PRIVACY POLICY 

Stratosphere Ventures Limited respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you:

• visit or use our website;
• contact us or submit an enquiry;
• request, discuss, purchase or receive our services;
• work with us as a client, prospective client, supplier, contractor, collaborator or professional contact;
• participate in Business Consulting, Modelling Recruitment or Portfolio Building activities;
• apply for, discuss or participate in an opportunity facilitated by us;
• communicate with us through email, telephone, video call, social media or another channel; or
• otherwise interact with Stratosphere Ventures Limited.

It also explains your rights under applicable UK data protection law and how you may exercise them.

This Privacy Policy should be read alongside our Cookies Policy, Website Terms and Conditions and any additional privacy information or service-specific terms provided to you.

Stratosphere Ventures Limited is the controller responsible for the personal data covered by this Privacy Policy, except where we expressly state that we are acting solely as a processor on behalf of another organisation.

Our corporate details are:

References in this Privacy Policy to “Stratosphere Ventures”, “we”, “us” or “our” mean Stratosphere Ventures Limited.

We are not presently required to appoint a statutory Data Protection Officer.

Privacy enquiries, rights requests and data protection complaints should be directed to the privacy contact above.

For the purposes of this Privacy Policy:

Personal data means information relating to an identified or identifiable living individual.

Processing includes collecting, recording, organising, storing, consulting, using, disclosing, sharing, restricting, deleting or otherwise handling personal data.

Special category data includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, health data, and data concerning a person’s sex life or sexual orientation.

Controller means the person or organisation that determines why and how personal data is processed.

Processor means a person or organisation that processes personal data on behalf of a controller.

The personal data we collect depends on your relationship and interaction with us.

We may obtain personal data:

• directly from you;
• from someone acting with your authority;
• from a client, employer, representative, agent, collaborator or professional adviser;
• from referees or professional contacts;
• through referrals and introductions;
• from organisations seeking talent, suppliers, consultants, collaborators or commercial partners;
• from publicly accessible sources, including professional websites, company websites, Companies House and professional social media platforms;
• from our website, systems and service providers;
• from analytics, security and communications providers;
• from event organisers or networking contacts; and
• from regulators, public authorities, courts, professional advisers or counterparties where lawful and relevant.

Where we obtain your personal data from a source other than you, we will provide the privacy information required by law within a reasonable period and no later than one month after obtaining it, unless an applicable exemption applies.
Where the law requires earlier notice because we contact you or disclose the data sooner, we will provide the information at that earlier point.

We process personal data only where we have a lawful basis.

Depending on the circumstances, we may rely on one or more of the following bases:

• Contract: processing is necessary to take steps at your request before entering into a contract or to perform a contract with you.
• Legal obligation: processing is necessary to comply with a legal or regulatory obligation.
• Legitimate interests: processing is necessary for our legitimate interests or those of a third party, except where those interests are overridden by your interests, rights or freedoms.
• Consent: you have freely given a specific, informed and unambiguous indication of consent.
• Vital interests: processing is necessary to protect someone’s life, in the limited circumstances where this applies.

Our principal processing activities are set out below.

Where we rely on legitimate interests, those interests may include:

• operating and developing our business;
• providing responsive and effective services;
• maintaining client and professional relationships;
• identifying appropriate commercial, creative or professional opportunities;
• protecting website and system security;
• preventing fraud, misuse and unlawful activity;
• maintaining accurate business records;
• improving our services and website;
• protecting confidential information and intellectual property;
• recovering debts;
• obtaining professional advice;
• managing complaints and disputes; and
• establishing, exercising or defending legal rights.

Before relying on legitimate interests, we consider whether the processing is necessary, whether there is a less intrusive means of achieving the purpose, and whether your rights or interests override ours.

You may object to processing based on legitimate interests as explained in section 14.

In some circumstances, personal data is required:

• to respond meaningfully to an enquiry;
• to take steps at your request before entering into a contract;
• to enter into or perform a contract;
• to verify authority or identity;
• to process payment;
• to comply with a legal obligation; or
• to administer a service or opportunity.

Where required information is not provided, we may be unable to respond fully, enter into a contract, provide a service, process a transaction or continue an engagement.

We will indicate where information is mandatory where reasonably practicable.

We may disclose personal data where lawful and reasonably necessary to:

• website hosting, infrastructure, database and technical-support providers;
• email, communications and customer-enquiry providers;
• cloud-storage and document-management providers;
• analytics, security, anti-abuse and performance providers;
• payment, invoicing, bookkeeping and accounting providers;
• professional advisers, including solicitors, accountants, auditors, insurers and consultants;
• clients, prospective clients, collaborators or opportunity providers where relevant to a requested service, introduction, booking or engagement;
• photographers, studios, creative professionals and service suppliers involved in delivering an agreed service;
• recruitment, talent or portfolio-related counterparties where appropriate;
• regulators, law-enforcement bodies, tax authorities, courts and public authorities where required or permitted by law;
• parties involved in a legal claim, complaint, investigation or dispute;
• a prospective buyer, investor, funder, partner or successor in connection with a proposed restructuring, investment, sale, acquisition or transfer of the whole or part of our business; and
• other parties where you have authorised the disclosure or where another lawful basis applies.

For the website and website accounts, the providers we currently use include our website hosting and application platform provider (Emergent), the managed MongoDB database infrastructure used by that platform, Resend for sending account and enquiry emails, and, where you choose to sign in with a Google account, Google together with the sign-in service operated by our platform provider.
Some of these providers may process personal data outside the United Kingdom, in which case section 10 applies.

We use a private, internal text assistant for administrative drafting.
It is available only to authorised Stratosphere Ventures administrators, cannot take actions on its own and is not given routine access to customer files, photographs or enquiry histories.
We do not use your private materials to train artificial-intelligence models.

Service providers acting as processors are required to process personal data only for authorised purposes, apply appropriate security and confidentiality protections, and comply with applicable data protection obligations.

Some recipients may act as independent controllers.
Where they do, their own privacy information will govern their subsequent processing.

We do not sell personal data.

Some service providers or recipients may store or process personal data outside the United Kingdom.

Where personal data is transferred to a country that is not covered by applicable UK adequacy regulations, we will use an appropriate transfer mechanism where required.
This may include:

• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another legally approved transfer mechanism;
• binding corporate rules where applicable; or
• a specific statutory derogation in limited circumstances.

We may also apply supplementary contractual, organisational or technical measures where appropriate.

You may contact us for further information about the safeguards relevant to a particular transfer, subject to legitimate confidentiality and security restrictions.

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised or unlawful access;
• accidental loss;
• destruction;
• alteration;
• misuse;
• unauthorised disclosure; and
• other forms of unlawful processing.

Measures may include, where appropriate:

• access controls;
• authentication measures;
• secure transmission;
• restricted administrative access;
• role-based permissions;
• system monitoring;
• logging;
• backup and recovery arrangements;
• supplier due diligence;
• contractual confidentiality and data-protection requirements;
• data minimisation; and
• incident-response procedures.

No internet transmission, website or storage system can be guaranteed to be completely secure.
You are responsible for using appropriate care when sending information electronically and for protecting any credentials issued to you.

Where we become aware of a personal data breach, we will assess, document and address it in accordance with applicable legal requirements.
Where required, we will notify the Information Commissioner and affected individuals.

Documents and photographs uploaded to a website account are private by default.
They are stored in access-controlled storage and can be opened only through the Website after a server-side permission check, by the account holder concerned or by authorised Stratosphere Ventures personnel where needed for the relevant enquiry or service.

Private storage, sharing for a specific agreed service, public display or publication, advertising, commercial image licensing and use in a talent submission are separate matters.
Each requires its own appropriate permission, release or agreement; uploading a file does not give that permission.

No system can be made completely secure, and technical providers who operate our infrastructure may have limited administrative access to systems for maintenance and security purposes under their own contractual obligations.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, regulatory, contractual and reporting requirements.

When determining an appropriate retention period, we consider:

• the amount, nature and sensitivity of the data;
• the purpose of processing;
• whether the purpose can be achieved by other means;
• contractual requirements;
• applicable limitation periods;
• legal and regulatory obligations;
• the likelihood of a dispute or legal claim;
• security considerations; and
• the potential risk arising from unauthorised use or disclosure.

Indicative retention periods include:

At the end of the applicable period, personal data will be securely deleted, anonymised or retained in a restricted form where continued retention is legally justified.

Our website may use cookies, local storage, pixels, tags and similar storage or access technologies.

Strictly necessary technologies may be used where required to provide a service requested by you, operate security controls or maintain essential website functionality.

Non-essential technologies will be used only in accordance with applicable law and the choices made through our cookie controls.

Please read our Cookies Policy for further information about:

• the categories of technologies used;
• their purposes;
• whether consent is required;
• how long they operate; and
• how you can change or withdraw your choices.

Subject to applicable legal conditions, restrictions and exemptions, you may have the following rights.

To exercise a data protection right, contact:

Please provide sufficient information to identify:

• who you are;
• the right you wish to exercise;
• the personal data or processing concerned; and
• any relevant dates, communications, projects or reference information.

We may request reasonable proof of identity or authority where necessary to protect personal data from unauthorised disclosure.
We will not request more information than is reasonably necessary.

You will not ordinarily be required to pay a fee.
A fee may apply, or we may decline to act, only where permitted by law, including where a request is manifestly unfounded or excessive.

We will respond within the period required by applicable law.
Where a lawful extension applies because of complexity or the number of requests, we will inform you.

Some rights are subject to legal restrictions and exemptions.
Where we cannot comply fully, we will explain our decision unless the law prevents us from doing so.

You may complain directly to us about any concern relating to our collection, use, disclosure, retention, security or other processing of your personal data.

Please send the complaint to:

Your complaint should, where possible, include:

• your name and contact details;
• a clear description of the concern;
• the personal data or processing involved;
• relevant dates;
• copies of relevant communications or documents; and
• the outcome you are seeking.

We will:

1. provide an accessible means of making a complaint;
2. acknowledge receipt within 30 days;
3. take appropriate steps to investigate the complaint;
4. keep you appropriately informed where the investigation is ongoing;
5. respond without undue delay;
6. communicate the outcome of our investigation; and
7. explain any action taken or proposed where appropriate.

We may contact you for additional information where reasonably necessary to investigate the complaint.

You are not required to complete our internal complaints process before contacting the Information Commissioner, although the Information Commissioner may expect you to raise the matter with us first where appropriate.

You may make a complaint to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information is available through the ICO’s official website.

The ICO can also be contacted at:

Telephone: 0303 123 1113

We would appreciate the opportunity to address your concern directly, but this does not affect your right to contact the ICO.

We may send direct marketing or business-development communications only where permitted by UK data protection law and the Privacy and Electronic Communications Regulations 2003 (PECR), as applicable.

The lawful basis and consent requirements may depend on:

• whether the recipient is a corporate subscriber or an individual subscriber such as a sole trader or certain partnerships;
• whether there is an existing customer relationship;
• the communication channel;
• how the contact details were obtained; and
• applicable electronic-marketing rules.

Where PECR requires consent, we will not rely on legitimate interests as a substitute for that consent.
Where PECR does not require consent, including certain business-to-business communications to corporate subscribers, we may rely on legitimate interests only after the relevant necessity and balancing assessment.
Every electronic marketing communication will identify an appropriate sender and provide an appropriate means of opting out where required.

You may stop direct marketing at any time by:

• using the unsubscribe or opt-out method provided;
• contacting stratosphereventure@gmail.com; or
• objecting to direct marketing under section 14.

Opting out of marketing will not prevent us from sending necessary administrative, contractual, transactional, security or service communications.

Our general website is intended for business and professional audiences.
The current launch model for Modelling Recruitment and Portfolio Building is adult-only: applicants must be aged 18 or over.

We do not knowingly accept under-18 applicants into the current Modelling Recruitment or Portfolio Building workflow.
If we receive information about a child accidentally, for safeguarding, or in another context where processing is legally necessary, we will minimise the information used, apply an appropriate lawful basis and additional safeguards, and delete or restrict it when it is no longer required.

If a future service is intentionally opened to under-18s, it must first be separately approved and supported by appropriate safeguarding, privacy and contractual controls.
Those controls may include:

• involvement or authorisation from a person with parental responsibility;
• age verification;
• appropriate consent, contract or another lawful basis;
• safeguarding controls;
• limits on publication or disclosure; and
• service-specific terms or privacy information.

A child or parent or guardian may contact us using the details in section 2 regarding relevant personal data.

Our website may contain links to third-party websites, platforms or services.

Those third parties may act as independent controllers and apply their own privacy policies.
We do not control their processing and are not responsible for the privacy, security or content of an independent third-party service.

You should review the relevant third party’s privacy information before supplying personal data.

In some engagements, we may process personal data solely on a client’s documented instructions.

Where we act as a processor:

• the client will ordinarily be the controller;
• the client’s privacy information will govern its processing purposes;
• we will process the data in accordance with the applicable contract and data-processing terms; and
• requests relating to that data may need to be referred to the relevant controller.

Nothing in this section changes our status as controller for personal data that we process for our own administration, legal compliance, security, billing, business management or independent purposes.

We will use personal data for the purpose for which it was collected unless we reasonably determine that another purpose is compatible with the original purpose and lawful.

Where we need to use personal data for a materially different or incompatible purpose, we will identify an appropriate lawful basis and provide additional privacy information where required.

We may update this Privacy Policy where necessary to reflect:

• legal or regulatory changes;
• changes to our services;
• changes to website functionality;
• changes to suppliers or processing activities;
• improvements to our privacy practices; or
• changes required for clarity or accuracy.

The current version will be published on our website with its effective date.

Where a change materially affects how we process existing personal data, we will take reasonable steps to bring the change to the attention of affected individuals where required.

Questions, requests or complaints concerning this Privacy Policy or our use of personal data should be sent to:

Stratosphere Ventures Limited

Registered in England and Wales

Company number: 17062351

ICO registration number: ZC199409

Registered office: 24 Weybridge Road, Thornton Heath, England, CR7 7LN

Email: stratosphereventure@gmail.com