PRIVACY POLICY 

Last Updated: 18/09/2026

IMPORTANT NOTICE

This Privacy Policy explains how Erolos (“Erolos”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data when you interact with Erolos, including through our website, social media channels, creative projects, photoshoots, events, applications, submissions, communications and other services or activities operated by Erolos.

Erolos is committed to handling personal data responsibly and in accordance with applicable data protection law, including the General Data Protection Regulation (“GDPR”) and applicable Irish data protection legislation.

This Privacy Policy should be read alongside any applicable Erolos terms, agreements, consent forms and other notices provided to you.

The final legal identity and address of the entity responsible for Erolos should be confirmed and inserted following legal review.

1. DATA CONTROLLER

1.1. The organisation responsible for determining how and why your personal data is processed is the relevant Erolos legal entity operating the applicable service or Project (“Erolos”).

1.2. The final version of this Privacy Policy should identify the exact legal name and registered/business address of the relevant Erolos entity.

1.3. Depending on the circumstances, Erolos may act as a data controller or, where legally appropriate, as a data processor on behalf of another organisation.

2. PERSONAL DATA

2.1. “Personal data” means information relating to an identified or identifiable individual.

2.2. Depending on how you interact with Erolos, we may process different categories of personal data.

2.3. We seek to collect only personal data that is reasonably necessary for the relevant purpose.

3. PERSONAL DATA WE MAY COLLECT

Depending on your interaction with Erolos, we may collect:

3.1 Identification and Contact Information

This may include:

• name;

• email address;

• telephone number;

• social media username or handle;

• postal or delivery address where required;

• date of birth or age where reasonably necessary; and

• other information you voluntarily provide.

3.2 Applications and Creative Submissions

If you apply to work with Erolos, participate in a Project or submit creative material, we may collect:

• portfolio information;

• photographs;

• social media profiles;

• creative work;

• areas of creative expertise;

• availability;

• relevant Project information;

• communications and messages; and

• other information reasonably necessary to assess or administer your involvement.

3.3 Participant and Model Information

Where you participate in a photoshoot, filming session, event or other Project, we may process information necessary to administer your participation, including:

• name;

• contact details;

• age or date of birth where required;

• consent and release records;

• payment or expense information where applicable;

• emergency or safeguarding information where legitimately required; and

• records concerning your participation.

3.4 Photographs, Video and Audio

If you participate in an Erolos Project, your:

• image;

• likeness;

• voice;

• appearance;

• performance; and

• other identifiable characteristics

may be captured in photographs, video, audio recordings or other Erolos Content.

Such material may constitute personal data under applicable data protection law.

3.5 Technical Information

When you use our website or digital services, we may collect information such as:

• IP address;

• browser type;

• operating system;

• device information;

• approximate location derived from technical information;

• pages visited;

• referring websites;

• interaction data;

• timestamps; and

• other technical information generated through use of our services.

3.6 Cookies and Similar Technologies

We may use cookies, pixels, tags, local storage and similar technologies.

The types of technologies used and the purposes for which they are used will depend on the relevant website and services.

4. SOURCES OF PERSONAL DATA

We may obtain personal data:

(a) directly from you;

(b) when you contact Erolos;

(c) when you submit an application, form, portfolio or creative proposal;

(d) when you participate in an Erolos Project;

(e) through publicly available professional or social media information;

(f) automatically through use of our website or digital services;

(g) from Project partners or professional collaborators where lawful and necessary; or

(h) from another lawful source.

5. PURPOSES OF PROCESSING

Depending on the circumstances, Erolos may process personal data for purposes including:

(a) responding to enquiries;

(b) reviewing creative submissions;

(c) assessing applications and potential collaborations;

(d) organising and administering Projects;

(e) communicating with participants and creative contributors;

(f) maintaining records of consent and contractual arrangements;

(g) creating, editing, publishing and distributing Erolos Content;

(h) marketing and promoting Erolos and its Projects;

(i) operating and improving our website and digital services;

(j) managing events and productions;

(k) processing payments and expenses where applicable;

(l) protecting the safety and security of participants, staff and Project Personnel;

(m) preventing misuse, fraud or unlawful activity;

(n) complying with legal and regulatory obligations;

(o) establishing, exercising or defending legal claims; and

(p) other purposes that are reasonably compatible with the purpose for which the information was originally collected, where permitted by law.

6. LAWFUL BASES

6.1. Erolos will process personal data only where it has a valid legal basis under applicable data protection law.

6.2. Depending on the circumstances, the legal basis may include:

(a) Consent
Where you have freely provided specific, informed and unambiguous consent.

(b) Contract
Where processing is necessary to enter into or perform a contract with you.

(c) Legal obligation
Where processing is necessary to comply with a legal or regulatory obligation.

(d) Legitimate interests
Where processing is necessary for Erolos's legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

6.3. Erolos will determine the appropriate lawful basis for the particular processing activity rather than treating all processing as consent-based.

6.4. Where Erolos relies on legitimate interests, the relevant interests and balancing considerations should be documented where required.

7. SPECIAL CATEGORIES OF PERSONAL DATA

7.1. Special categories of personal data include information such as health information, biometric data used for identification, racial or ethnic origin, political opinions, religious beliefs, and other categories defined by applicable law.

7.2. Erolos does not intentionally seek to collect special category data unless there is a legitimate and lawful reason to do so.

7.3. Where special category data is required, Erolos will ensure that an appropriate legal condition for processing applies in addition to the relevant general lawful basis.

7.4. Participants should not provide sensitive personal information to Erolos unless it is reasonably necessary for a legitimate purpose or specifically requested.

8. PHOTOGRAPHS, VIDEO, AUDIO AND LIKENESS

8.1. Where you participate in an Erolos Project, photographs, video or audio recordings may be created featuring you.

8.2. Erolos may process such material for the purposes described in the applicable Project documentation, consent/release agreement and this Privacy Policy where a lawful basis exists.

8.3. The contractual permission governing the use of your image or likeness is separate from your rights under data protection law.

8.4. Entering into a model or participant release agreement does not remove statutory data protection rights.

8.5. Similarly, exercising a data protection right does not automatically determine whether a separate contractual right, copyright right or other legal permission exists.

8.6. Erolos may retain photographs and recordings for legitimate archival, legal, historical, editorial or business purposes, subject to applicable law and appropriate retention considerations.

9. DIRECT MARKETING

9.1. Erolos may send marketing communications where permitted by applicable law.

9.2. Where consent is required, Erolos will obtain the appropriate consent before sending such communications.

9.3. You may unsubscribe from marketing communications using the available unsubscribe mechanism or by contacting Erolos.

9.4. Unsubscribing from marketing communications does not necessarily prevent Erolos from sending non-marketing communications reasonably necessary for contractual, administrative, legal or operational purposes.

10. COOKIES AND SIMILAR TECHNOLOGIES

10.1. Erolos may use cookies and similar technologies to operate, secure and improve its website and digital services.

10.2. Strictly necessary technologies may be used where legally permitted without consent.

10.3. Non-essential cookies, including certain analytics, advertising or tracking technologies, will be used only where the required consent or other lawful basis exists.

10.4. Where consent is required, Erolos will provide an appropriate mechanism for obtaining and withdrawing that consent.

10.5. The final website implementation should accurately identify the specific cookies and technologies actually used by Erolos.

10.6. Users may also have controls available through their browser or device settings, although these controls do not replace any consent mechanism required by applicable law.

11. ANALYTICS

11.1. Erolos may use analytics technologies to understand how users interact with its website and digital services.

11.2. Depending on the technology used, analytics information may include:

• pages visited;

• interaction data;

• device information;

• browser information;

• approximate geographic information;

• referral information; and

• usage patterns.

11.3. Erolos will determine whether a particular analytics technology requires consent or can lawfully operate under another legal basis.

11.4. The final version of this Privacy Policy should identify the actual analytics providers and technologies deployed by Erolos where appropriate.

12. SHARING PERSONAL DATA

12.1. Erolos may share personal data where reasonably necessary and lawful for the purposes described in this Privacy Policy.

12.2. Recipients may include:

• hosting providers;

• email and communications providers;

• website and technology providers;

• payment providers;

• analytics providers;

• professional advisers;

• legal advisers;

• insurers;

• event or production partners;

• photographers and creative collaborators;

• agencies;

• venues;

• contractors;

• service providers; and

• public authorities or law enforcement where legally required.

12.3. Erolos will not sell personal data to third parties.

12.4. Where a service provider processes personal data on Erolos's behalf, Erolos will take appropriate steps to ensure the processing is governed by applicable data protection requirements.

13. CREATIVE COLLABORATORS AND PROJECT PARTICIPANTS

13.1. Projects may involve photographers, videographers, stylists, editors, models, performers, assistants, producers, agencies, venues and other creative collaborators.

13.2. Personal data may be shared with such persons where reasonably necessary for the administration, production, publication or legitimate operation of the Project.

13.3. Erolos will seek to limit access to personal data to information reasonably necessary for the relevant purpose.

13.4. Where an independent organisation determines its own purposes and means of processing, that organisation may have separate data protection responsibilities.

14. INTERNATIONAL TRANSFERS

14.1. Some Erolos service providers, platforms or collaborators may process personal data outside Ireland or the European Economic Area (“EEA”).

14.2. Where personal data is transferred outside the EEA, Erolos will implement an appropriate lawful transfer mechanism where required by applicable law.

14.3. Depending on the circumstances, this may include:

• an adequacy decision;

• Standard Contractual Clauses;

• another lawful transfer mechanism; or

• another safeguard recognised by applicable data protection law.

14.4. The specific safeguards used will depend on the relevant recipient and jurisdiction.

15. DATA RETENTION

15.1. Erolos will retain personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

15.2. Retention periods may depend on:

• the nature of the information;

• the purpose for which it was collected;

• contractual requirements;

• legal obligations;

• accounting and tax requirements;

• safeguarding considerations;

• potential or actual legal claims;

• legitimate archival requirements; and

• other relevant circumstances.

15.3. Erolos may retain Project records and creative material for extended periods where reasonably necessary for legitimate archival, historical, editorial, legal or business purposes, subject to applicable law.

15.4. The final internal retention schedule should identify specific retention periods or criteria for different categories of personal data.

16. DATA SECURITY

16.1. Erolos will take reasonable technical and organisational measures appropriate to the circumstances to protect personal data against:

• unauthorised access;

• unlawful processing;

• accidental loss;

• destruction;

• alteration; and

• unauthorised disclosure.

16.2. No method of electronic transmission or storage can be guaranteed to be completely secure.

16.3. Access to personal data should be limited to persons who reasonably require it for legitimate business or Project purposes.

17. PERSONAL DATA BREACHES

17.1. Erolos will maintain appropriate procedures for identifying, assessing and responding to personal data breaches.

17.2. Where required by applicable law, Erolos will notify the Data Protection Commission or other competent authority of a personal data breach within the applicable statutory period.

17.3. Where required by law, affected individuals will also be notified.

18. AUTOMATED DECISION-MAKING AND PROFILING

18.1. Erolos does not intend to make decisions producing legal or similarly significant effects on individuals solely through automated processing unless permitted by applicable law and subject to any safeguards required by law.

18.2. If Erolos introduces significant automated decision-making or profiling, the relevant information and safeguards will be provided where legally required.

19. YOUR DATA PROTECTION RIGHTS

Subject to applicable law, you may have the right to:

(a) access your personal data;

(b) obtain information about how it is processed;

(c) request correction of inaccurate or incomplete personal data;

(d) request erasure in certain circumstances;

(e) request restriction of processing in certain circumstances;

(f) object to certain processing;

(g) receive certain personal data in a portable format;

(h) withdraw consent where processing relies on consent; and

(i) exercise other rights provided by applicable data protection law.

19.2. These rights are not absolute and may be subject to legal conditions or exemptions.

19.3. For example, Erolos may be required to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.

20. EXERCISING YOUR RIGHTS

20.1. To exercise a data protection right or ask a privacy-related question, you may contact Erolos using the contact details in Section 36.

20.2. Erolos may need to verify your identity before responding to certain requests.

20.3. Erolos will respond within the applicable statutory period.

20.4. Where permitted by law, Erolos may request additional information reasonably necessary to locate the relevant personal data or process the request.

20.5. Where Erolos is unable to comply fully with a request, it will explain the applicable reason where legally required.

21. COMPLAINTS TO THE DATA PROTECTION COMMISSION

21.1. If you believe that Erolos has processed your personal data unlawfully, you should contact Erolos so that we can investigate and address the issue where appropriate.

21.2. You also have the right to lodge a complaint with the Irish Data Protection Commission (“DPC”) where you consider that your data protection rights have been infringed.

21.3. The DPC is the relevant supervisory authority for many organisations established in Ireland.

22. CHILDREN

22.1. Erolos may operate Projects or services involving individuals under 18.

22.2. Where processing relies upon consent in relation to an information society service, the applicable rules concerning children and digital consent will apply.

22.3. The fact that an individual is under 18 does not automatically mean that all processing of their personal data requires parental consent.

22.4. Depending on the nature of the Project and the processing involved, Erolos may require parental or legal guardian consent or implement additional safeguarding procedures.

22.5. Where a minor participates in an Erolos Project, the applicable participant and parental/guardian consent forms will be provided separately where required.

23. SOCIAL MEDIA

23.1. Erolos operates or may operate social media accounts and pages on third-party platforms.

23.2. If you interact with Erolos through a social media platform, that platform may independently process your personal data under its own privacy policy and terms.

23.3. Erolos may receive information made available through those platforms, subject to the platform's functionality and applicable law.

23.4. Erolos does not control the privacy practices of third-party social media platforms.

24. THIRD-PARTY WEBSITES AND SERVICES

24.1. Erolos may provide links to third-party websites, platforms or services.

24.2. Third-party websites and services operate independently from Erolos and may have their own privacy policies.

24.3. Erolos is not responsible for the privacy practices of third-party organisations outside its control.

24.4. You should review the applicable privacy notice before providing personal information directly to a third party.

25. LEGAL CLAIMS AND RECORDS

25.1. Erolos may retain and process personal data where reasonably necessary to:

• establish legal rights;

• exercise legal rights;

• defend legal claims;

• comply with legal obligations;

• maintain evidence;

• resolve disputes; or

• protect Erolos and relevant individuals.

25.2. Such processing will be limited to what is reasonably necessary for the relevant purpose.

26. PUBLICLY AVAILABLE INFORMATION

26.1. Erolos may process information that you have intentionally made publicly available, including professional information or social media information, where there is a lawful basis for doing so.

26.2. Erolos will not assume that information being publicly accessible means that every possible use of that information is automatically lawful.

27. DATA MINIMISATION AND ACCURACY

27.1. Erolos aims to process personal data that is adequate, relevant and limited to what is necessary for the relevant purpose.

27.2. Erolos also aims to keep personal data accurate and, where necessary, up to date.

27.3. You should notify Erolos if important personal information you have provided becomes inaccurate or changes.

28. DATA PROTECTION BY DESIGN

28.1. Erolos will seek to consider privacy and data protection requirements when introducing or materially changing systems, processes and Projects involving personal data.

28.2. Where legally required, Erolos may carry out a Data Protection Impact Assessment (“DPIA”) before undertaking processing likely to result in a high risk to individuals.

29. DATA PROCESSORS AND SERVICE PROVIDERS

29.1. Erolos may use third-party service providers to process personal data on its behalf.

29.2. Where required, Erolos will ensure that appropriate contractual and organisational arrangements are in place with such processors.

29.3. Service providers may include hosting, cloud storage, email, analytics, payment, communications, scheduling, project management and other technology providers.

29.4. The final version of this Privacy Policy should be reviewed against Erolos's actual service providers and data-processing arrangements.

30. DATA PROTECTION OFFICER

30.1. Erolos will determine whether it is legally required to appoint a Data Protection Officer (“DPO”).

30.2. If Erolos is required to appoint a DPO, the relevant contact details will be provided in the final version of this Privacy Policy.

30.3. If Erolos is not legally required to appoint a DPO, privacy enquiries may be directed to the Erolos contact details provided below.

31. CONFIDENTIALITY AND PRIVACY

31.1. Erolos will take reasonable steps to protect personal information from unauthorised disclosure.

31.2. Confidentiality obligations may also arise under contracts, participant agreements, contributor agreements or other arrangements.

31.3. Contractual confidentiality obligations and data protection obligations operate independently and may apply simultaneously.

32. CONSENT AND WITHDRAWAL

32.1. Where Erolos relies on consent as its legal basis for processing, consent will be requested in a manner intended to meet applicable legal requirements.

32.2. You may withdraw consent where processing is based on consent.

32.3. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

32.4. Withdrawal of consent also does not necessarily affect processing carried out on another lawful basis where another legal basis independently applies.

32.5. Where a contractual agreement separately governs the use of creative material, withdrawal of data protection consent does not automatically determine the contractual rights of either party. The relevant circumstances and applicable law must be considered separately.

33. DATA PROTECTION AND EROLOS CONTENT

33.1. Photographs, video recordings, audio recordings and other creative material may contain personal data.

33.2. Erolos will process such material in accordance with the applicable lawful basis, contractual arrangements and data protection requirements.

33.3. Where an Erolos Project involves identifiable individuals, the applicable participant release and consent documentation may govern contractual permissions relating to the use of their image and likeness.

33.4. Nothing in a participant release agreement is intended to remove statutory data protection rights.

34. CHANGES TO THIS PRIVACY POLICY

34.1. Erolos may update this Privacy Policy from time to time to reflect changes in:

• law;

• technology;

• services;

• Projects;

• data-processing practices; or

• business operations.

34.2. The “Last Updated” date at the beginning of this Privacy Policy will indicate when it was most recently revised.

34.3. Where legally required, Erolos will provide additional notice concerning material changes.

35. GOVERNING LEGAL FRAMEWORK

35.1. This Privacy Policy is intended to operate in accordance with applicable Irish and European data protection law.

35.2. This includes, where applicable:

• Regulation (EU) 2016/679 (General Data Protection Regulation);

• the Data Protection Act 2018;

• applicable Irish electronic communications and privacy legislation;

• applicable European Union legislation; and

• guidance and requirements issued by the Irish Data Protection Commission and other competent authorities.

35.3. If any provision of this Privacy Policy conflicts with a mandatory legal requirement, the mandatory legal requirement will prevail to the extent of the conflict.

36. EROLOS CONTACT

For questions concerning this Privacy Policy, your personal data, data protection rights, consent, privacy concerns or other data protection matters, please contact Erolos using the following details:

Erolos
Website: www.erolos.xyz
Email: info@erolos.xyz

END OF AGREEMENT