Pixally Contractor Privacy Notice

1.1 This notice explains how Pixally handles personal information about you when you use a Pixally contractor account, and when a studio that uses Pixally invites you, books you, pays you or keeps records about work you do for it.

1.2 It sits alongside our Contractor Terms of Use. Capitalised words such as "Studio", "Engagement", "Service Agreement", "Studio Data" and "Contractor Data" mean what the Contractor Terms say they mean. In this notice:

• "Service" means the Pixally contractor account and the parts of Pixally you use through it;
• a Studio invites you when it asks you to join the list of contractors it works with;
• a Studio you work with is one whose invitation you have accepted; and
• a Studio engages or books you when it has an Engagement with you, such as a job.

1.3 This notice does not cover:

• information about a Studio's clients that you see during an Engagement. That information belongs to the Studio, and Section 10 of the Contractor Terms explains how you must treat it;
• your Pixally subscriber account, if you also run a studio. Our Privacy Policy covers that account; and
• services run by others, such as a payment provider or Google, which have their own privacy policies.

• You have one account, and Pixally is responsible for it. That covers your sign-in, your profile, your gear, your travel settings, your availability and any tax form you upload.
• Each Studio keeps its own records about you. When a Studio books you, it records things like your pay, your jobs, the agreements you sign with it and its ratings of your work. Those records belong to that Studio, and we hold them on its behalf.
• Studios see what they need, and not each other's records. A Studio sees your profile and the details of its own work with you. It cannot see what another Studio pays you or how another Studio rated you.
• Your tax form is locked down. A W-9 is stored as an encrypted file. We never extract, search, display or email the number on it. Only you, the owners and administrators of each Studio you work with that has set your pay rate, and the few people who support the feature can open it (Section 5).
• Your bank details go to the payment provider, not to us. We see only whether your payout account is ready, anything you need to fix, the bank's name and the last four digits (Section 7.6).
• We do not sell your information, and we do not use it for advertising.
• You control your public profile. If we launch a professional directory, we will tell you first, show you exactly what would be public, and let you hide anything or opt out (Section 9).
• You can ask us for a copy of your information, to correct it, or to delete it, at privacy@pixally.com (Section 13).

3.1 Pixally. Pixally LLC, a Delaware limited liability company ("Pixally", "we", "us", "our"), whose contact details are in Section 18, is responsible for (is the controller of) the information in your contractor account: your sign-in details, the profile you manage, your gear, your travel and location settings, your availability, your meal needs if you share them, any tax form you upload, your settings, and the records we keep to run and secure the Service. We are also responsible for your public profile if we launch a professional directory (Section 9).

3.2 Each Studio. When a Studio invites you, books you or pays you, it creates its own records about its work with you. Examples are the roles and services it lists you for, the rates it sets, prices and payments, the Service Agreements you sign with it, messages and files exchanged in its workspace, tasks, and any ratings, reviews or notes it records about your work. The Studio decides what goes into those records and what is done with them, so the Studio is responsible for them (is the controller). We handle them on the Studio's behalf and on its instructions (as its processor). The same applies to any copy of your information a Studio downloads or exports, such as your tax form or a report it prepares for its own tax filings.

3.3 Records you both hold. Some records appear both in your account and in a Studio's workspace. An example is the jobs a Studio has booked you for, with their dates. We are responsible for them as part of your account, including for keeping your availability accurate across the Studios you work with (Section 7.3). The Studio is separately responsible for its own use of them, such as its payment records and its ratings of your work.

3.4 Services with their own relationship with you.

• The payment provider a Studio uses to pay you through the Service (currently Stripe) collects your identity and bank details directly from you, under its own terms and privacy policy.
• Google provides sign-in, if you choose it, and the maps and address lookup in the Service, under its own terms and privacy policy (Section 4.4).

3.5 If you are not sure who is responsible for a piece of information, ask us at privacy@pixally.com and we will tell you.

4.1 What you give us

• Account details: your first and last name, the name you prefer to be called, your email address, your mobile phone number, your password (unless you sign in with Google), and your website or portfolio link.
• Profile and professional details: a photo of yourself, the gear you work with (for example cameras, lenses, lighting, video, phone and drone equipment), and, if you fly drones, your drone licence. A drone licence is a professional credential, which is why there is a place for it. Other identity documents do not belong in the Service (Section 4.5).
• Travel and location: your home address, which we use to work out your distance from each job and any travel fee, and how far you are willing to travel with and without a travel fee. Section 7 explains who sees your address and who sees only your distance or general area.
• Availability: your working days, how far ahead you accept bookings, and dates you mark as unavailable.
• Meal needs (optional): dietary requirements or food allergies you choose to tell us about. See Section 4.5.
• Tax documentation: a Form W-9 if you are a US person or, if you are not, a form such as a Form W-8BEN. See Section 5.
• Invoices, deliverables and files: invoices, delivery links, shipping details and other files you upload for a Studio.
• Messages, notes and tasks: emails you send to or through a Studio's workspace, replies to text reminders, notes and tasks. Notes you keep private are not shared with any Studio. Notes you share go to the Studio.
• Signatures: your typed or drawn signature on Service Agreements.
• Support requests: what you tell us when you contact us.

4.2 What Studios give us or create about you

• When a Studio invites you: your name, your email address, the brands and services it wants you for, and any message it adds.
• When a Studio sets you up and books you: your roles, event types and service areas, whether it treats you as a backup for a brand, your pay rates and any payment notes, the jobs it assigns you, event prices and travel fees, and a history of changes to them.
• When a Studio pays you: invoice and payment records, including payments it records as made outside the Service (for example in cash or through a payment app).
• Ratings, reviews and notes: a Studio's users can rate your work and write reviews after an event. You cannot see these in your account. They are the Studio's records, and Section 13.2 explains how to ask for them.
• Tax reporting: a Studio's owners and administrators can prepare reports of what they paid you, with your name, email address and mailing address, to help with their own tax filings.

4.3 What we collect automatically

• Sign-in and security: when and how you sign in, which Studio workspace you are using, your IP address, and details about your device and browser. We use these to keep your account secure, for example to alert you to a sign-in from a new device.
• Time zone: set automatically from your browser settings or your IP address.
• Signature evidence: when you sign a Service Agreement, the date and time, your name and email address, and the IP address you signed from are recorded with the signed document.
• Activity records: records of actions in the Service, such as agreements sent, viewed and signed, deliverables and invoices uploaded, tasks completed, and reminders sent and answered.
• Message records: whether an email or text message was delivered, and your replies to text reminders.
• Cookies and similar technology: see Section 10.

4.4 What we receive from others

• Google sign-in: if you choose "Continue with Google", Google tells us your name, email address and profile picture.
• Google Maps: we use Google's address service to complete your home address and Google Maps to calculate distances to venues. The Service includes Google Maps features and content. Your use of them is subject to the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps/) and the Google Privacy Policy (https://policies.google.com/privacy).
• The payment provider: whether your payout account is set up, anything the provider needs you to fix (for example a document it could not verify), the bank's name and the last four digits of the account, and the status of each payout.
• Other Studios' bookings: when a Studio books you for a date, that date shows as unavailable to the other Studios you work with (Section 7.3).

4.5 Meal needs and sensitive information

• Meal needs are optional. You do not have to tell us about dietary requirements or allergies. If you do, share only what someone planning a meal needs to know.

  • We share it only with Studios that book you, so that meals on a job can be planned for you. It may be passed on to a Studio's client or venue if they provide meals on the day.
  • Allergy information is information about your health, and some dietary requirements can reveal religious beliefs. So we hold what you share on the basis of your explicit consent, which you give by adding it.
  • You can change or delete it in your settings at any time. Deleting it withdraws your consent, and affects nothing else in your account.
• What we do not want. Apart from meal needs you choose to share, we do not ask for, and do not want, information about your health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, criminal history or biometric data.
• Identity documents and tax numbers. Do not upload identity documents such as passports or driving licences to the Service (Contractor Terms, Section 9.4). Identity checks for payouts happen with the payment provider, not with us. Do not put a Social Security Number or other tax number in messages, notes, invoices or other files. The tax documentation feature is the only place for it (Section 5).
• If we find information we do not want, we will delete it.

4.6 What you need to give us. We need your name, email address and phone number to set up your account, and your home address to calculate distances and travel fees. A Studio may require a tax form before it pays you. US tax law may require a Studio that reports its payments to you, and does not have your taxpayer identification number, to withhold part of your pay ("backup withholding"). Everything else, including meal needs and a profile photo, is optional.

5.1 Why it is here. Studios that pay you may have to file information returns about those payments, and for that they need your taxpayer identification number. The Service lets you upload your form once, so that each Studio that engages you can get it from one place.

5.2 How we protect it. A Form W-9 usually contains a Social Security Number (SSN) or an Employer Identification Number (EIN), and an equivalent form for another country may contain a foreign tax number and your date of birth. So:

1. 1.the form is stored as an encrypted file, and it is encrypted whenever it moves between you, us and a Studio;
2. 2.we do not extract, parse, index, search or display the number itself, and it is not stored as a separate field or included in any report anywhere in the Service;
3. 3.only you, the owners and administrators of each Studio you work with that has set your pay rate, and the Pixally personnel who need to operate or support the feature can open the form. Studios get it through a download link that expires within minutes, never by email;
4. 4.we never email the form, and we keep its address out of our analytics, error reporting and web caching; and
5. 5.we use the form only to make it available to you and to those Studios. The only exceptions are a disclosure the law requires, and a business transfer under Section 7.11, after which these protections continue to apply.

5.3 Our Social Security Number protection policy. It is Pixally's policy to protect the confidentiality of Social Security Numbers, to prohibit their unlawful disclosure, and to limit access to them. In practice:

• the tax documentation feature is the only place in the Service where a taxpayer identification number may be submitted (Section 4.5);
• access is limited as described in Section 5.2;
• everyone at Pixally, and every service provider, who can reach tax forms is bound by confidentiality obligations;
• the tax documentation feature never displays the number, puts it in a report, or sends it by email or text message;
• if we find a Social Security Number anywhere else in the Service, we will delete it; and
• when a form is deleted, we delete it from our systems rather than keeping it in readable form, apart from encrypted backups that are overwritten on their normal cycle.

5.4 Copies a Studio keeps. When a Studio downloads your form, that copy is the Studio's. The Studio is responsible for keeping it safe and for how long it keeps it (Contractor Terms, Section 15.3). Studios often have their own legal duty to keep tax records.

5.5 How long we keep it. We keep your current form while any Studio has an Engagement with you through the Service, and for seven (7) years after your most recent Engagement ends. Then we delete it. When you upload a new form, the one it replaces is deleted. A Studio keeps any copy it already downloaded (Section 5.4). We keep forms for this period because Studios may need them to answer questions about their tax filings for past years.

5.6 Deleting it sooner. You can delete your form yourself in your account settings at any time, or ask us to delete it.

• We will delete it, subject to any period a Studio that engaged you is required by law to retain it (Contractor Terms, Section 9.3), where the law that applies to you allows that.
• Where that applies, we will tell you. We will then keep the form only for as long as the requirement lasts, make it available only to that Studio, and then delete it.
• Deleting our copy does not delete a copy a Studio has already downloaded. Ask that Studio directly.

Where the law requires a legal basis, such as in the European Economic Area, the United Kingdom or Switzerland, the basis for each use is shown beside it.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (Section 13).

7.1 Studios.

• A Studio that invites you sees the details it entered, such as your name and email address, and whether you have accepted.
• A Studio you work with can also see:

  • your profile: name, preferred name, photo, email address, phone number and website;
  • your roles and services, and the gear relevant to what it works with you on;
  • your travel settings and your distance from its jobs;
  • your availability; and
  • your drone licence.
• A Studio that has engaged you can also see:

  • your invoices and deliverables for its jobs; and
  • everything in its own records about you (Section 3.2).
• Once a Studio you work with has set your pay rate, its owners and administrators can also download your tax form (Section 5).
• Your home address. A Studio's owners and administrators can see your mailing address where they need it for tax reporting. Otherwise, Studios see your distance from their jobs rather than your address.

Within a Studio, what each of its users can see depends on the role the Studio gives them.

7.2 When a Studio stops working with you. If a Studio removes you, it keeps its records of your past work together, and you keep read-only access to those past jobs. Changes you make to your profile after that are not shared with that Studio.

7.3 Other Studios. A Studio never sees another Studio's records about you, such as what you were paid, the jobs you did or how you were rated. The only thing shared between Studios is availability: a date one Studio books you for shows as unavailable to the others, without saying who booked you or why.

7.4 Other contractors on the same job. So that the team can coordinate on the day, contractors booked on the same event may see your name, photo, role, service, general area (such as your city), email address and phone number. One example is the event summary a Studio sends before the event. They do not see your home address, your pay or your distance from the job.

7.5 A Studio's clients and venues. A Studio decides what to share with its own clients and venues. For example, it may tell a couple who is covering their day, or pass on your meal needs if the client or venue provides vendor meals. That sharing is the Studio's decision and its responsibility.

7.6 The payment provider. If a Studio pays you through the Service, the payment provider (currently Stripe) collects your identity and bank details directly from you and handles them under its own terms and privacy policy. We give it the details it needs to set up your account (your name and email address) and to make payouts, and it tells us the status described in Section 4.4. We never receive your full bank account number or your identity documents.

7.7 Tools a Studio connects. If a Studio connects its own software to the Service, such as its accounting software, the Service may send that software the Studio's records about you, such as your name and the amounts and dates it paid you. That software is the Studio's choice and its responsibility.

7.8 Service providers. We use companies that host and run parts of the Service for us, under contracts that require them to protect your information and use it only to provide their services to us. They are:

• cloud hosting, storage and database providers;
• search infrastructure;
• email and text message delivery;
• analytics and error monitoring;
• customer support tools; and
• the developers who build and maintain the Service for us.

We will give you a list of these providers on request. Google's sign-in and maps services work under Google's own terms, as described in Sections 3.4 and 4.4.

7.9 Pixally personnel. Our personnel, and the developers who operate the Service for us, can access information where they need to run, support, secure or fix the Service. They are bound by confidentiality obligations. Access to tax forms is narrower still (Section 5).

7.10 Legal and safety. We may disclose information where we believe in good faith that it is reasonably necessary to comply with a law, regulation, legal process or enforceable governmental request; to enforce our terms; or to protect the rights, property or safety of you, a Studio, the public or Pixally. We disclose tax forms only where the law requires it.

7.11 Business transfers. If Pixally is involved in a merger, acquisition, financing, reorganisation or sale of assets, personal information may be transferred as part of that transaction. We will tell you before your information becomes subject to a different privacy notice.

7.12 With your agreement. We share information in other ways when you ask us to or agree to it.

8.1 Service messages. We send you messages about your account and your work: invitations, job and schedule updates, agreement and invoice reminders, payment updates, tax form reminders, and sign-in and security messages. Your notification settings let you choose whether many of these arrive in the app or by email. Some essential messages, such as security messages, may not be switched off while you have an account.

8.2 Text messages. A Studio that turns on text reminders may send you text messages through the Service about jobs it has booked you for.

• What they are: reminders before an event, and requests to confirm that you are attending. Your replies are recorded and shared with that Studio.
• Who sends them: they come from a Pixally number on behalf of the Studio that booked you.
• How often: it depends on your bookings.
• Cost: message and data rates may apply.
• Stopping them: reply STOP to stop receiving text messages from the Service. Because Studios share the same sending number, this can stop texts from every Studio you work with through Pixally. Reply START to receive them again, or HELP for help.
• No marketing: we do not share your mobile number, or your agreement to receive text messages, with anyone for their own marketing or promotional purposes.

8.3 Emails from a Studio's workspace. When a Studio emails you from its workspace, the email arrives at your own email address. Your replies are stored in that Studio's workspace and form part of its records.

8.4 News from Pixally. We may occasionally send you news about Pixally features for contractors. You can unsubscribe at any time using the link in the email, and doing so does not affect service messages.

9.1 We intend to launch a professional directory connecting Studios with contractors (Contractor Terms, Section 13). It is not available today.

9.2 When it launches, a public profile may be created for you by default. It may show your name or business name, your disciplines and roles, the areas you work in, your general availability, your equipment, other information you have chosen to publish about yourself, and sample work from your account, as described in Section 13 of the Contractor Terms.

9.3 Before your profile goes live, we will email you, show you in the Service exactly what would be public, and give you controls to edit it, hide any field or item, or opt out entirely. You can opt out at any time, before or after launch, and opting out does not affect anything else in your account. Where the law requires your separate consent before we publish your profile, we will ask for it and will not publish your profile without it.

9.4 Your public profile will never show your home address, your tax information or what Studios pay you. Your email address and phone number will appear only if you choose to add them.

9.5 A public profile can be seen by anyone, may be indexed by search engines, and can be copied by others. When you remove something, it comes off the directory going forward, but we cannot recall copies others have already made.

9.6 Publishing your profile is not a sale of your information and is not sharing it for advertising.

10.1 The Service uses cookies and similar browser storage that are strictly necessary to sign you in, keep your session secure and remember settings such as your display theme. The Service does not work without them.

10.2 We may also use analytics and error-monitoring tools to understand how the Service is used and to find and fix problems. We configure them to keep the addresses of tax forms out of what they collect. Where the law requires your consent for these tools, we will ask for it. You can ask us to exclude you from analytics at privacy@pixally.com.

10.3 We do not use cookies or similar technology in your contractor account to show you advertising.

11.1 Pixally is based in the United States. The Service and our service providers store and process information in the United States, and some providers may also process it in other countries.

11.2 If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States. Where the law requires it, we rely on the European Commission's Standard Contractual Clauses, with the United Kingdom's addendum or the Swiss equivalent, or on another lawful transfer mechanism. You can ask us for a copy of the relevant safeguards.

13.1 Rights available to everyone. Wherever you live, you can ask us to:

• give you a copy of the information in your account;
• correct it;
• delete it or close your account;
• send it to you in a portable format;
• stop using it for a particular purpose, such as analytics or product news; or
• remove you from any public display.

You can change many details yourself in your account settings.

13.2 Information a Studio controls. For a Studio's records about you, such as its ratings, notes, pay records or signed agreements, start with that Studio, because it decides about its own records. If you cannot get a response, email privacy@pixally.com. We will help you identify the right business and press it to respond, but we cannot overrule its decisions about its own records.

13.3 What we may need to keep. If we cannot fully meet a request, we will tell you and explain why. For example, we may need to keep a tax form for a Studio's legal retention period (Section 5.6), information needed to resolve a dispute, or records the law requires us to keep.

13.4 If you are in the European Economic Area, the United Kingdom or Switzerland. You have the right to access your personal information, to have it corrected, to have it erased, to restrict how it is used, to object to its use (including where we rely on legitimate interests), to receive it in a portable format, and to withdraw consent at any time without affecting earlier use. You also have the right to complain to your local data protection authority. In the United Kingdom, that is the Information Commissioner's Office.

13.5 If you are in California or another US state with a privacy law. Depending on your state, you may have the right to know what personal information we collect, use and disclose and to get a copy; to correct it; to delete it; to opt out of the sale of your personal information, of sharing it for cross-context behavioural advertising, and of certain profiling; and not to be discriminated against for using your rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of in those categories.

The sensitive personal information we collect is:

• your account sign-in details;
• the government identifiers, and any citizenship or country details, on your tax form; and
• any meal needs you choose to share that reveal health information or religious beliefs.

We use it only to provide the Service as described in this notice, and not to infer characteristics about you. The categories of personal information we collect, its sources, our purposes, the recipients, and how long we keep it are set out in Sections 4, 6, 7 and 12.

13.6 How to make a request. Email privacy@pixally.com from the email address on your account and tell us what you are asking for.

• Verification: we will verify your identity before acting, usually by confirming that you control that email address.
• Timing: we generally respond within thirty (30) days for requests under the GDPR or UK GDPR, and within forty-five (45) days for US state requests. Where the law allows an extension, we will tell you if we need longer and why.
• Authorised agents: you can use an authorised agent where your local law allows it. We will ask for proof of the agent's authority and may still confirm your identity with you directly.

13.7 Appeals. If we decline your request, you can appeal by replying to our decision or by emailing privacy@pixally.com with "Appeal" in the subject line. We will respond within the time your local law requires and explain our decision. If you are still not satisfied, you can contact your state attorney general or your data protection authority.

13.8 We will not treat you differently or penalise you for exercising your rights.

14.1 We protect your information with technical and organisational measures appropriate to the risk. They include encryption in transit, encryption at rest for tax forms, separation between Studios' workspaces, access controls that limit who at Pixally and at each Studio can see what, download links for tax forms that expire within minutes, and confidentiality obligations on everyone with access.

14.2 Please help protect your account. Use a strong password that you do not use anywhere else, keep your email account secure, and tell us at security@pixally.com straight away if you think someone else has accessed your account.

14.3 No system is completely secure. If a security incident affects your personal information, we will investigate, take steps to contain it, and notify you and the relevant authorities where the law requires, without undue delay. If an incident affects a Studio's records, we will also tell the Studio, so that it can meet its own obligations to you.

Contractor accounts are only for people aged eighteen (18) or over (Contractor Terms, Section 4.1). We do not knowingly collect personal information from anyone under eighteen (18). If you believe someone under eighteen (18) has created an account, contact privacy@pixally.com and we will delete it.

• We do not sell your personal information.
• We do not share it for cross-context behavioural advertising, or use it to show you ads.
• We do not use your personal information to train artificial intelligence models, whether ours or anyone else's.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The Service may sort or suggest contractors to a Studio, for example by distance or availability, but the Studio decides whom to book.
• We do not extract, display, report or email the number on your tax form (Section 5).
• We do not show your home address, your tax information or what Studios pay you on any public profile.
• We do not share your mobile number, or your agreement to receive text messages, for anyone's marketing.

17.1 We may update this notice. The "Last updated" date at the top shows when it last changed.

17.2 If a change is material, we will tell you before it takes effect, by email to your account address or by a notice in the Service. Where the Contractor Terms (Section 24.2) or the law require it, we will ask you to accept it.

17.3 Earlier versions are available on request.

• Privacy questions and requests: privacy@pixally.com
• Security concerns: security@pixally.com
• General support: support@pixally.com

By post:

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to complain to your local data protection authority (Section 13.4).