First Faces Models operates across multiple countries, so the way we protect personal data has to hold up against several different legal frameworks at once — not just one.
This page sets out, region by region, which rules we follow and what rights they give you, alongside the rights and protections that apply no matter where you're based.
If you're in the UK or EEA, your data is processed under the General Data Protection Regulation, giving you rights to access, correct, delete and port your data, and control over how it's used.
For users in India, we follow the Digital Personal Data Protection Act 2023, which governs consent, lawful processing and your rights to access and correct your personal data — with extra safeguards where a child's data is involved.
We handle Australian users' data in line with the Australian Privacy Principles under the Privacy Act 1988, covering transparent collection, secure handling, and your right to access and correct your information.
Data belonging to users in the UAE is handled under the UAE's Personal Data Protection Law, which covers consent, access, correction and deletion rights.
California residents are covered by the CCPA and CPRA, giving rights to access and delete personal data, opt out of its sale, and protection from discrimination for exercising those rights.
For Canadian users, we follow PIPEDA's requirements around consent, purpose limitation, and your right to access and challenge the accuracy of your personal information.
Data belonging to users in China is handled under the Personal Information Protection Law, one of the world's strictest privacy regimes, with firm rules around consent and cross-border data transfers.
Users in Japan are protected under the Act on the Protection of Personal Information, which we follow for transparent, accurate and secure handling of your data.
Regardless of which regional law applies to you, we extend the following rights to every user:
A large part of the information we hold relates to children. We only collect or process a child's personal data where a parent or legal guardian has created and controls the account, and consented to that processing. A parent or guardian may review, correct or request deletion of their child's data at any time.
We apply appropriate technical and organisational safeguards to protect your data against unauthorised access, loss or misuse, including secure storage, access controls limiting who within our team can view personal data, and regular review of our security practices. Information is only shared with trusted partners where necessary to deliver our services.
In the unlikely event of a data breach affecting your personal information, we will notify affected users and the relevant regulator without undue delay, in line with the notification requirements of the law that applies to you.
Questions about how we protect your data?
Email us at [email protected] and we'll be happy to help.
