Privacy Policy

1. Data Controller

[COMPANY NAME] ("[COMPANY NUMBER]"), registered at [REGISTERED ADDRESS], is the data controller responsible for your personal data collected through the ImageClaim platform.

For all data protection enquiries, please contact our Data Protection Lead at: privacy@imageclaim.io

UK users: ImageClaim is registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].

2. Data We Collect

3. How We Use Your Data

We use the data we collect for the following purposes:

4. Image Processing and Storage

5. Legal Basis for Processing (GDPR and UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases for processing your personal data:

6. Data Sharing

7. Third-Party Services

The following third-party services process your data as part of providing the Service:

We encourage you to review the privacy policies of these third-party providers. ImageClaim is not responsible for the data practices of third-party services.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the United Kingdom and European Economic Area, including the United States, where our third-party service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Agreement (IDTA), as applicable;
• The EU-US and UK-US Data Privacy Framework (where applicable);
• Binding Corporate Rules or other approved transfer mechanisms.

You may request a copy of the safeguards applicable to your data by contacting privacy@imageclaim.io.

9. Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfil the purposes described in this Policy, or as required by law. Our standard retention periods are:

10. Your Rights Under GDPR and UK GDPR

If you are located in the United Kingdom or European Union, you have the following rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data, subject to certain exceptions (e.g. where we are required by law to retain it).
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
• Right to Object: You have the right to object to processing of your personal data based on our legitimate interests, including for direct marketing purposes.
• Rights in Relation to Automated Decision-Making: You have the right not to be subject to a decision made solely on the basis of automated processing, including profiling, where that decision produces legal or similarly significant effects on you.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at privacy@imageclaim.io. We will respond to your request within thirty (30) days. We may ask you to verify your identity before fulfilling a request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the relevant supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: Your national data protection authority (see edpb.europa.eu/about-edpb/about-edpb/members_en for a list).

11. Your Rights Under the CCPA (California Residents)

California residents have the following rights regarding their personal information:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: ImageClaim does not sell or share personal information for cross-context behavioural advertising. We will update this Policy if our practices change.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information to that which is necessary to provide the Service.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA rights.

To exercise any CCPA rights, contact us at privacy@imageclaim.io or by post at [REGISTERED ADDRESS]. We will verify your identity before processing your request. We do not currently facilitate requests via an authorised agent but may do so in future.

For CCPA purposes, we have collected the following categories of personal information in the twelve months prior to the effective date of this Policy: identifiers (name, email, IP address); commercial information (payment and transaction records); internet activity information (usage data); visual information (uploaded photographs).

12. Cookies

We use cookies and similar tracking technologies. For detailed information about our use of cookies, the types of cookies we use, and how to manage them, please see our Cookie Policy.

In summary, we use:

• Strictly necessary cookies — required for the Service to function (authentication, session management). Cannot be disabled.
• Functional cookies — remember your preferences and settings.
• Analytics cookies — help us understand how the Service is used (with your consent).
• Marketing cookies — used for targeted advertising (with your consent, where applicable).

13. Data Security

ImageClaim implements industry-standard technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of sensitive data at rest using AES-256;
• Hashed and salted password storage (bcrypt);
• Payment Card Industry Data Security Standard (PCI-DSS) compliance via Stripe;
• Role-based access controls limiting employee access to personal data;
• Regular security audits and penetration testing;
• Incident response procedures and breach notification processes.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law (within 72 hours for GDPR/UK GDPR purposes where required).

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

14. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at privacy@imageclaim.io and we will delete such information promptly.

15. Contact and Data Requests

For all privacy-related enquiries, subject access requests, and data deletion requests:

This Privacy Policy may be updated from time to time. We will notify you of material changes by email and by posting a notice within the Service. The effective date at the top of this Policy reflects the date of the most recent update.