CREATORS

We have processes in place that are intended to ensure that all Creators on the Website: (i) are at least 18 years of age; and (ii) verify their identity. Before you can start a Creator account, we will:

• Ask you to provide Creator User Data, as set out at Section 9 (categories of personal data).
• Check your country of residence. This check is intended to ensure lawful access to the Website and the Services.
• Ask you to provide Financial Data, as set out at Section 9 (categories of personal data). This is necessary so that payments can be made to Creators for content, and so that Creators can access their earnings via the Website. Financial Data is also collected as a verification and anti-fraud measure.
• Ask you to go through a third-party age and identity verification process:
• This process involves our third-party provider collecting a short .gif, taken from a "selfie" and photo from a government identity document (in both cases, that you provide to the third-party provider). The third-party provider then uses Face Recognition Data to match the two images so they can digitally verify your age and identity.
• As described at Section 9 (categories of personal data), we do not collect, receive, possess, or have access to any Face Recognition Data collected or processed by our third-party providers through this process.
• Where permitted by applicable law, we receive from our third-party providers Third-Party Onboarding Data, and certain Technical Data, as set out at Section 9 (categories of personal data), to maintain a record of the age and identity verification process.
• Check that you have not previously been banned from using the Website and our Services (e.g. as a result of violating our Terms of Service).

USERS

We have processes in place that are intended to ensure that: (i) all Users on the Website are at least 18 years of age; and (ii) Users in certain locations verify their identity. Before you can start a User account, we will:

• Ask you to provide User Data, as set out at Section 9 (categories of personal data).
• Check your country of residence. This check is intended to ensure lawful access to the Website and the Services.
• Ask you to provide Financial Data, as set out at Section 9 (categories of personal data). This is necessary so that Users can make payments to Creators. Financial Data is also collected as a verification and anti-fraud measure.
• Ask you to go through a third-party process to gain assurances of your age. The specific process will depend upon your location and the third-party provider. This may include:
• Third-party age and identity verification
• For certain locations, we are required to verify the age and identity of our Users, so we need to take additional steps. This process involves our third-party provider collecting a short .gif, taken from a "selfie" and photo from a government identity document (in both cases, that you provide to the third-party provider). The third-party provider then uses Face Recognition Data to match the two images so they can digitally verify your age and identity.
• As set out at Section 9 (categories of personal data), we do not ourselves collect, receive, possess, or have access to this data.
• Where permitted by applicable law, we may receive from our third-party providers Third-Party Onboarding Data, and certain Technical Data, as set out at Section 9 (categories of personal data), to maintain a record of the age and identity verification process.
• Third-party age estimation
• For certain locations, we use third-party providers to conduct age estimation. This process involves our third-party provider collecting a short .gif "selfie" (that you provide to the third-party provider) and using digital technology to estimate your age, which may involve the use of Face Recognition Data.
• If you go through the third-party age estimation process, we will only receive the results of the process (pass / fail and reason for failing), to maintain a record of the age estimation process.
• If you fail the third-party age estimation process (e.g. if you are over 18 years of age, but their technology has predicted that you look under 18 years of age), you may have the option to go through the third-party age and identity verification process set out above.

MORE INFORMATION ON OUR ONBOARDING PROCESSES

• Why does VUDE use third-party face recognition technology?
• The use of face recognition technology by our third-party providers is an important technological measure used in our wider onboarding processes for Creators and Users. It is intended to ensure safety on the Website and our compliance with applicable laws.
• We use third-party service providers to carry out age and identity verification, who carry out these services on our behalf, as data processors.
• How does Face Recognition Data help to prevent fraud?
• Face recognition technology reduces the possibility of fraudulent face image spoofing and the uploading of fraudulent government identity documents when individuals go through the onboarding process.
• Where our third-party providers have identified possible fraud attempts (such as the use of fake or otherwise manipulated documents) our third-party providers may maintain a record of such attempts, including Face Recognition Data, for the purposes of detecting unlawful activity and preventing access to the Website.
• Periodic authentication of your identity
• During the time that you hold an account with us, we may require you to periodically authenticate your identity. If you have gone through the third-party age identity verification process, where permitted by applicable law our third-party providers may retain Face Recognition Data to enable you to authenticate your identity. Where this is retained, you do not need to provide the third-party provider with your government identity document again when authenticating your identity.
• Withdrawing your consent: You may withdraw your consent to the retention of your Face Recognition Data for the purposes of subsequent authentication (and delete this) by contacting [email protected] . While withdrawing your consent to the retention of your Face Recognition Data will not affect your ability to complete a subsequent authentication process, it may require you to provide the third-party provider with your government identity document again during the authentication process.

We process personal data for, or based on, one or more of the following legal bases:

• Consent: Your consent is requested only in specific circumstances which includes, for example, the processing of: (i) Face Recognition Data by our third-party providers as part of the age and identity verification process for all Creators (and for Users in certain locations); and (ii) age estimation captures (which may involve the use of Face Recognition Data) by our third-party providers for Users in certain locations. Please see Section 10 (our onboarding processes), above, for further information.
• Performance of a contract: By using the Services, you have contracted with us through our Terms of Service, and we will process personal data to perform that contract (e.g. to fulfil transactions between Users and Creators and process Creator earnings) and to enforce the terms of that contract.
• Legitimate interests: We may process personal data if it is in our, or a third-party's, legitimate interests (as detailed in the table below). This includes, for example, investigating and responding to a report made through our Takedown Procedure to protect a Creator's intellectual property rights.
• Compliance with legal obligations: As a global business, we may process personal data to comply with applicable law, rules and regulations in the locations where we operate.
• Task carried out in the public interest: We may process personal data as necessary for a task carried out in the public interest. This may include, for example, reporting illegal activity to relevant law enforcement authorities, other governmental agencies and non- governmental organisations.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

The table below indicates the purposes for which your personal data is processed and the legal justification for the processing. Some of the above grounds for processing will overlap and there may be several grounds which justify the processing:

We collect your personal data from the following categories of sources:

• Directly from you: When you provide it to us directly to open an account and use the Services, when you update your personal data in your account, or by corresponding with us (e.g. User Data, Account Data).
• Automatically or indirectly from you: For example, through and as a result of your use of the Services (e.g. Transaction Data, Technical Data, Usage Data).
• From our service providers: For example, where permitted by applicable law, we receive Third-Party Onboarding Data and certain Technical Data from our third-party age and identity verification providers.

We share your personal data with the following categories of third parties:

• Our third-party service providers: Such as our IT, payment processing, customer support, content and text moderation, and age and identity verification / age estimation service providers. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely the receipt of services to support business functionality).
• Our professional advisers: Such as our legal advisors, bankers, auditors, accountants, consultants, and insurers. Our professional advisors will process personal data as necessary to provide their services to us. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely the receipt of professional services).
• Corporate: Relevant third parties in the event of a possible sale, merger, acquisition, business reorganisation or group restructuring exercise. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our and the relevant third parties' legitimate interests (namely assessing and putting into effect potential transactions).
• Our group companies: For the centralised coordination and management of our business, in accordance with the purposes set out at Section 9 (categories of personal data). These recipients will process personal data in the same way as set out in this Policy. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely coordinating the global operations of our business).
• Relevant authorities, regulators and organisations: In response to requests from governmental authorities (including law enforcement and tax authorities), regulators, and certain non-governmental organisations. These recipients will use your personal data in the performance of their regulatory, law enforcement or otherwise charitable or not-for-profit role. The lawful basis we rely on for sharing personal data with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject, or necessary for our, or a third-party's, legitimate interests, or where it is in the interests of the wider public to do so (namely reporting illegal content to, and assisting with requests from, such authorities, regulators and organisations, to protect the safety of our users and third parties).

You have certain rights regarding the collection and processing of personal data. You may exercise these rights by contacting us using the contact details set out at Section 19 (assistance and contact information).

Under certain circumstances and subject to certain exemptions, you have the right to:

• Withdraw your consent to the processing of your personal data: Please note that withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw your consent.
• Request to know or access to your personal data: You may receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you: You may correct any incomplete or inaccurate personal data we hold about you.
• Request deletion / erasure of your personal data: You may ask us to delete or remove personal data where there is no legitimate reason for us continuing to process it. You also may ask us to delete or remove your personal data where you have exercised your right to object to processing (see below). Please note that we may not always be able to comply with your request of deletion / erasure for specific legal reasons.
• Request the restriction of processing of your personal data: You may ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of some sections of your personal data to another party.
• You also have the right to object to processing of your personal data where we are relying on a legitimate interest for the processing and there is something about your particular situation which makes you want to object to processing on this ground.
• We do not process personal data that is subject to solely automated decision-making, where that decision-making is likely to have a legal or similarly significant effect on you.

You also have the right:

• To lodge a complaint with a data protection regulator. For example, in the UK, this is the Information Commissioner's Office (ICO) and in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). If you are resident in the EEA, you may wish to contact your local country or state-specific data protection regulator.
• Depending on your location, to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights, or appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by contacting us using the contact details set out at Section 19 (assistance and contact information).

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, as set out in this Policy. Subject to the below, we retain personal data for a period of 6 months after the deletion or deactivation of your account on the Website.

Please note that:

• We will delete your personal data sooner where a shorter retention period is required by applicable law.
• We will retain your personal data for a longer period to the extent we deem necessary to carry out the processing activities set out in this Policy, for example:
• where it is necessary to comply with laws and regulatory obligations that are applicable to us (e.g. adhering to record keeping / maintenance requirements in certain locations and financial / tax reporting requirements, which in some cases is up to 7 years, and if we receive a valid legal request, such as a preservation order or search warrant, related to your account);
• for the purposes of identifying and reporting illegal activity, protecting the safety of our users and third parties, or otherwise protecting the rights and property of our users, us, and other third parties (e.g. where you have, or we have reason to believe that you have, violated our Terms of Service, and in circumstances where users are banned from further access to the Website);
• for purposes of legal proceedings (e.g. to defend ourselves in litigation about a claim related to you); and
• for the purposes of responding to requests from third parties in relation to your account, such as requests received from, or investigations by, law enforcement authorities, relevant governmental authorities (e.g. tax authorities and regulatory authorities) and non-governmental organisations.

The personal data that we retain and the length of time for which it is retained will be determined on a case-by-case basis, depending on the particular circumstances.

No sales for targeted advertising

We do not sell or share personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual's activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as "targeted advertising").

Sensitive information

Although sensitive information may be disclosed for a business purpose as described below, we do not sell or share sensitive information for the purpose of targeted advertising.

The following personal data elements we, or our service providers, collect may be classified as "sensitive" under certain privacy laws ("sensitive information") including:

• username and password;
• social security number, driver's licence number, and passport number;
• government identifiers (such as driver's licence numbers);
• partial payment card number and the name registered with your payment card; and
• Face Recognition Data (biometric information which is collected and processed by our third-party providers).

We use this sensitive information for the purposes set out at Section 11 (how / why we use your personal data and lawful bases for processing), to the extent necessary for the operation of our Services, to enter into and perform a contract with you, to comply with legal and regulatory requirements, to protect the safety of ours users and third parties or as otherwise permissible for our own internal purposes consistent with applicable laws.

Deidentified information

We may at times receive, or process personal data, to create deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by applicable law.

Minors

Our Services are strictly intended for individuals 18 years of age or older. Anyone under 18 years of age is not permitted to use the Services. By using the Services, you represent that you are 18 years of age or older.