Privacy & Cookies

peseta.media (the “Website”) is operated by PESETA.MEDIA LTD, a company incorporated and registered in England and Wales with company number 17495003, whose registered office is:

124 City Road
London
EC1V 2NX
United Kingdom

PESETA.MEDIA LTD (“Peseta.Media”, “we”, “us”, “our”) is the controller of personal data where we determine why and how that personal data is processed.

This notice applies to:

• creators whose content may be made available through Peseta.Media;
• publishers, brands, broadcasters, agencies and other licensing customers;
• registered Website users;
• people who contact us or make enquiries; and
• visitors to the Website.

For questions about this notice or to exercise your data-protection rights, contact:

privacy@peseta.media

We collect only information reasonably required to operate Peseta.Media and provide the relevant part of the service.

Account Data

When you register for a buyer or Client account, we may collect:

• your name;
• email address;
• company or organisation;
• job title, where provided; and
• authentication information.

Where passwords are used, we do not store your password in readable form. Passwords are stored using an appropriate one-way hashing process.

Creator Data

When you enter into the Creator General Terms, we may collect:

• your legal name;
• email address;
• telephone number, where provided;
• social-media usernames and handles;
• social-media profile URLs;
• Account information;
• profile information;
• Content associated with Accounts you have identified to us; and
• information concerning the ownership, permissions, releases or clearance status of Content.

Creator Acceptance Records

When you accept the Creator General Terms, we may retain evidence of that acceptance, including:

• your name;
• email address;
• the date and time of acceptance;
• the exact version of the Creator General Terms accepted;
• a copy or record of the full text of those Terms;
• a version identifier or cryptographic fingerprint of the Terms;
• Accounts identified by you;
• answers or declarations provided during the acceptance process;
• the acceptance action taken;
• your IP address; and
• relevant browser, device or technical information.

Unlike general Website Technical Data, the IP address associated with acceptance of the Creator General Terms may be retained in full because it forms part of the evidence that the agreement was entered into.

Creator Acceptance Records may be retained after the creator relationship ends where reasonably necessary to evidence copyright permissions, licences, sublicences, chain of title or the terms under which Content was made available.

Content and Licensing Data

We may collect or generate information relating to:

• Content made available through Peseta.Media;
• Content ownership;
• rights and clearance status;
• licence restrictions;
• Clients to whom Content has been presented or licensed;
• licence dates and terms;
• attribution information; and
• records required to administer existing licences.

Enquiry & Communications Data

If you contact us through a form, email, chat or other communication channel, we may collect:

• your name;
• email address;
• company;
• job title;
• telephone number;
• the contents of your message;
• correspondence with us; and
• information reasonably necessary to respond to your enquiry.

Transaction Data

Where applicable, we may collect:

• licensing plan;
• licences purchased;
• Content downloaded or licensed;
• order history;
• invoices;
• billing information; and
• transaction records.

We do not store full payment-card details ourselves. Where card payments are accepted, payment information is processed by the relevant payment provider.

Profile Data

Where profiles are available, this may include:

• an avatar you upload;
• an automatically assigned avatar;
• display name; and
• other optional profile information.

Technical Data

When you use the Website, we may automatically receive limited technical information such as:

• IP address;
• browser type;
• device type;
• operating-system information;
• security and authentication information; and
• technical logs.

For ordinary Website operation and security, IP addresses may be truncated, hashed or otherwise minimised where appropriate.

Creator Acceptance Records are an exception where a full IP address may be retained for evidential purposes.

Usage Data

If you consent to analytics cookies or similar optional technologies, we may collect information about how you use the Website, such as:

• pages viewed;
• clips viewed;
• searches performed;
• interactions with Website features;
• navigation through the Website; and
• related analytics events.

Where analytics requires consent, this data is not collected through those analytics technologies unless you have consented.

Advertising Data

If you consent to advertising cookies, we may record which advertisement or campaign brought you to the Website (for example, an ad click identifier or campaign tag in the link you followed) and link it to an account, enquiry or order you make, so we can tell which of our advertising works.

We may separately maintain aggregated service-level statistics that no longer identify an individual, such as total clip views or aggregate licensing activity.

We may obtain personal data:

• directly from you;
• from Accounts that you identify to Peseta.Media;
• from publicly accessible social-media profiles and platforms;
• from Clients or prospective Clients;
• from people who contact us regarding Content, copyright, permissions or ownership;
• from service providers acting on our behalf; and
• from Website and system activity generated when you use our services.

Where we obtain personal data from a source other than you, we use and disclose it in accordance with applicable data-protection law.

Under UK data-protection law, we need a lawful basis for processing personal data.

The basis depends on why we are using the information. The table below summarises our main purposes; each lawful basis is explained in more detail underneath it.

Performing our contract with you

We may process information where necessary to enter into or perform a contract with you.

Examples include:

• creating and administering an account;
• fulfilling a licence;
• providing Content or download access;
• processing an order;
• administering licensing arrangements;
• entering into and administering the Creator General Terms;
• identifying the Accounts covered by the Creator General Terms;
• recording the rights granted to Peseta.Media;
• communicating with creators about Content and licences; and
• sending confirmation that Creator General Terms have been accepted.

Certain information is necessary for us to enter into or administer these arrangements.

If you do not provide required information, we may be unable to provide the relevant service or enter into the relevant agreement with you.

Legitimate interests

We may process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and developing our content-licensing business;
• identifying and presenting potentially licensable Content;
• maintaining evidence of copyright ownership, permissions and chain of title;
• retaining evidence of creator agreements;
• administering existing licences;
• protecting Peseta.Media and its Clients against copyright or ownership disputes;
• preventing fraud, abuse and misuse;
• maintaining Website and information security;
• investigating rights disputes and complaints;
• protecting and enforcing legal rights;
• defending legal claims;
• understanding non-identifying, aggregated service performance; and
• protecting the legitimate commercial interests of Peseta.Media, creators and Clients.

Where we rely on legitimate interests, you may have the right to object. See Your rights below.

Consent

We rely on consent where required for particular optional processing, including:

• optional analytics cookies or similar technologies;
• optional advertising cookies or similar technologies; and
• marketing emails where consent is required and you have actively opted in.

You may withdraw consent at any time.

Withdrawing consent does not affect processing carried out before withdrawal and does not affect processing we carry out under another lawful basis.

Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations, including:

• accounting and tax requirements;
• responding to lawful requests from authorities;
• maintaining legally required business records; and
• complying with court orders or other legal obligations.

Establishing and defending legal rights

Personal data may also be retained or used where reasonably necessary to establish, exercise or defend legal claims, including copyright, ownership and licensing disputes.

Where you are a creator, certain personal information may need to be disclosed to Clients or prospective Clients in connection with Content.

This may include:

• creator name;
• social-media handle;
• Account information;
• Content source;
• attribution information;
• information relating to ownership or permissions; and
• other information reasonably necessary to demonstrate or administer licensing rights.

We only disclose information that is reasonably relevant to the licensing, attribution, rights-management or administration of the Content.

This section is our cookie policy. It explains what cookies and similar technologies are, which ones the Website uses and why, and how you can control them.

What are cookies?

Cookies are small text files that a website stores in your browser when you visit it. They let the website recognise your browser on later requests and visits, for example to keep you signed in or to remember a choice you made.

Similar technologies work in comparable ways. They include local storage (data a website keeps in your browser, such as the contents of a basket) and scripts that check a visitor is a person rather than an automated program.

Cookies set by the website you are visiting are first-party cookies. Cookies set by another company's service used on that website are third-party cookies.

How we use them

We use as few cookies and similar technologies as reasonably practicable. Anything beyond what is strictly necessary only runs if you agree to it.

They fall into three categories:

• Strictly necessary: required for the Website to work or to provide something you have asked for, such as signing in, keeping the Website secure, keeping items in your trolley and remembering your cookie choice. These do not require consent and cannot be switched off in our cookie controls.
• Analytics: help us understand how the Website is used, for example which pages and clips are viewed, which searches are made and how people move through the Website. We use our own analytics and Google Analytics. These only operate if you choose “Accept all” or tick “Analytics Cookies” in our cookie controls.
• Advertising: help us measure whether our ads lead to sign-ups, enquiries and purchases, and let us show our ads to people who have visited the Website. We use Google Ads for this. These only operate if you choose “Accept all” or tick “Advertising Cookies” in our cookie controls.

Declining analytics or advertising cookies does not stop you using any part of the Website.

What we use them for

Third-party services

• Security checks: some of our forms use a third-party security service to confirm they are being sent by a person rather than an automated program. It processes limited technical information, such as your IP address and browser details, only for that purpose and not for advertising.
• Google: if you accept analytics or advertising cookies, Google Analytics and Google Ads are loaded on the Website and set their own cookies. Google receives information such as the pages you visit, your IP address and browser details, and the ad you arrived from. We use Google Consent Mode, so Google is told which of these you allowed, and nothing from Google loads until you have made a choice that allows it. See how Google uses information from sites that use its services and Google's privacy policy.
• Stripe: when you pay by card you are taken to a checkout page hosted by Stripe, which may set its own cookies on that page to process the payment securely and prevent fraud. Stripe does not set cookies on the Website itself. See Stripe's privacy policy.

Links in our messages

We may count how often links in some of our messages are used. No cookie is set for this, and the information recorded cannot be used to identify you or follow you over time.

Managing your choices

You can change or withdraw your analytics or advertising choice at any time using Cookie settings at the bottom of every page. Your new choice applies from that moment and does not affect anything collected before it. You can also control the ads Google shows you in Google's My Ad Center.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the Website, such as signing in, from working, and deleting cookies will remove your saved cookie choice. Instructions for the main browsers:

• Google Chrome
• Apple Safari
• Mozilla Firefox
• Microsoft Edge

On phones and tablets, the same controls are in your browser app's settings.

Do Not Track and similar signals

Some browsers can send a “Do Not Track” or similar privacy signal. Analytics and advertising cookies stay off unless you opt in, and we do not currently change how the Website behaves in response to these signals. Use Cookie settings to control them.

Changes to the cookies we use

The cookies and technologies we use may change as the Website develops. We will keep the table above up to date and will ask for your consent again before introducing any new optional cookies.

We do not sell personal data to advertisers or data brokers.

We may share personal data with categories of recipients including:

Clients and prospective Clients

Where reasonably necessary to present, license, attribute or administer Content.

Email and communications providers

To send account, contractual, licensing, order, enquiry and other service-related communications.

Cloud-storage and hosting providers

To host the Website, Content, images, files and associated infrastructure.

Database providers

To securely store the information required to operate the service.

Payment providers

Where payments are processed.

Rights-management and verification providers

Where reasonably necessary to verify Content, ownership, licensing or permissions.

Analytics and advertising partners

Google (Google Analytics and Google Ads), only if you accept analytics or advertising cookies. See Cookies and similar technologies.

Professional advisers

Including solicitors, accountants, auditors and insurers.

Contractors and service providers

Where they provide services to Peseta.Media and process personal data on our behalf.

Courts, regulators and public authorities

Where disclosure is required or permitted by law.

Parties involved in rights disputes

Where reasonably necessary to investigate or resolve a copyright, ownership, privacy or other legal claim.

Corporate transactions

We may disclose appropriate information to prospective purchasers, investors, acquirers and their advisers in connection with a proposed investment, merger, acquisition, restructuring or sale of some or all of our business or assets, subject to appropriate safeguards where applicable.

Service providers processing data on our behalf are required to handle that information only in accordance with our instructions and applicable data-protection requirements.

We primarily use data centres in the United Kingdom. Some Clients and service providers are located outside the United Kingdom, including in the United States.

As a result, personal data may sometimes be transferred to or accessed from another country.

Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate lawful mechanism, which may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), where a US recipient is certified under it; or
• another transfer mechanism permitted under UK data-protection law.

You can contact privacy@peseta.media if you would like further information about safeguards relevant to an international transfer of your personal data.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or subsequently lawfully processed.

More detail on each category follows.

Accounts and transaction records

Generally retained while your account is active and for an appropriate period afterwards where necessary for:

• accounting;
• tax;
• legal;
• fraud-prevention; or
• contractual purposes.

Enquiries and communications

Kept for as long as reasonably necessary to deal with the enquiry or maintain an appropriate business record.

Information may subsequently be deleted or anonymised where it is no longer required.

Analytics

Raw optional analytics events, where collected with consent, may be retained for up to 24 months before being deleted or converted into aggregated information that no longer identifies individuals.

Cookie-consent records

Retained for as long as reasonably necessary to remember your preference and demonstrate compliance.

Creator Acceptance Records

Creator Acceptance Records may be retained for as long as reasonably necessary to evidence:

• the Creator General Terms accepted;
• copyright permissions;
• rights granted to PESETA.MEDIA LTD;
• Client licences and sublicences;
• chain of title; and
• the establishment, exercise or defence of legal claims.

These records may need to remain after a creator terminates their relationship with Peseta.Media because licences granted while the agreement was active may continue afterwards.

Content and licensing records

Records relating to Content and Client licences may be retained for the duration of the relevant licence and afterwards where reasonably necessary to maintain evidence of rights granted or to manage potential legal claims.

When determining retention periods, we may consider:

• the duration of our relationship with you;
• the duration of relevant Client licences;
• applicable legal limitation periods;
• accounting and tax requirements;
• actual or potential disputes;
• the need to evidence copyright permissions or chain of title; and
• the nature and sensitivity of the information.

We may use automated or algorithmic tools to assist with activities such as:

• Content discovery;
• categorisation;
• search;
• recommendations;
• duplicate detection;
• moderation; and
• identifying Content that may be relevant to Clients.

Unless we specifically tell you otherwise, we do not use solely automated decision-making that produces legal effects or similarly significant effects concerning you.

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration; and
• unauthorised disclosure.

The measures used depend on the nature of the information, the technology available and the risks involved.

No internet-based system can be guaranteed to be completely secure, but we take reasonable measures designed to protect the information entrusted to us.

Depending on the circumstances and the lawful basis on which we process your information, UK data-protection law may give you the right to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete information.
• Ask us to delete personal data where there is no lawful reason for us to continue retaining it.
• Restrict processing in certain circumstances.
• Object to certain processing.
• Receive certain information in a portable format where the right to data portability applies.
• Withdraw consent at any time where we rely on consent.

These rights are not absolute. For example, we may need to retain Creator Acceptance Records even after a deletion request where those records are reasonably required to evidence existing copyright licences or establish, exercise or defend legal claims.

To exercise a data-protection right, contact:

privacy@peseta.media

We may need to verify your identity before completing a request.

There is normally no charge. We will respond within one month of receiving your request. If a request is complex, or you have made several, we may extend this by up to two further months, and we will tell you within the first month if we need to.

We may refuse a request, or part of one, where the law allows it, for example where a request is manifestly unfounded or excessive, where we cannot verify your identity, or where complying would affect other people's rights. If we refuse, we will explain why.

Your right to object

Where we process your personal data on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

If you object, we will consider whether we have compelling legitimate grounds to continue processing the information or whether it is required for legal claims.

You may object to the use of your personal data for direct marketing at any time.

Complaints

If you are unhappy with how we handle your personal data, please contact us first at:

privacy@peseta.media

You also have the right to complain to the UK Information Commissioner’s Office (ICO), the UK's data-protection regulator:

• website: ico.org.uk;
• telephone: 0303 123 1113; or
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Certain personal data may be required to:

• create an account;
• purchase or administer a licence;
• identify a creator;
• enter into the Creator General Terms;
• identify Accounts covered by those Terms;
• communicate with you; or
• maintain evidence of copyright and licensing rights.

Where information is necessary for a contract and you do not provide it, we may be unable to enter into or perform that contract or provide the relevant service.

The Website is not directed at children under 13, and we do not knowingly collect personal data from children under 13 through the Website.

Creators entering into the Peseta.Media Creator General Terms must be at least 18 years old.

If you believe that a child has provided us with personal data in circumstances where we should not hold it, contact:

privacy@peseta.media

and we will investigate and take appropriate action.

We may update this Privacy & Cookies notice where:

• our services change;
• the personal data we process changes;
• our service providers or technologies change;
• legal or regulatory requirements change; or
• our processing activities otherwise materially change.

When we update this notice, we will update the “Last updated” date at the top of the page.

Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected individuals before beginning materially different processing where required by law.