Biometric data retention policy

1. What this policy covers

“Face data” means the biometric data created so that a person can find their own photos with a selfie:

• Face templates: numerical representations of the faces detected in a gallery's photos, held in the gallery's face-search index (Amazon Rekognition, EU region) or, for galleries on one of our own face models, as face vectors.
• The face archive: small face crops saved privately so a gallery's face search can be rebuilt without re-reading the original photos. The archive is never shown to anyone and is never served publicly.

Face data is not a photo. Photos, orders, sales, downloads and bib/number search are not covered by this policy and are not affected by it: deleting face data never deletes a photo.

2. Selfies used to search

A selfie uploaded to search a gallery is used only for that search: it is compared with the gallery's face templates and then discarded. Selfies are not stored, are not added to any face-search index and are not used to create a face template.

3. When we delete face data

We permanently delete face data at the earliest of:

• 12 months after the photo was uploaded. This applies photo by photo: each photo's face data is deleted 12 months after that photo was uploaded, even if the gallery stays online.
• 30 days after the gallery is closed or deleted, or after face search is switched off for the gallery. If the administrator reopens the gallery or switches face search back on within those 30 days, the deletion is cancelled.
• 30 days after a person asks us to delete their face data or withdraws their consent (see §5).
• 45 days after our yearly review finds that the face data is no longer necessary (see §7).

When all of a gallery's face data has been deleted, selfie search ends for that gallery. Its photos stay available to browse, buy and download, and bib/number search keeps working.

4. How we delete it

• An automated job runs every day. It deletes expired face templates from the gallery's face-search index and blacks out (or deletes) the matching crops in the face archive.
• Each photo whose face data has been deleted is marked so that it is never indexed for face search again — including when a gallery's face search is rebuilt.
• When a gallery's face search is closed down, its whole face-search index and face archive are deleted.
• Deletion is permanent: deleted face templates cannot be restored.

5. Asking us to delete your face data

Anyone can ask for their face data to be deleted, or withdraw their consent to face search, at any time:

• In the gallery: open selfie search and choose “Make a request”. Your request goes to the gallery's administrator and to Photohawk.
• By email: write to support@photohawk.com and tell us which gallery or event it concerns.

We match the faces in the gallery (or across the administrator's whole workspace) to the person, delete the matching face data and stop those photos from being indexed for face search again. We do this within 30 days of the request. To do it we do not keep a template of the person's face: we record only which photos and faces were removed. If photos of the same person are uploaded later, a new request covers them.

6. Backups

• Face templates in the face-search index (Amazon Rekognition) are not backed up: once deleted they are gone.
• The face archive and our own face vectors are kept in a private storage bucket without versioning or replication, so a deletion there is immediate.
• Our database backups (point-in-time recovery, kept for up to 35 days) hold references to faces (identifiers and positions in a photo), never face templates. They are purged automatically within 35 days.

7. Yearly review

At least once a year we review whether the face data we hold is still necessary for face search. Any face data the review finds unnecessary is deleted within 45 days of that finding.

8. Why these limits (legal basis)

Data-protection law asks that personal data be kept no longer than necessary for its purpose (the storage-limitation principle of the GDPR and UK GDPR, Article 5(1)(e)). Face data is only needed while people are still looking for their photos, which happens mostly in the weeks after an event, so we set a limit of 12 months from upload. That limit is our own choice; it is not a period the law prescribes.

It also falls within the deadlines set by US state biometric-privacy laws, including:

• Illinois (Biometric Information Privacy Act): destroy biometric data when the purpose for collecting it has been satisfied, or within 3 years of the person's last interaction, whichever comes first — under a public written retention schedule such as this one.
• Texas (Capture or Use of Biometric Identifier Act): destroy within a reasonable time, and no later than one year after the purpose for collecting it ends.
• Colorado (Colorado Privacy Act, biometric amendments): delete when the purpose has been satisfied, within 24 months of the person's last interaction, or within 45 days of finding at a yearly review that it is no longer necessary — whichever comes first.
• Washington (RCW 19.375): keep biometric identifiers no longer than reasonably necessary to provide the service.

Face search runs only with the consent of the person searching, which can be withdrawn at any time (see §5). For more on how we handle personal data, see our privacy policy at photohawk.com/privacy.

9. Contact

Questions about this policy, or a request about your face data: support@photohawk.com. CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom.