Event: SuperPower Summit (BCF23) 2023 · T&Cs version 1.4

1. What This Page Is For

Global Counsel Forum ("GCF", "we", "us", "our") operates a photo gallery for SuperPower Summit (BCF23) 2023 ("the Event"). This page explains, and asks for your consent to, a specific feature of that gallery: facial recognition matching, which lets you find photos of yourself, and lets other attendees of this Event who also consent find photos of you, across this Event's photo collection.

This consent applies to this Event only. If you attend a future GCF event with a similar gallery, you will be asked to consent again separately for that event; your face data and consent for one year's Event does not carry over automatically to another.

This is separate from, and in addition to, our general photography and event terms. You are only asked to read and sign this notice if you choose to use the self tagging / photo search feature. If you do not wish to use this feature, you do not need to sign it, and photos of you may still exist in the general (non searchable) gallery under our standard event photography terms.

2. What We Are Actually Doing

• To tag yourself, you browse this Event's photo gallery, choose a photo you appear in, and click your own face within that photo. We then create a mathematical representation of your face (a faceprint or face embedding) from a small, cropped portion of that photo covering only your face, not the rest of the photo or anyone else who appears in it.
• We then use that faceprint to automatically find and label other photos from this Event's collection that also contain your face.
• Once you are tagged, any other attendee of this Event who has also signed this consent notice will be able to search the gallery by name and see the photos matched to you. Your name is shown alongside photos found this way, in the same way it would be if someone tagged you by hand.
• Your email address, and the record of your consent, are kept privately by GCF for administration and compliance purposes only. They are never displayed to other attendees or made public. Only your name is visible to other consenting attendees, as part of the search results feature described above.
• Your faceprint and the resulting tags are kept indefinitely unless and until you ask us to delete them (see Section 7).
• To make the gallery searchable, faces appearing in this Event's photos are grouped automatically so that the same person's photos can be shown together. This grouping is done on photographs GCF already holds and is entitled to use under the ticket terms you agreed to when booking, and it attaches no name or contact details to anyone. A group only becomes identified when that person chooses to tag themselves, which is what this notice asks your consent for.
• We use a third party facial recognition service (Amazon Web Services Rekognition) to perform the matching. See Section 6.

3. Legal Basis and Special Category Data

Facial recognition data is biometric data for the purpose of uniquely identifying a natural person, and is classed as special category data under UK GDPR (Article 9). We rely on your explicit, informed, freely given consent as the legal basis for this specific processing (UK GDPR Article 9(2)(a)). This is separate from, and additional to, any legal basis (such as legitimate interests) we rely on for general event photography.

You may decline to give this consent without any impact on your attendance at the Event or any other GCF services. Declining only means you will not be enrolled in the searchable, face matched gallery for this Event.

4. What You Are Consenting To

By ticking the boxes and submitting the form, you confirm that you understand and agree that:

• You will select a photo from this Event's gallery in which you appear, and click your own face within it. A faceprint will be generated from a cropped portion of that photo covering only your face.
• That faceprint will be used to automatically scan and match your face against this Event's photo collection.
• Photos matched to you will be tagged with your name.
• Any other attendee of this Event who has also given this consent will be able to search for your name and view the photos matched to you. This is a shared, cross attendee search feature, not a private find my own photos tool.
• Your name will be visible to other consenting attendees through this feature. Your email address and consent record will not be shared with other attendees or made public, and are held by GCF for administration and compliance only.
• Your faceprint and associated tags will be stored indefinitely, until you request their deletion (Section 7).
• Your data will be processed by Amazon Web Services (Rekognition) as our data processor, as described in Section 6.
• You may withdraw this consent at any time, which will result in the deletion of your faceprint and the removal of your face tags from this Event's gallery, in line with Section 7.

5. What We Do NOT Use This For

• We do not use this facial recognition system for security, surveillance, access control, or to monitor attendance.
• We do not display or share your email address or consent record with other attendees or the public.
• We do not share your faceprint or tagged photos with third parties outside this Event's gallery, other than our processor named in Section 6.
• We do not use your faceprint for any automated decision making that produces legal or similarly significant effects concerning you.
• We do not attach your name, email address or any other contact details to your face unless you choose to tag yourself, which is what this notice asks your consent for.

6. Third Party Processor: Amazon Web Services

We use Amazon Web Services (AWS) Rekognition to generate and match faceprints. AWS acts as our data processor under the terms governing our AWS account, including the AWS Service Terms and AWS's Data Processing Addendum. Face data is transmitted to and processed within AWS's Europe (London) region (eu-west-2), so it stays within the UK. AWS Rekognition does not store the original photo you upload for matching, only the derived facial feature data needed to perform the search; it also does not use this data to improve its own products or other customers' services.

7. Your Rights, Withdrawal, and Deletion

Because your faceprint is stored indefinitely rather than on a fixed retention schedule, the ability to withdraw consent and request deletion is your primary control over this data, and we want to make it easy to use.

• You may withdraw your consent and request deletion of your faceprint and all associated photo tags for this Event at any time, free of charge, by emailing [PRIVACY EMAIL] or using the "Delete my face data" option on this Event's gallery page.
• We will action deletion requests within [X, to be confirmed] days.
• Deletion removes your faceprint from this Event's matching system and removes your name/tag from matched photos. It does not delete the underlying photographs themselves from the general Event gallery, which are retained under our standard event photography terms. It also does not affect your enrollment, if any, in a different year's gallery, each Event's consent and data are separate.
• You also have the right, under UK GDPR, to access the data we hold about you, correct it, restrict its processing, and lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Children

This facial recognition feature is only available to Event attendees aged 18 and over. [Event attendee age policy to be confirmed; if under 18s can attend, this section requires specific additional safeguards.]

9. Photo Ownership and General Event Terms

This notice governs the facial recognition feature only. It sits alongside, and does not replace, GCF's general Event photography terms and the SuperPower Summit (BCF23) 2023 Terms and Conditions, which continue to apply to all photography taken at the Event.

10. Contact

Questions about this notice, or to exercise any of the rights above, contact [PRIVACY EMAIL].

This notice is a starting draft and has not yet been reviewed by a solicitor. If you are seeing this message, GCF has not yet confirmed this text is ready for live use.