Privacy policy | The Three Buttons

Last updated: October 2026

Who we are

The Three Buttons Ltd ("The Three Buttons", "T3B", "we", "us") is a production house based in London, UK, and is the controller of the personal information described in this policy. You can contact us about privacy at hello@thethreebuttons.co.uk.

What we collect

Enquiries: the name, company, email, phone number, social handle, project details, budget range and message you send through our contact form, plus the page you enquired from.
Client portal: your name, email address, login details (passwords are handled by our authentication provider and never stored by us in readable form) and the projects and files shared with you.
Project work: images, video and audio of people who appear in productions we film for our clients.
Event guests (Live Gallery): if you sign up to get your photos from an event we photograph, your name, email address, optional phone number, which event it was, whether you asked to be emailed about new photos, and whether you agreed to hear from us about future events (recorded with the date you agreed). See "Face matching" below for the face codes used to find your photos.
Technical data: a one-way hashed version of your IP address, used only to prevent spam and abuse of our forms, and essential cookies that keep you signed in.

How we use it

To reply to enquiries and prepare quotes.
To plan, produce and deliver projects, and to give clients secure access to their files.
To show selected work in our portfolio, where we have permission to do so.
To keep our website and portal secure and to meet our legal obligations.

Legal basis

We rely on taking steps at your request before entering a contract and on performing a contract (enquiries and projects), our legitimate interests (running and promoting our business, preventing spam, showing our work) and, where required, your consent. You can withdraw consent at any time.

Face matching (Live Gallery)

At events we photograph, guests can find the photos they're in by taking a selfie. This uses face matching, so it involves biometric data, which UK data protection law treats as special category data. Here is exactly how it works.

Your selfie never leaves your phone. Your phone turns it into a face code (a list of numbers that describes the shape of a face). Only that code is sent to us, never the photo itself, and a face code can't be turned back into a picture.
We compare it only with that event's photos. When we upload the event's edited photos, we make a face code for each face in them so they can be searched. Face codes are only ever compared within the same event and are never used to identify anyone by name, for any other event or for any other purpose.
We only use your face code with your consent. You choose "Find my photos with a selfie" yourself, separately from any other choice, and you can skip it and still get the event link by email.
How long we keep it. If you only search, your face code is used for that search and not kept. If you also ask to be emailed when new photos of you arrive, we keep your face code for that event only and delete it automatically 30 days after the event. Face codes made from the event's photos are deleted when we delete that event's photos.
Who sees what. Each guest's gallery link is private to them and normally only shows the photos they're in. The organiser of the event may choose to let guests browse every photo.
Changing your mind. Email hello@thethreebuttons.co.uk at any time and we'll delete your details, your face code and your matches, or remove a photo of you from an event gallery.

We use trusted providers to run our services: Vercel (website hosting), Supabase (database, authentication and file storage) and Resend (email delivery). We also use Frame.io (Adobe) to review and deliver project files, and may copy edited event photos from it into an event gallery. They process information only on our instructions. We never sell personal information.

How long we keep it

Enquiries that don't become a project are deleted within 24 months. Project and portal records are kept for as long as needed to deliver the work and to meet legal and accounting requirements, then deleted or anonymised. Event photo galleries stay available for as long as we agree with the event organiser; when we close an event, its photos and their face codes are deleted. Guests' face codes are deleted 30 days after the event (see "Face matching"). Your name and email stay on our event guest list until you ask us to remove them, and we only send marketing emails if you ticked the box to hear from us, which you can undo at any time.

Your rights

Under UK data protection law you can ask to access, correct or delete your personal information, restrict or object to its use, or receive a copy to move elsewhere. Email hello@thethreebuttons.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We only use essential cookies: the sign-in session for the client portal. Our homepage reel is embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). We don't use advertising or tracking cookies. On Live Gallery event pages, if you sign up with no signal, your sign-up is saved on your own device (in your browser's local storage) only until it can be sent.

Privacy policy.