Purpose and scope
This is PhotoMea’s public policy for biometric data processed in connection with face matching. It states what is processed, why it is processed, how long it is retained, and how it is destroyed.
It applies to photomea.com, PhotoMea applications, and related services operated by VIONTA MANAGEMENT CONSULTING FZCO (“PhotoMea”, “we”), FZA Business Park Building A1, Dubai Silicon Oasis, Dubai, United Arab Emirates.
The “Consent Statement” section contains the complete text presented during registration or sign-in. The Privacy Policy covers our other privacy practices and rights.
What we process
A face vector is a numerical representation derived from a face image for comparison. PhotoMea treats face vectors used to distinguish a person as biometric data.
| Data | Source | Purpose |
|---|---|---|
| Registration selfie | Uploaded by the Participant | Generate a face vector and verify matching |
| Account face vector | Derived from the selfie | Find the Participant’s photos |
| Event-photo face vectors | Derived from uploaded event photos | Enable comparison within the event |
| Match records | Generated by comparison | Show matched photos |
| Estimated age range and gender | Derived from the selfie | Anonymous, aggregated event statistics |
| Consent record | Created at approval | Record the text version, date, and channel |
How face matching works
A Participant uploads a registration selfie. PhotoMea derives a face vector from that image and derives vectors from faces in event photos. Each event has a separate, isolated comparison area; vectors from one event are not transferred to or used to identify a person in another event.
Photos are shown according to face-match results and event access settings. A group photo may be shown to each Participant it matches; the full gallery is available only if the Event Owner opens it.
The process is automated and probabilistic and may produce an incorrect result. PhotoMea personnel do not routinely inspect vectors. Limited, logged access may occur for support, security, abuse, or legal reasons.
Legal basis and choice
PhotoMea processes biometric face data on the basis of the individual’s freely given, informed, and specific explicit consent. Where EU or UK data protection law applies, this is consent under Article 6(1)(a) and explicit consent under Article 9(2)(a).
Estimated age range and gender are processed under the same approval and only for anonymous, aggregated event statistics.
If you do not approve, your account is not closed and you may continue to use the Platform, but face matching is unavailable. You may view photos without matching only if the Event Owner has opened the full gallery; otherwise you may ask the Event Owner to send your photos directly.
Consent Statement (version 2026.09-4)
The statement below is presented during registration or sign-in and is the complete text submitted for your approval.
EXPLICIT CONSENT STATEMENT. I confirm that I have read the Privacy Policy and this Biometric Data Policy; that I freely and on an informed basis give my explicit consent to the processing of my registration selfie and the face vector generated from that image for the purpose of finding and matching photos of me among photographs from events I attend; to the generation of estimated age range and gender information from the same selfie and its use solely to prepare anonymous and aggregated event statistics; and to its processing and storage by the service providers described in the Privacy Policy’s “International processing” section. This consent does not replace any international-transfer safeguards required by law.
Consent is collected electronically by selecting the relevant checkbox. PhotoMea records the approval date, text version, and channel. This page contains the current complete text.
This section is the consent statement. The remaining sections and the Privacy Policy provide information about purposes, data categories, recipients, and rights.
Retention and destruction
Biometric data is retained only while required for its purpose and is destroyed when the purpose ends. The periods below are applied automatically.
Destruction means permanent deletion. Data deleted from active systems is overwritten or rendered inaccessible through the backup cycle. Destruction events are logged.
If consent is withdrawn, PhotoMea deletes the registration selfie, account face vector, and demographic estimate without waiting for the periods below and stops matching. Consent records may be kept for the applicable limitation period to establish or defend legal claims.
| Data | Period | Action |
|---|---|---|
| Registration selfie and account face vector | Six months after the last sign-in if the account is inactive | Automatically deleted |
| Event-photo face vectors | Six months from the event date | Automatically deleted; existing match records remain |
| Estimated age range and gender | The related face-data period; earlier on withdrawal | Deleted; anonymous aggregate statistics may remain |
| Match records and event Content | Two years from the event date | Automatically deleted |
| Consent record | The applicable limitation period after withdrawal | Deleted when that period ends |
Use and disclosure limits
PhotoMea does not sell, rent, or trade biometric data. It is not used for advertising, marketing, targeting, surveillance, or general-purpose artificial-intelligence model training.
PhotoMea discloses biometric data only to infrastructure and processing providers necessary to provide the service and bound to process it on PhotoMea’s instructions; with explicit consent; or in response to a lawful and binding request.
PhotoMea is established in the United Arab Emirates. Face analysis and primary application storage are carried out in the European Union. The current providers and processing locations are listed in the Data Processing Agreement.
Security
PhotoMea protects biometric data with measures appropriate to its nature and risk, including encryption in transit and at rest, separately authorized storage, event-level isolation, access controls, logging, and confidentiality duties.
No method of storage or transmission is completely secure.
People in photos who have no account
Uploaded event photos are indexed for face comparison, including faces of people who have no PhotoMea account. The comparison area is isolated to the event; vectors are not linked to account contact details before a Participant is matched and are not used across events. Event-photo vectors are deleted within six months of the event date, subject to the earlier destruction requirements below. A Participant’s consent covers their own data and does not authorize processing of another person’s biometric data.
The Event Owner is responsible for the Content it uploads and for informing people at the event as required by applicable law.
A person without an account may request removal of a photo, deletion of face data, or exclusion from matching by writing to support@photomea.com. No account is required.
United States biometric notice
Where the Illinois Biometric Information Privacy Act applies, this policy is PhotoMea’s publicly available retention schedule and destruction policy. Collection of covered biometric data requires prior written notice of its purpose and retention period and the individual’s written release or that of their legally authorized representative. An event sign or another person’s consent does not replace that release. Covered biometric data is destroyed when its purpose has been satisfied or within three years after the individual’s last interaction with PhotoMea, whichever occurs first.
Where Texas or Washington biometric law applies, the required notice and consent must precede capture or enrollment for a commercial purpose. PhotoMea does not sell, lease, or trade biometric identifiers and discloses them only as permitted by applicable law.
The shorter retention periods stated above continue to apply; these state-law limits do not extend them.
Withdrawal and requests
You may withdraw consent at any time, without charge, through the face-matching section of account settings or by writing to privacy@photomea.com. Withdrawal does not affect processing carried out before it.
Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or another available remedy. Photo-removal requests may be sent to support@photomea.com. PhotoMea may request the minimum information reasonably needed to verify and complete a request.
Children
A person must be eighteen to open an account. A minor may use PhotoMea only under a parent or legal guardian’s supervision and approval, and that adult must approve face matching. If PhotoMea learns that a child’s biometric data was processed without valid permission, it deletes the data without undue delay.
The Event Owner is responsible for notices and permissions required for event Content depicting children.
Changes and contact
If a change affects the substance of the Consent Statement, PhotoMea changes the version number and requests approval of the new version where required. A previous approval does not authorize materially expanded processing.
Questions about biometric data may be sent to privacy@photomea.com.