This policy explains what personal data taffye collects, why we use it, who we share it with, how long we keep it and what rights you have. It applies to visitors of this website, people who apply to become taffye models, the models we represent, and the clients and partners who contact us.
1. Who is responsible for your data
The controller of your personal data is Taffye Limited, a company registered in England and Wales, 30 Churchill Place, London, England, E14 5RE. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, where they apply to our offices in the European Union, the EU GDPR.
For any question about this policy or your data, write to [email protected] with "Privacy" in the subject line.
2. What we collect and why
Visitors of the website
When you visit the website, our servers and our security provider automatically process your IP address, browser and device information, the pages you request and the time of the request. We use this to deliver the website, keep it secure, prevent abuse and fix errors. We also remember your chosen language and office city and, if you have one, your access or partner token, using the cookies described in our Cookie policy.
We also use Microsoft Clarity, in its cookieless mode, to see how the website is used: pages opened, clicks, scrolling and anonymised session replays. Text typed into forms is masked. We use this only to improve the website, not to identify you or for advertising.
If you open the website through a personal invitation link, we also record, for that invitation, the time of your visits, the pages you viewed, how long you stayed, and the approximate country and city derived from your IP address. We use this to see whether an invitation was used and to follow it up.
Legal basis: our legitimate interests in running a secure, working website.
Model applicants
If you apply through "Become a model", we collect your name, email address, phone number, city, height, links to your social media and portfolio, the photographs and CV you send, your message, the IP address the application came from with the approximate country and city derived from it, your device and browser type, the page you came from, and the pages of this website you opened during that visit before sending the form. We use them to assess your application, to contact you about it and to protect the form from abuse.
Legal basis: your consent, given when you submit the form, and the steps needed before possibly entering into a representation agreement with you. You can withdraw your consent at any time by emailing us; we will then delete your application.
Photographs can reveal information about your appearance from which ethnic origin or health might be inferred. We do not use your photographs to draw such conclusions; we look at them only to assess your suitability as a model. Please do not send us any other special category data (for example about health, religion or sexuality) unless we ask for it for a specific reason.
We accept applications only from people aged 18 or over. If we learn that an application came from someone under 18, we delete it together with the photographs.
Models we represent
For the models we represent we hold contact and identity details, measurements, photographs and video, booking and payment records, and the information needed to look after their safety on set. We publish a model's name, photographs, measurements, hair and eye colour and city on the website and share their portfolio with clients and partners to find them work.
Legal basis: performance of the representation agreement with the model, our legal obligations (including as an employment agency and for tax and accounting), and the model's consent for publication of their profile. Represented models receive a separate, more detailed privacy notice with their agreement.
Clients, partners and enquiries
If you request a commercial proposal or partner access, we collect your organisation, website, your name and position, email address, phone number, your message, the office and language of the page you used, and your IP address. If you email us, we receive your message and contact details. We use this to reply, prepare a proposal, manage our relationship and any engagements, and to issue and control partner tokens.
Legal basis: steps taken at your request before entering into a contract, performance of a contract, and our legitimate interests in developing and managing our business relationships.
3. Who we share data with
We never sell personal data. We share it only where needed:
- Within taffye - between our team and offices in London, Prague, Zagreb, Krakow and Kyiv, so that the right office can deal with an application or project.
- With clients and partners - a represented model's portfolio and relevant details, to propose them for work. We never share an applicant's details with clients unless they become a taffye model.
- With our service providers - our hosting provider, Cloudflare (content delivery and security), Google Fonts (which receives your IP address when your browser loads the website's fonts), Microsoft (Clarity usage statistics), and our email and IT providers. They act on our instructions and are bound by data processing terms.
- With professional advisers and authorities - our accountants, lawyers and insurers, and public authorities or courts where the law requires it, or to protect the rights and safety of our models, clients or others.
- In a business transfer - if our business or part of it is sold or reorganised, to the new owner, under the same protections.
4. International transfers
Some recipients, including our office in Kyiv and some of our service providers, are located outside the United Kingdom and the European Economic Area. Where a country is not covered by an adequacy decision, we protect your data with appropriate safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. You can ask us for a copy of the relevant safeguards.
5. How long we keep data
- Model applications that do not lead to representation - up to 12 months from the date of application, then deleted together with the photographs and CV. You can ask us to delete yours sooner.
- Partner and proposal requests that do not lead to an agreement - up to 24 months, then deleted.
- Represented models and clients - for the duration of our relationship and then for 6 years, which is the period during which legal claims can be made and accounting records must be kept. Published profiles are removed from the website when representation ends.
- Server and security logs - for a short period, normally no longer than 60 days, unless needed to investigate an incident.
6. Your rights
Under data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data based on legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on consent.
To exercise a right, email [email protected]. We may need to confirm your identity first. We will reply within one month. Exercising your rights is free of charge.
If you are not satisfied with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
7. Security
The website is served only over encrypted connections. Applications, photographs and CVs are stored in a private area that is not publicly accessible and can be opened only by authorised staff after logging in. Access to our systems is limited to people who need it for their work. No system is perfectly secure, but we take appropriate technical and organisational measures and will notify you and the regulator of a personal data breach where the law requires it.
8. Automated decisions
We do not make decisions about you based solely on automated processing. Every application is reviewed by a person.
9. Changes to this policy
We may update this policy. The current version is always on this page with its "last updated" date. If a change materially affects how we use data we already hold, we will tell the people concerned.