TSS Photography – Biometric Information Policy

TSS Photography is a network of independently owned and operated franchise businesses. These businesses may use technology provided by Candid Color Systems, Inc. (“CCS”), including tools that enable image recognition or face matching.

This Biometric Information Policy explains how biometric data may be collected, used, and processed in connection with TSS Photography services and CCS-powered platforms.

This policy applies to:

• Visitors to TSS Photography websites
• Individuals whose images are captured at events or photography sessions
• Users of online galleries and image search tools powered by CCS

In this context:

• Local TSS Photography franchisees interact directly with customers and capture images and (where required) consent
• CCS provides the technology used to process images and enable certain features

Facial recognition features are optional and must be affirmatively enabled by the photographer, or franchisee.

If facial recognition is not enabled, we do not collect or process biometric identifiers.

“Biometric data” generally refers to data derived from unique biological characteristics, such as facial geometry, that can be used to identify an individual.

For purposes of this policy, biometric data may include:

Biometric Identifier means a retina or iris scan, fingerprint, voiceprint, or scan of face geometry.

Biometric Information means any information based on a biometric identifier that is used to identify an individual.

Biometric identifiers do not include:

• Photographs
• Video recordings
• Physical descriptions
• Demographic data
• Information derived from photographs unless used to create a facial template for identification

Biometric processing may occur only when specific features are enabled, such as:

• Face search (allowing users to find their images using a photo)
• Image matching or grouping based on facial characteristics

If these features are not used, biometric data is not collected or processed.

We do not collect:

• DNA
• Retina scans
• Fingerprints
• Voiceprints
• Health or medical biometric data

Biometric data is generated solely for the purpose of identifying and grouping images of the same individual within a gallery.

Biometric data is:

• Not sold
• Not leased
• Not traded
• Not used for advertising
• Not used for profiling
• Not used for automated decision-making

Because TSS Photography operates through independent franchisees supported by CCS technology, responsibilities are divided as follows:

• Franchisees / Photographers
  • Capture images
  • Interact with customers
  • Provide required notices and obtain consent where required by law
• Candid Color Systems, Inc. (CCS)
  • Provides the platform and technology
  • Processes biometric data solely to deliver services such as image matching or search
  • Does not control the operations of independent franchisees

Franchisees and other CCS customers are responsible for complying with applicable biometric privacy laws.

Where required by law, biometric data will only be collected or processed after appropriate notice and consent have been obtained.

In the TSS Photography context:

• The local franchisee or photographer is responsible for informing individuals about the use of biometric-enabled features
• Consent must be obtained before biometric data is collected or used where required by applicable law
• CCS relies on its customers (including franchisees) to confirm that such consent has been obtained

Facial recognition features are activated only when:

1. The photographer or studio affirmatively enables the feature; and
2. Required consents are obtained where applicable under law.

Where required by law, written consent must be obtained from the individual (or parent/guardian for minors) before biometric data is collected.

Photographers and franchisees are responsible for obtaining legally required releases and consents from their subjects.

By enabling facial recognition, the franchisee represents and warrants that it has obtained all legally required consents.

Biometric data is used solely to support specific functionality, such as:

• Helping users locate their images more efficiently
• Improving image organization and delivery

Biometric data is not sold and is not used for unrelated purposes such as advertising.

Biometric data is retained only for the shortest period necessary to fulfill the purpose of collection.

Biometric data will be permanently deleted when the earliest of the following occurs:

1. The user requests deletion in writing.
2. The associated account or gallery is deleted.
3. The facial recognition feature is disabled.
4. Three (3) years after the individual’s last interaction with the platform; or
5. As otherwise required by applicable law.

Deletion is permanent and irreversible.

Biometric data may be shared only as necessary to provide services, including:

• Between franchisees and CCS for processing and fulfillment
• With service providers acting on behalf of CCS under appropriate safeguards

Biometric data is not disclosed to third parties except as required to provide services or comply with legal obligations.

Candid does not:

• Sell biometric identifiers
• Profit from biometric data
• Use biometric data for advertising
• Use biometric data for cross-platform tracking

Biometric data is used solely to provide requested facial recognition functionality.

Where biometric-enabled features are offered, individuals may have the option to:

• Decline to use face search or similar features
• Request removal of images or associated data, where applicable

Requests may be directed to the local TSS Photography business or through the contact information below.

Individuals may:

• Request confirmation of whether biometric data is being processed
• Request deletion of biometric data
• Withdraw consent (where applicable)
• Disable facial recognition (through the studio or account holder)

Requests may be submitted to:

ccssupport@candid.com

We may require identity verification before fulfilling requests.

Where facial recognition is used for minors (e.g., school photography, youth sports):

• Photographers/studios must obtain parental or guardian consent where required by law.
• We rely on photographers and studios to ensure lawful collection.

We will delete biometric data of minors upon verified request from a parent or guardian.

We use reasonable administrative, technical, and physical safeguards to protect biometric data, including:

• Encryption in transit and at rest (where applicable)
• Access controls and authentication restrictions
• Secure cloud storage environments
• Restricted internal access to authorized personnel only

However, no security system is completely impenetrable.

For questions about biometric data related to a specific event or photography session, please contact the local TSS Photography business that provided the services.

For questions about CCS technology or data processing practices, contact:

Email: ccssupport@candid.com

Mailing Address:

Candid Color Systems, Inc

1300 Metropolitan Ave

Oklahoma City, OK 73108