Legal
Image Approvals Privacy Policy
What personal data we hold, why we hold it, who we share it with, and the rights you have over it under UK data protection law.
Last updated: 27 October 2026 Version 2
Image Approvals runs image approvals for film and TV productions. Productions share set and publicity stills with the cast who appear in them, so the cast (or their representatives) can approve each image or ask for it not to be used. This policy explains what personal data that involves and how we look after it. It also covers this website.
ShootBuddy, our scheduling product, has its own privacy policy inside the ShootBuddy platform.
1. Who we are
Image Approvals Ltd ("Image Approvals", "we", "us"), 13 Portland Road, Edgbaston, Birmingham, B16 9HN. Registered in England and Wales, company number 11685628. Registered with the Information Commissioner's Office, registration number ZB185861. Contact us at info@imageapprovals.com.
2. Our role: controller and processor
Production content. The photos on a production, the tags that link people to them, captions, approval and kill decisions, viewing records and who has access all belong to the production company that hired us. Under data protection law the production company is the controller: it decides why and how that data is used. We are its processor and handle that data only on its instructions, under our Terms and its contract with us. Questions about how a production uses photos of you are best sent to the production. If you send them to us, we will pass them on.
Accounts, enquiries and this website. We are the controller of your platform account (name, email address, password, two-factor settings and sign-in records), of enquiries and access requests, and of data collected through this website.
3. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Account details: name, email address, username, role, company and production | To set up your account and show you the productions and photos you are allowed to see | Contract, or our legitimate interest in running the service for the production that invited you |
| Security data: password (stored only as a one-way hash), two-factor settings, sign-in attempts, IP addresses | To keep accounts and unreleased images secure | Legitimate interests (security) |
| Production content: photos (which may show your face and appearance), filenames, captions and tags | To run the approvals process for the production | The production's instructions (it decides the legal basis as controller) |
| Your review activity: which photos you viewed, approved or killed, and when | To record approvals and give the production an accurate approval record | The production's instructions |
| Enquiries, access requests and quote forms: name, email, phone number, company and job role | To reply to you and decide access requests | Legitimate interests, or steps before a contract |
| Service emails we send you | Invitations, password resets, approval reminders and account notices | Contract or legitimate interests |
| Error reports and technical data: browser, device and the page where an error happened | To find and fix faults | Legitimate interests |
We do not sell personal data, use it for advertising, or let anyone use your photos to train AI models. We only send marketing emails to business contacts who have agreed to receive them or who are existing customers, and every one includes a way to unsubscribe.
Photos can incidentally reveal other information about a person, such as health or religion. We don't analyse photos for this. The production is responsible for having a lawful basis for the photos it shares with us, including photos of children.
5. How long we keep data
We keep personal data only as long as we need it. Photos are removed at the production's Project Close Date and permanently deleted soon after. An audit record of what was approved and delivered is kept for at least 6 years for audit and disputes. Accounts not used for a year are closed after warning emails. Our Data Retention Policy has the details.
6. Documents available on request
Production companies and their legal teams can ask for our data protection pack. It contains our Data Processing Agreement, full sub-processor list, detailed retention schedule and security overview, plus notes on any processing a production asks us to carry out. Email info@imageapprovals.com and we'll send it, and let you know when the sub-processor list changes.
7. Security
All connections are encrypted, and two-factor sign-in is available. Each account sees only the productions and photos its permissions allow. Access to our own systems is restricted and protected by multi-factor authentication. No system is perfectly secure, and we will tell you without undue delay if a breach affects your data.
8. Your rights
You have the right to ask for a copy of your personal data, and to have it corrected or deleted. You can also ask us to restrict how we use it, object to us using it on the basis of legitimate interests, and in some cases have it in a portable format. Email info@imageapprovals.com.
For your account and enquiries, we reply within one calendar month. For production content, we pass your request to the production (the controller) without undue delay and help it respond.
9. Complaints
If you are unhappy with how we have handled your personal data, email info@imageapprovals.com with "Data protection complaint" in the subject line. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11. Changes to this policy
When we change this policy we update the date and version at the top of this page. If a change is significant, we will tell platform users by email or in the platform.