LEGAL

Privacy Policy

Privacy Policy

Privacy Policy

Last updated: July 28, 2026

Last updated: July 28, 2026

1. Introduction

1. Introduction

We respect your privacy and are committed to protecting it. This privacy policy ("Policy") explains what information we may collect from you, or that you may provide to us, through the [www.vesto3d.com] website ("Website") and any related products and services (together, the "Services"). It sets out how we collect, use, store, protect and disclose that information ("Personal Information"), the choices you have about our use of it, and how you can access and update it.


This Policy is a legally binding agreement between you ("User", "you", "your") and Vesto 3D, a company registered in Romania ("Vesto 3D", "we", "us", "our"). If you are entering into this agreement on behalf of a business or other legal entity, you confirm you have authority to bind that entity, and "you" refers to that entity. If you do not have that authority, or you do not agree with these terms, you must not accept this Policy and may not use the Website or Services.


By accessing and using the Website and Services, you confirm that you have read, understood and agree to be bound by this Policy. This Policy does not cover the practices of companies we do not own or control, or of individuals we do not employ or manage.


Vesto 3D provides 3D body scanning and virtual fitting products, services and technology. This Policy covers both our public marketing website and the Services we provide to our customers. Some sections apply only to the Website and others only to the Services, as indicated.

We respect your privacy and are committed to protecting it. This privacy policy (“Policy”) explains what information we may collect from you, or that you may provide to us, through the [www.vesto3d.com] website (“Website”) and any related products and services (together, the “Services”). It sets out how we collect, use, store, protect and disclose that information (“Personal Information”), the choices you have about our use of it, and how you can access and update it.


This Policy is a legally binding agreement between you (“User”, “you”, “your”) and Vesto 3D, a company registered in Romania (“Vesto 3D”, “we”, “us”, “our”). If you are entering into this agreement on behalf of a business or other legal entity, you confirm you have authority to bind that entity, and “you” refers to that entity. If you do not have that authority, or you do not agree with these terms, you must not accept this Policy and may not use the Website or Services.


By accessing and using the Website and Services, you confirm that you have read, understood and agree to be bound by this Policy. This Policy does not cover the practices of companies we do not own or control, or of individuals we do not employ or manage.


Vesto 3D provides 3D body scanning and virtual fitting products, services and technology. This Policy covers both our public marketing website and the Services we provide to our customers. Some sections apply only to the Website and others only to the Services, as indicated.

We respect your privacy and are committed to protecting it. This privacy policy (“Policy”) explains what information we may collect from you, or that you may provide to us, through the [www.vesto3d.com] website (“Website”) and any related products and services (together, the “Services”). It sets out how we collect, use, store, protect and disclose that information (“Personal Information”), the choices you have about our use of it, and how you can access and update it.


This Policy is a legally binding agreement between you (“User”, “you”, “your”) and Vesto 3D, a company registered in Romania (“Vesto 3D”, “we”, “us”, “our”). If you are entering into this agreement on behalf of a business or other legal entity, you confirm you have authority to bind that entity, and “you” refers to that entity. If you do not have that authority, or you do not agree with these terms, you must not accept this Policy and may not use the Website or Services.


By accessing and using the Website and Services, you confirm that you have read, understood and agree to be bound by this Policy. This Policy does not cover the practices of companies we do not own or control, or of individuals we do not employ or manage.


Vesto 3D provides 3D body scanning and virtual fitting products, services and technology. This Policy covers both our public marketing website and the Services we provide to our customers. Some sections apply only to the Website and others only to the Services, as indicated.

2. Our role: controller and processor

2. Our role: controller and processor

Vesto 3D works with businesses, researchers and other organisations (together, "Customers") that may require us to collect and process personal information on their behalf — for example, where a Customer uses our Services in its own business, or embeds our technology into its website or mobile app.


In those cases we follow the privacy instructions given to us by the Customer, and you should consult that Customer's own privacy policy to understand how it uses your information. In that arrangement the Customer is the "controller" of the personal information and Vesto 3D is the "processor", unless we and the Customer have agreed otherwise. If you ask us to pass your personal information to a Customer, that Customer's use of it is governed by their privacy policy and our use is governed by this one; in that situation both we and the Customer act as controllers.


Where we decide for ourselves why and how information is processed — for example, the information we need to give you access to the Website and Services — we act as controller and meet the controller obligations set out in the GDPR.

Vesto 3D works with businesses, researchers and other organisations (together, “Customers”) that may require us to collect and process personal information on their behalf — for example, where a Customer uses our Services in its own business, or embeds our technology into its website or mobile app.


In those cases we follow the privacy instructions given to us by the Customer, and you should consult that Customer’s own privacy policy to understand how it uses your information. In that arrangement the Customer is the “controller” of the personal information and Vesto 3D is the “processor”, unless we and the Customer have agreed otherwise. If you ask us to pass your personal information to a Customer, that Customer’s use of it is governed by their privacy policy and our use is governed by this one; in that situation both we and the Customer act as controllers.


Where we decide for ourselves why and how information is processed — for example, the information we need to give you access to the Website and Services — we act as controller and meet the controller obligations set out in the GDPR.

Vesto 3D works with businesses, researchers and other organisations (together, “Customers”) that may require us to collect and process personal information on their behalf — for example, where a Customer uses our Services in its own business, or embeds our technology into its website or mobile app.


In those cases we follow the privacy instructions given to us by the Customer, and you should consult that Customer’s own privacy policy to understand how it uses your information. In that arrangement the Customer is the “controller” of the personal information and Vesto 3D is the “processor”, unless we and the Customer have agreed otherwise. If you ask us to pass your personal information to a Customer, that Customer’s use of it is governed by their privacy policy and our use is governed by this one; in that situation both we and the Customer act as controllers.


Where we decide for ourselves why and how information is processed — for example, the information we need to give you access to the Website and Services — we act as controller and meet the controller obligations set out in the GDPR.

3. Information collected automatically

3. Information collected automatically

When you open the Website, our servers automatically log information sent by your browser. This can include your device's IP address, browser type and version, operating system type and version, language settings, the page you visited immediately before ours, the pages you view on the Website, how long you spend on them, what you search for, and access times and dates, along with similar statistics.


We use automatically collected information only to identify possible misuse and to build statistics about how the Website and Services are used. These statistics are not compiled in a way that identifies any individual User.

When you open the Website, our servers automatically log information sent by your browser. This can include your device’s IP address, browser type and version, operating system type and version, language settings, the page you visited immediately before ours, the pages you view on the Website, how long you spend on them, what you search for, and access times and dates, along with similar statistics.


We use automatically collected information only to identify possible misuse and to build statistics about how the Website and Services are used. These statistics are not compiled in a way that identifies any individual User.

When you open the Website, our servers automatically log information sent by your browser. This can include your device’s IP address, browser type and version, operating system type and version, language settings, the page you visited immediately before ours, the pages you view on the Website, how long you spend on them, what you search for, and access times and dates, along with similar statistics.


We use automatically collected information only to identify possible misuse and to build statistics about how the Website and Services are used. These statistics are not compiled in a way that identifies any individual User.

4. Information you provide

4. Information you provide

You can browse the Website without telling us who you are. To use certain features, however, you may be asked for Personal Information such as your name and email address. We will tell you whenever we need information that identifies you personally, that lets us contact you, or that we need to deliver the Services. We typically request it when you register for or use the Services, or when you complete our contact form to ask about them.


We receive and store the information you knowingly give us when you create an account, make a purchase or complete any online form. Where relevant this may include:

  • Account details (such as username, unique user ID and password)

  • Contact information (such as email address and phone number)

  • Basic personal information (such as name and country of residence)


Some of this comes directly from you through the Website and Services. We may also obtain information about you from other sources, such as public databases and joint marketing partners.

You can browse the Website without telling us who you are. To use certain features, however, you may be asked for Personal Information such as your name and email address. We will tell you whenever we need information that identifies you personally, that lets us contact you, or that we need to deliver the Services. We typically request it when you register for or use the Services, or when you complete our contact form to ask about them.


We receive and store the information you knowingly give us when you create an account, make a purchase or complete any online form. Where relevant this may include:

  • Account details (such as username, unique user ID and password)

  • Contact information (such as email address and phone number)

  • Basic personal information (such as name and country of residence)


Some of this comes directly from you through the Website and Services. We may also obtain information about you from other sources, such as public databases and joint marketing partners.

You can browse the Website without telling us who you are. To use certain features, however, you may be asked for Personal Information such as your name and email address. We will tell you whenever we need information that identifies you personally, that lets us contact you, or that we need to deliver the Services. We typically request it when you register for or use the Services, or when you complete our contact form to ask about them.


We receive and store the information you knowingly give us when you create an account, make a purchase or complete any online form. Where relevant this may include:

  • Account details (such as username, unique user ID and password)

  • Contact information (such as email address and phone number)

  • Basic personal information (such as name and country of residence)


Some of this comes directly from you through the Website and Services. We may also obtain information about you from other sources, such as public databases and joint marketing partners.

5. Body data (3D scanning)

For certain Services you will be asked to complete a 3D body scan. This uses two full-body photographs together with image-processing algorithms and other technologies to map the shape and contours of your body ("body data"). Where you use our apps to perform a scan, we may collect the photographs the app captures and process them to produce the body data. We may also ask for further details about you, such as your gender.


Body data and related information may be processed to supply goods or services to you, to keep accurate records of those transactions, and to help us develop, debug and test our apps and Services. Our legal basis is the performance of a contract between you and us (or between you and one of our Customers), taking steps at your request before entering into such a contract, and/or your specific consent to these uses.


Where we perform Services for a Customer as processor, we may receive body data with no other identifying information attached. In those cases we have no way to identify the individual the body data relates to.


We may use pixel tags, web beacons and similar technologies to record how people access the Services. This information is generally not personally identifying and may include IP addresses (or the associated DNS name), the site from which someone linked to our Services, and the browser software used. It is analysed in aggregate to administer our systems and improve the Services.

6. Optional face photograph and facial data

This section is specific to Vesto 3D and describes a feature you are never required to use.

6.1 What we collect and when

As an optional part of certain Services, you may choose to provide a photograph of your face so that the 3D model or avatar we generate for you resembles you more closely. Where you take up this option, we process:


  • the face photograph itself; and

  • the geometric measurements and mesh data derived from it in order to reconstruct the shape of your head and face ("facial data").


Depending on the applicable law in your jurisdiction, a face photograph and the data derived from it may qualify as biometric data and as a special category of personal data. We treat it as such in all cases.

6.2 It is genuinely optional

You do not have to provide a face photograph. If you decline, the Services remain fully available to you and your 3D model will simply be generated with a generic, non-identifying head. Declining has no effect on measurement accuracy, sizing results, pricing or any other part of the Services.

6.3 Legal basis

We process face photographs and facial data only on the basis of your explicit, separate, opt-in consent, given under Article 9(2)(a) GDPR and equivalent provisions of other applicable laws. This consent is requested distinctly from any other consent or acceptance of terms, and is never bundled into general acceptance of this Policy or of our terms of service.

6.4 What we use it for, and what we do not

We use your face photograph and facial data solely to:

  • reconstruct the geometry of your head and face;

  • generate, render and display a personalised 3D model or avatar for you; and

  • allow you (or a Customer acting on your instructions) to view garments, equipment or products on that model.


We do not:

  • use face photographs or facial data for facial recognition, identity verification, identity matching, age or emotion estimation, or any form of surveillance;

  • create or store a facial recognition template or faceprint intended to identify you across images, sessions or databases;

  • compare your face photograph against any database of individuals;

  • sell, licence, lease, trade or otherwise profit from your face photograph or facial data;

  • use your face photograph or facial data to train machine learning or AI models, unless you have given a further, separate and clearly worded consent for that specific purpose, which you may refuse or later withdraw without any consequence for your use of the Services.

6.5 Disclosure

Face photographs and facial data are disclosed only to:

  • the Customer on whose behalf we are processing, where you are using the Services through that Customer and it is necessary to deliver the Services to you;

  • service providers who host or process data strictly on our documented instructions, under written contracts imposing confidentiality and security obligations at least as protective as those in this Policy; and

  • authorities or other parties where disclosure is required by law.


We do not disclose face photographs or facial data to any other third party, and we do not disclose them for any marketing, advertising or profiling purpose.

6.6 Retention and deletion

We do not store your face photograph. The photograph is processed only for the moment it takes to reconstruct the geometry of your head and face, and is discarded as soon as that reconstruction is complete. It is never written to persistent storage, never added to your account, never backed up and never archived. Once your session ends, no copy of the original photograph exists in our systems.

What we retain is only the facial data derived from the photograph — the geometry and mesh needed to render your 3D model. We keep it for the shorter of: (a) the period necessary to provide the Services you have requested; (b) [6 months]; or (c) the moment you withdraw your consent or ask for deletion.

You can withdraw your consent or request deletion at any time through the Services or by contacting us at hi@vesto3d.com. On withdrawal we will delete the facial data we hold without undue delay and, in any case, within [30 days], other than any copy we are legally obliged to retain. Because the original photograph is never stored, there is nothing further for us to delete in respect of it. Withdrawal does not affect the lawfulness of processing carried out before you withdrew, and it does not prevent you from continuing to use the rest of the Services.

6.7 Security

Your face photograph is encrypted in transit and is held only in volatile memory for the duration of the reconstruction, so it is never stored at rest. The facial data derived from it is encrypted in transit and at rest, held separately from other account information wherever technically practicable, and accessible only to personnel who need access to operate or support the feature.

6.8 Users in the United States

Where state biometric privacy laws apply to you — including the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and the Washington Biometric Privacy Act — we collect, use and store biometric identifiers and biometric information only after providing written notice of the purpose and retention period and obtaining your written release. Our retention schedule and destruction guidelines are as described in section 6.6 and, at the latest, biometric data is destroyed once the purpose for collecting it has been satisfied or within three years of your last interaction with us, whichever happens first.

6.9 Children

The face photograph feature is not available to, and must not be used by, anyone under the age of 16. See section 8.

7. Photographs of other people

If you supply any other person's personal data to Vesto 3D — including any photograph, body data or face photograph of another person — you may only do so if you have that person's authority, and you must comply with any obligations that applicable law places on you in doing so.

8. Privacy of children

We do not knowingly collect Personal Information from children under 16. If you are under 16, please do not submit any Personal Information through the Website or Services. If you believe a child under 16 has provided Personal Information to us, please contact us so that we can delete it.

We encourage parents and guardians to supervise children's internet use and to instruct them never to provide Personal Information online without permission.

9. How we use collected information

To make the Website and Services available to you, or to comply with a legal obligation, we may need to collect and use certain Personal Information. If you do not provide what we ask for, we may not be able to supply the requested products or services. Information we collect may be used to:

  • create and manage user accounts;

  • fulfil and manage orders;

  • deliver products and services;

  • improve our products and services;

  • send administrative information;

  • send product and service updates;

  • respond to enquiries and provide support;

  • request user feedback;

  • improve the user experience;

  • respond to legal requests and prevent harm; and

  • operate and run the Website and Services.


Whether and how we process your Personal Information depends on how you interact with the Website and Services and where you are located. We rely on the following legal bases:

  • Consent — where you have consented to a specific use (for example cookies or similar technologies, and, always, the optional face photograph described in section 6).

  • Contract — where we need your Personal Information to provide the products or services you have requested under our contractual relationship, or to respond to your enquiries.

  • Legal obligation — where the law requires us to use your Personal Information.

  • Legitimate interests — including maintaining and improving the safety and security of our Website and Services, suppressing illegal activity, guarding against liabilities, investigating and defending against third-party claims, protecting against fraud, and protecting the rights and property of our company, our users and our partners.


Under some laws we may be permitted to process information until you object by opting out, without relying on consent or another basis above. We are happy to clarify the specific legal basis that applies in any given case, including whether providing Personal Information is a statutory or contractual requirement.

10. Payment processing

Where a Service requires payment, you may need to supply card details or other payment account information, which is used solely to process the payment. We use third-party payment processors ("Payment Processors") to handle payment information securely.

Payment Processors follow the security standards maintained by the PCI Security Standards Council. Sensitive data is exchanged over an SSL-secured channel and is encrypted and protected with digital signatures. We share payment data with Payment Processors only to the extent needed to process payments, issue refunds and handle related complaints and queries.

Payment Processors may collect Personal Information directly from you — such as your email address, billing address, card details and bank account number — and handle all stages of the payment process in their own systems. Their use of your information is governed by their own privacy policies, which may not offer the same protections as this Policy. We recommend reviewing them.

11. Managing your information

You can delete certain Personal Information we hold about you, and what is deletable may change as the Website and Services evolve. When you delete Personal Information we may retain an unrevised copy in our records for as long as necessary to meet obligations to our affiliates and partners and for the purposes described in this Policy. To delete your Personal Information or permanently close your account, contact us.

12. Disclosure of information

Depending on the Services requested, or as needed to complete a transaction, we may share your information with affiliates, contracted companies and service providers ("Service Providers") that help us operate the Website and Services, and whose privacy practices are consistent with ours or who agree to follow our policies on Personal Information. We do not share personally identifiable information with unaffiliated third parties.


Service Providers may only use or disclose your information as necessary to perform services for us or to comply with legal requirements. They receive only the information needed for their specific function and are not authorised to use it for their own marketing or other purposes.


We may also disclose Personal Information where required or permitted by law — for example to comply with a subpoena or similar legal process — and where we believe in good faith that disclosure is necessary to protect our rights.

13. Retention of information

We retain and use your Personal Information for as long as your account remains active, to enforce our agreements and to resolve disputes, and for longer only where the law requires or permits it — up to a maximum of 36 months. Shorter periods apply to face photographs and facial data, as set out in section 6.6.


We may use aggregated data derived from your Personal Information after you update or delete it, but not in a way that identifies you personally. Once a retention period expires the Personal Information is deleted, and the rights of access, erasure, rectification and portability can no longer be exercised in respect of it.

14. Transfers of information

Before transferring Personal Information to a third party (including our Customers) we carry out reasonable checks on that party's compliance with the law. We make commercially reasonable efforts to store Personal Information in the region where the individual lives or operates where we are legally required to do so — for example, keeping EU residents' information within the EU or in a country recognised as offering an adequate level of protection.


Where that is not commercially reasonable, we ensure that third-party processors are bound by an agreement providing at least the minimum required level of security and containing the provisions required by law (such as approved standard contractual clauses), including an obligation to impose equivalent terms on any sub-processors.


Depending on your location, transfers may involve storing your information in a country other than your own. This will not include countries outside the European Union and European Economic Area. Where such a transfer takes place you can learn more from the relevant sections of this Policy or by contacting us.

15. Your data protection rights under the GDPR

If you are in the European Economic Area you have certain data protection rights, and we take reasonable steps to let you correct, amend, delete or limit the use of your Personal Information. If you want to know what we hold about you, or want it removed, please contact us. In certain circumstances you have the right to:


  1. Withdraw consent where our processing is based on consent — at any time, without affecting the lawfulness of processing carried out beforehand. This applies in particular to the optional face photograph described in section 6.

  2. Be informed and obtain access — to learn whether we process your Personal Information, to obtain details about that processing, and to receive a copy of the information being processed.

  3. Rectification — to verify the accuracy of your information and have it corrected, updated or completed.

  4. Object — to processing carried out on a legal basis other than consent. Where processing is based on public interest, official authority or our legitimate interests, you may object on grounds relating to your particular situation.

  5. Restriction — to limit processing in defined circumstances: where you contest the accuracy of the information and we need to verify it; where processing is unlawful but you prefer restriction to erasure; where we no longer need the information but you need it for legal claims; or where you have objected and we are verifying whether our grounds override yours. Restricted information will be marked accordingly and, apart from storage, processed only with your consent, for legal claims, to protect another person's rights, or for important public interest reasons.

  6. Erasure — in defined circumstances: where the information is no longer necessary for the purposes it was collected for; where you withdraw consent; where you object under applicable rules; where processing is for direct marketing; or where the data has been processed unlawfully. Exceptions apply where processing is necessary for freedom of expression and information, for compliance with a legal obligation, or for legal claims.

  7. Portability — to receive the Personal Information you provided to us in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted to another controller, provided this does not adversely affect the rights and freedoms of others.

  8. Complain to a supervisory authority — if you are not satisfied with how we handle your complaint, you may lodge a complaint with your local data protection authority in the EEA.


To exercise your rights, email us at hi@vesto3d.com. We aim to respond to all legitimate requests within one month and will contact you if we need more information to act on your request.

Where we process personal information for a Customer as processor and you wish to exercise your rights, please contact that Customer directly, as they are the controller. Because we may only access such data on that Customer's instructions, if you would rather make your request to us, please tell us the name of the Customer that submitted your data. We will refer your request to them and support them in responding within a reasonable timeframe.

16. Data analytics

Our Website and Services may use third-party analytics tools that rely on cookies, web beacons or similar technologies to collect standard internet activity and usage information. The resulting statistical reports cover things like how often Users visit, which pages they view and for how long. We use these insights to monitor performance and improve the Website and Services. We do not use analytics tools to track or collect personally identifiable information, and we do not link statistical reports to any individual User.


We use Google Analytics to analyse use of the Services. Google Analytics generates statistical and other information about site use by means of cookies stored on users' devices, and Google stores this data. More information is available in Google's privacy policy at https://policies.google.com/privacy.

17. California privacy rights

Consumers resident in California have additional rights over their Personal Information under the California Consumer Privacy Act ("CCPA"). If you are a California resident, this section applies to you.


In addition to the rights described elsewhere in this Policy, California residents who provide Personal Information to obtain Services for personal, family or household use may request and obtain from us, once per calendar year, information about the categories and specific pieces of Personal Information we have collected and disclosed.


California residents also have the right to request deletion of their Personal Information and to opt out of its sale — meaning selling, disclosing or transferring Personal Information to another business or third party for monetary or other valuable consideration. We do not sell Personal Information, and we do not sell or share face photographs or facial data under any circumstances. To exercise these rights, contact us. We will not discriminate against you for doing so.

18. How to exercise your rights

Requests can be made using the contact details in this Policy. We may ask you to verify your identity before responding. Your request should contain enough information for us to confirm that you are who you claim to be, or that you are an authorised representative. Where a request comes from an authorised representative, we may ask for evidence of a power of attorney or other valid written authority.


Please include enough detail for us to understand and respond to the request. We cannot respond, or provide Personal Information, until we have verified your identity or authority and confirmed that the information relates to you.

19. Cookies

Our Website and Services use cookies to help personalise your experience. A cookie is a small text file placed on your device by a web server. Cookies cannot run programs or deliver viruses. They are assigned uniquely to you and can only be read by a web server in the domain that issued them. If you decline cookies, some features of the Website and Services may not be available to you.


We may use cookies to collect, store and track information for security and personalisation, to operate the Website and Services, and for statistical purposes. You can accept or decline cookies: most browsers accept them by default, but you can change your browser settings to decline them.

20. Do Not Track signals

Some browsers include a Do Not Track feature signalling that you do not want your online activity tracked. Tracking here means collecting personally identifiable information from consumers as they move across different websites over time, which is not the same as using or collecting information in connection with a single website. Because there is still no uniform standard for how browsers communicate this signal, the Website and Services are not currently set up to interpret or respond to it. Even so, we limit our use and collection of your Personal Information as described throughout this Policy.

21. Social media features

Our Website and Services may include social media features such as share buttons ("Social Media Features"). These may collect your IP address and the page you are viewing, and may set a cookie so that they function correctly. They are hosted either by their providers or directly on our Website and Services. Your interactions with them are governed by the privacy policy of the relevant provider.

22. Email marketing

We offer electronic newsletters that you may subscribe to voluntarily at any time. We keep your email address confidential and will not disclose it to third parties except as permitted in the sections above or where a third-party provider is used to send the emails. We handle information sent by email in line with applicable laws and regulations.


In line with the CAN-SPAM Act, all emails we send clearly identify the sender and explain how to make contact. You can stop receiving newsletters or marketing emails by following the unsubscribe instructions in them or by contacting us, though you will continue to receive essential transactional emails.

23. Links to other resources

The Website and Services contain links to resources we do not own or control. We are not responsible for the privacy practices of those resources or third parties. Please be aware when you leave our Website and Services, and read the privacy statements of any resource that may collect Personal Information.

24. Information security

Vesto 3D takes reasonable technical, administrative and physical measures to protect your personal information against unauthorised use, disclosure and alteration. We hold the information you provide on servers in a controlled, secure environment and maintain reasonable safeguards against unauthorised access, use, modification and disclosure of the Personal Information in our control. No transmission over the internet or a wireless network can be guaranteed, however.


While we work to protect your Personal Information, you acknowledge that (i) the internet has security and privacy limitations beyond our control; (ii) the security, integrity and privacy of information exchanged between you and the Website and Services cannot be guaranteed; and (iii) such information may be viewed or tampered with in transit by a third party despite best efforts.

Security also depends in part on the device you use to communicate with us and on how you protect your credentials, so please take appropriate steps to safeguard them. Nobody can view or edit the personal information associated with your account without your username and password, so do not share these.


We provide information and training to all employees who have access to personally identifiable data we hold, and our employees are responsible for the internal security of that information. We will not process personal information in any way that is incompatible or inconsistent with the purpose for which it was collected.

25. Data breach

If we become aware that the security of the Website and Services has been compromised, or that Users' Personal Information has been disclosed to unrelated third parties through external activity such as a security attack or fraud, we reserve the right to take reasonably appropriate measures, including investigation, reporting, and notification of and cooperation with law enforcement authorities. We will make reasonable efforts to notify affected individuals where we believe there is a reasonable risk of harm or where notice is otherwise required by law, including by posting a notice on the Website and sending you an email.

26. Changes and amendments

We may modify this Policy, or its terms relating to the Website and Services, at any time at our discretion. When we do, we will revise the "last updated" date and send you an email to notify you. We may also notify you in other ways, such as through the contact details you have given us.


An updated version takes effect immediately upon posting unless stated otherwise. Continuing to use the Website and Services after the effective date constitutes your consent to the changes. We will not, without your consent, use your Personal Information in a way that is materially different from what was stated when it was collected. Any change affecting how face photographs or facial data are processed will require a fresh, separate opt-in consent.

27. Changes and amendments

We may modify this Policy, or its terms relating to the Website and Services, at any time at our discretion. When we do, we will revise the "last updated" date and send you an email to notify you. We may also notify you in other ways, such as through the contact details you have given us.


An updated version takes effect immediately upon posting unless stated otherwise. Continuing to use the Website and Services after the effective date constitutes your consent to the changes. We will not, without your consent, use your Personal Information in a way that is materially different from what was stated when it was collected. Any change affecting how face photographs or facial data are processed will require a fresh, separate opt-in consent.

28. Contacting us

If you have questions, concerns or complaints about this Policy, about the information we hold about you, or if you wish to exercise your rights, please contact us:


We will try to resolve complaints and disputes and will make every reasonable effort to honour your rights as quickly as possible, and in any event within the timescales set by applicable data protection law.