Privacy policy

1. Who we are

Fate Media Creative is a trade name of Fate Studios Creative, LLC, a California limited liability company based in San Diego, California ("we", "us", "our"). We provide corporate photography and video production, including headshot booths that use facial recognition to deliver photographs to the people in them.

We are the business responsible for the personal information described in this policy, except where we are handling information on behalf of a client, as described in section 15.

2. Scope

This policy covers personal information we collect through:

• this website and any form, email or phone call you use to reach us;
• our photography, videography and headshot booth services at events and on location;
• galleries, download links and text or email messages we send to deliver images;
• our dealings with clients, vendors, contractors and applicants.

It does not cover third-party sites we link to, or the separate privacy practices of a client whose event you attended.

3. What we collect

Information you give us

• Business contact details — name, employer, job title, email address, phone number, mailing and billing address.
• Project details — event dates, venues, run of show, headcount, deliverables, budgets and anything else you put in a quote request, brief or email.
• Contract and payment records — signed agreements, purchase orders, invoices, W-9s and payment confirmations. Card and bank details are handled by our payment processor; we do not store full card numbers.
• Attendee delivery details — the mobile number or email address a person enters at a booth so we can send them their photographs.

Information we create

• Photographs and video footage of people, spaces, products and events, including audio recorded during interviews.
• Facial recognition data — a mathematical representation ("face template") derived from a photograph, used only to match a person to the images they appear in. This is described in detail in section 5 and in our biometric data notice.
• Production records — shot lists, call sheets, releases, and notes about a shoot.

Information collected automatically

• Technical data — IP address, browser and device type, operating system, referring page, pages viewed and time of visit.
• Delivery data — whether a message we sent was delivered, whether a gallery link was opened, and whether someone replied STOP or unsubscribed.

4. How we use it

We do not use photographs, footage, voice recordings or face templates to train artificial intelligence or machine learning models, and we do not permit our vendors to do so with material from your event.

5. Facial recognition

In short:

• A face template is generated only after a person signs up at the booth and agrees to face matching.
• It is used for one purpose: finding the photographs from that event that the person appears in, so those photographs can be sent to them.
• It is scoped to a single event. It is not carried across events, not cross-referenced against other galleries, and not used to identify anyone by name.
• It is never sold, rented, traded, licensed or used for advertising or model training.
• It is permanently destroyed within 30 days of final delivery for the event, or sooner on request.
• Anyone may decline face matching and still receive their photographs.

6. Who we share it with

We share personal information only where it is needed to run the service:

• Our client for the event. The organization that hired us receives the finished gallery, and may receive counts of sign-ups and deliveries. They receive attendee contact details only where the attendee was told at sign-up that this would happen.
• Technology vendors — the gallery and booth platform, cloud storage and backup, the SMS and email providers that carry our messages, and our website host. They act on our instructions and may not use the data for their own purposes.
• Contractors — second shooters, editors, retouchers, producers and assistants engaged on a project, all bound by written confidentiality obligations.
• Professional advisers — accountants, insurers and lawyers, as needed.
• Payment processors for billing.
• Authorities, where we are legally required to disclose, or where disclosure is necessary to protect someone's safety or our legal rights.
• A successor entity, if the business is sold or reorganized. Face data is not transferable in that event; it is destroyed rather than transferred.

7. We do not sell or share personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA and under comparable state laws. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16.

8. How long we keep it

Where a legal claim, audit or dispute is live, we keep what is relevant to it until it is resolved.

9. Security

We use access controls, encryption in transit and at rest, multi-factor authentication on production systems, least-privilege access for contractors, and scheduled deletion routines for time-limited data such as face templates. Crew devices are encrypted and cards are offloaded to secured storage at the end of each shoot day.

No system is perfect. We cannot guarantee absolute security, and you send information to us at your own risk. If a breach affecting your personal information occurs, we will notify you and the relevant regulators as required by law.

10. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use it;
• receive a copy in a portable format;
• correct information that is inaccurate;
• delete your personal information, including your face template and your photographs;
• opt out of the sale or sharing of personal information (we do not do either);
• limit our use of sensitive personal information;
• opt out of profiling with legal or similarly significant effects (we do not profile);
• appeal a decision we make about your request;
• not be discriminated against for exercising any of these rights.

To exercise a right, email info@fatemediacreative.com or call (619) 495-2320, telling us what you want and, if you can, the name and date of the event. We will acknowledge within 10 business days and respond within 45 calendar days, extendable once by a further 45 days where the request is complex. There is no charge unless a request is manifestly unfounded or excessive.

We will need to verify your identity before acting, usually by confirming you control the phone number or email address the photographs were sent to. An authorised agent may act for you with written permission.

If you ask us to delete photographs, we will remove them from our active galleries and storage. We may not be able to recall copies already downloaded by you, by other attendees or by our client, and we may retain what we are legally required to keep.

11. California

In the past twelve months we have collected the following categories of personal information under the CCPA: identifiers; customer records information; commercial information; internet or network activity; geolocation at the level of event venue; audio, electronic and visual information; professional or employment-related information; and sensitive personal information in the form of biometric information processed for the purpose of uniquely identifying a person. Each category is collected from the sources, used for the purposes, and disclosed to the categories of recipients described in sections 3, 4 and 6.

We use sensitive personal information only to deliver the service you or our client asked for. We do not use or disclose it for the purpose of inferring characteristics about you, so the right to limit its use under section 1798.121 is not engaged. You may still request that we delete it.

California residents may also request, once a year, information about disclosures to third parties for their direct marketing purposes under California's "Shine the Light" law. We make no such disclosures.

12. Other states

Residents of states with comprehensive privacy laws — including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — have the rights listed in section 10 to the extent their state law provides them, and may appeal a refusal by writing to info@fatemediacreative.com with "Appeal" in the subject line. If we deny an appeal, you may contact your state attorney general.

Residents of Illinois, Texas and Washington should read the biometric data notice, which sets out the specific disclosures, consent and destruction schedule required by the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and Washington law.

13. Cookies and analytics

This site uses a small number of cookies and similar technologies: strictly necessary ones that make the site work, and optional analytics that tell us which pages are read. We do not use advertising cookies and we do not run retargeting pixels.

Video is embedded from Vimeo and loads only when you click play. We request Vimeo's do-not-track mode, but once you start a video Vimeo's own privacy policy applies to that playback.

You can block or delete cookies in your browser settings. We honour the Global Privacy Control signal as a valid opt-out request where state law requires it.

14. Children

Our services are aimed at businesses and are not directed to children. We do not knowingly collect personal information from anyone under 13. We do not enrol anyone under 18 in facial recognition without the verified consent of a parent or legal guardian. If you believe a child's information has been collected, contact us and we will delete it.

15. When we act for a client

For some work we act as a service provider or processor for the client who hired us, handling personal information on their documented instructions and only for the purposes of their project. In those cases the client's own privacy policy governs how they use what we deliver, and you should direct access and deletion requests about their use of the material to them. We will help them respond.

16. Visitors outside the United States

We operate in the United States and our vendors store data there. If you access this site or attend an event from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws differ from those in your country. Where we handle the personal data of individuals in the EEA or UK, we rely on the performance of a contract or our legitimate interest in running the business, and we use Standard Contractual Clauses with vendors where required.

17. Changes

We will update this policy as our services and the law change. The effective date at the top always reflects the current version. If a change materially affects how we handle your information, we will give notice on this site and, where we hold your contact details and the change is significant, by email.

18. Contact us

Fate Studios Creative, LLC dba Fate Media Creative
San Diego, California, United States
Privacy: info@fatemediacreative.com
Phone: (619) 495-2320