and in accordance with the safeguards set out in the Data Protection Legislation.
Other Information: We may collect additional information not specifically mentioned here with your consent or as required by applicable laws and regulations.
Please note that the exact information collected will vary depending on your interactions with Our Platform and the Services we offer. We only collect information that is necessary for the purposes outlined in this Privacy Notice and as permitted by Data Protection Law.
9. Personal data we collect and process on behalf of Subscribers
We process and store personal information on Subscribers’ behalf as a data processor (not a controller). For example, when a Subscriber creates and shares an image release for review and signature, we process and store that release on the Subscriber’s behalf and according to their instructions. The Subscriber acts as the data controller and is primarily responsible for your personal data. For certain features of Our Platform, we may act as both processor and controller (e.g. retaining transaction records to meet our legal obligations). Please see our Data Processing Addendum for more information on how we process personal data on behalf of Subscribers.
The same applies when a Subscriber registers images in the Rights Ledger, including through a Site Integration on its own website: the Subscriber is the controller and decides what is registered, and we act as its processor. If you uploaded an image to a website that uses one of our Site Integrations, that website's operator is the right contact about it; we will revoke or erase the registration on its instruction.
We act as a controller for the Rights Check API records, the check records and reports of wrong matches and the review copies described in Section 8, and for the security of the Rights Ledger.
If you have questions about how your personal data is collected, stored, used and processed in these cases where we are processing your personal data on behalf of a Subscriber, including exercising your data subject rights, please contact the relevant Subscriber or the person requesting your signature of the image release. We will forward any rights requests we receive to the appropriate Subscriber where we act as a data processor.
10. How we use personal data
Under the Data Protection Legislation, we must always have a lawful basis for using personal data. The lawful basis will depend on the type of personal data concerned and the context in which we collect, store, use or process it.
We will use your personal data in the following circumstances:
To perform a contract with you.
To provide, maintain and improve Our Platform and the Services.
Where it is necessary for our legitimate interests (or those of a third party), for example:
To develop our business
To develop new Services
To protect the security or integrity of our IT systems
To manage our relationship with you as our client
To administer our business
To administer or improve Our Platform
To maintain records for legal and regulatory compliance
To maintain or defend legal claims
To operate the Rights Ledger: to let people check whether an image is registered and on what terms, to keep the Rights Check API secure and within its usage limits, and to make sure that matches are accurate
Note that we will only rely on our legitimate interests to use your personal data if your interests and rights do not override those legitimate interests.
Where we need to comply with a legal or regulatory obligation.
Where you have consented to us using or processing your personal data (for example by consenting to receiving direct marketing communications from us). You have the right to withdraw consent at any time by contacting us.
With your permission and/or where permitted by law, to market Our Platform and/ or the Services to you. You will not be sent any unlawful marketing or spam, and you will always have the opportunity to opt-out of marketing communications at any time.
We do not carry out automated decision making or any type of automated profiling.
We will only use your personal data for the purposes for which it was originally collected unless we reasonably believe that another purpose is compatible with those original purposes and we need to use your personal data for that purpose.
If we need to use your personal data for an unrelated or incompatible purpose to that for which it was originally collected, we will inform you and explain the legal basis which allows us to do so.
In some circumstances, where permitted or required by law, we may process your personal data without your knowledge or consent. This will only be done within the bounds of the Data Protection Legislation and your legal rights.
We may aggregate personal data, generate general insights from Service usage, or de-identify data to remove identifying elements. We then use this for aggregated and/ or anonymised data for marketing, research and product development. Where information has been aggregated or anonymised in this way, it no longer constitutes personal data under the Data Protection Legislation, and this Notice does not apply to it.
In situations where we act as a processor rather than controller, it is the relevant Subscriber who determines the appropriate legal basis associated with processing activities. Any questions about the applicable lawful basis should be directed to them.
11. Keeping your personal data
We will only process and store your personal data for as long as is necessary taking into account the reasons for which it was first collected.
When deciding what the correct time is to keep the data for, we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means, and any legal and regulatory requirements.
We may keep your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation arising out of our relationship.
The law requires us to keep basic information about our Subscribers (including identity, contact and payment information as well as information on the contracts we enter into with our Subscribers) for tax purposes, for six years after they stop being Subscribers.
In circumstances where we have anonymised your personal data for research or statistical purposes, we may use this information indefinitely without further notice to you.
For the Rights Ledger and the Rights Check API:
images you check are discarded straight after the check (and any review copy, see Section 8, within 90 days);
Rights Check API call records are deleted automatically after 180 days;
records of checks are deleted after 90 days, and reports of wrong matches after two years;
larger copies of registered images are kept for up to 2 years, then deleted;
Rights Ledger records are kept for as long as the rights they record are relevant, until the Subscriber revokes them, or until we erase them on the Subscriber's instruction or when an account is closed.
12. Storing your personal data
The security of your personal data is essential to us.
To protect your personal data, we have put in place appropriate technical and organisational measures, including the following:
personal data entered by you on Our Platform is secured by SSL (secure socket layer) technology in transit and at rest to improve security. SSL secures connections, prevents hackers from impersonating Our Platform or stealing information that Subscribers, Guest Users or other website visitors submit.
the payment processor integration on Our Platform, provided by Stripe, is compliant with PCI-DSS. Sensitive card data is never handled by us. It goes directly to the payment processor’s servers and we do not have access to this information.
we store personal data securely, including putting in place access controls, physical security, and secure backup procedures.
we collect only the minimum amount of personal data necessary for the purposes described in Sections 8 to 10 of this Notice.
access to your personal data is limited to those employees, agents, contractors, and other third parties with a legitimate need to know and they are subject to duties of confidentiality.
we conduct regular data security audits to identify and address any vulnerabilities.
we keep our software, systems, and applications up-to-date with security patches and updates to address known vulnerabilities
we have in place procedures for dealing with data breaches. These include notifying you, acting quickly to identify and limit the breach and any consequences of the breach and/or notifying the relevant authorities where we are legally required to do so.
However, please note that although we take appropriate steps to protect your personal data, no website or transmission of data, computer system or wireless connection is completely secure and so we cannot guarantee the security of that personal data.
13. Transferring and sharing your personal data
We may use external third parties to provide systems, technology or support which involves them processing your personal data on our behalf. For example, we use:
Sendinblue SAS, trading as Brevo, to provide our client relationship management platform, including to create, manage and send marketing emails to Subscribers, Guest Users and other people who have previously used our Services and/ or have opted to receive them. Please see Sendinblue SAS, trading as Brevo’s Privacy Policy and Data Processing Agreement which set out how it processes and protects personal data.
Stripe Inc. to administer our payment processes. When you purchase a Subscription or related products or services from us via Our Platform, the payment information that you provide is encrypted and transmitted directly to Stripe, according to which payment method you select. We do not store your payment information. The information you input is processed by Stripe in accordance with Stripe's Data Processing Addendum.
OVH Groupe SA, to host Our Platform and store the images we process on behalf of Subscribers, for example photographs of models which are attached to model image releases, on dedicated servers in the United Kingdom. Please see OVHcloud's personal data protection page for more information.
Hetzner Online GmbH, to host our IR Protect service and its storage (the Rights Ledger, thumbnails and larger copies of registered images and photography deliverables, and any review copies) in the European Union (Finland). Please see Hetzner's privacy policy for more information.
Telnyx LLC, to send text messages with verification codes when a responsible signatory confirms a photography agreement. Please see Telnyx's Privacy Policy for more information.
Cloudflare, Inc. (Turnstile), to check that forms on Our Platform are used by people rather than automated programs. Please see Cloudflare's Privacy Policy for more information.
tawk.to, to provide live chat functionality for our Subscribers and platform users, including real time messaging, support requests and Knowledge Base functionality. Please see tawk.to's Privacy Policy for more information on how it stores and secures personal data.
AC PM LLC, trading as Postmark, to provide us with our transactional email platform. Please see AC PM LLC, trading as Postmark’s Data Processing Addendum for more information on how it stores and secures personal data on our behalf.
Some of these external third parties use physical or cloud storage which is based outside the United Kingdom. By providing any information, including personal data to us, you consent to such transfer, storage and processing. Third countries outside the EEA may not have data protection laws that are as strong as those in the UK. We use our best endeavours to select only external third parties that require the same levels of personal data protection that would apply under the Data Protection Legislation, and ensure these levels of protection are contained in the external third parties’ privacy policies and/ or data processing addenda.
In addition to the third party IT and systems providers referred to above, we may also:
share your personal data with other third parties if you specifically request this and have consented to it.
in exceptional circumstances, share personal data if we consider that there is a real risk of harm to you or to others.
on occasion, share your personal data with our professional advisers such as lawyers, bankers, auditors and insurers.
share your personal data with HM Revenue & Customs, regulators and other authorities based in the United Kingdom if they request this.
transfer your personal data to any new owner, if we sell, transfer, or merge parts of our business or assets. Any new owner of our business may continue to use your personal data in the same way(s) that we have used it, as specified in this Privacy Notice.
be legally required to share certain personal data, which might include yours, if:
we are involved in legal proceedings
we are complying with legal obligations, for example as regards safeguarding, terrorism, money laundering or drug trafficking
we are complying with a court order
we are complying with the instructions of a government or regulatory authority.
If any of your personal data is shared with a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.
14. Controlling and withholding your personal data
In addition to your rights under the Data Protection Legislation, set out in Section 6 above, when you submit personal data via Our Platform or in connection with our Services, you may be given options to restrict our use of your personal data. We aim to give you control over our use of your data for direct marketing purposes (including the ability to opt out of receiving marketing emails from us), which you may do by unsubscribing using the links provided.
You may access certain areas of Our Platform without providing any personal data. However, to use all features and functions available on Our Platform you may be required to submit or allow for the collection of certain data.
You may restrict our use of Cookies. For more information, see our Cookie Policy which is available on Our Platform.
15. Accessing your personal data
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it. This is known as a Subject Access Request.
All subject access requests should be made in writing and sent to the following email address: help@imagerelease.uk. Please include “Subject Access request” in the email subject field.
There is not normally any charge for a subject access request, unless your request is ‘manifestly unfounded or excessive’, in which case we may charge an administrative cost.
We will respond to your subject access request within one month of receiving it, unless your request is more complex, in which case more time may be required (up to a maximum of three months). We will keep you informed of our progress.
16. Our contact details
To contact us about anything to do with your personal data and data protection, please email us at help@imagerelease.uk.
17. Updates to this Privacy Notice
We may amend or update this Privacy Notice from time to time. A revised Privacy Notice will be uploaded on Our Platform and you will be deemed to have accepted its terms on your first use of Our Platform following the revisions. We recommend that you check this page regularly.
This Privacy Notice was last updated on 14 October 2026.