# DOCUMENT 6
# BIOMETRIC PRIVACY ADDENDUM & WRITTEN CONSENT
## 1. PURPOSE
This Addendum explains how Celestial collects, uses, discloses, protects, retains, and destroys Biometric Data for a CelestialTV Project.
It also serves as the Participant’s written biometric consent.
No face embedding, identity match, liveness analysis, voiceprint, or voice model may be created before the required consent is recorded.
---
## 2. DATA COVERED
Celestial may process the following categories only when needed for the Project:
### Reference Media
- photographs;
- video;
- voice recordings;
- identity documents;
- liveness captures; and
- other Customer-supplied files.
Reference Media may be sensitive even where a particular statute does not classify the original photograph or recording itself as a biometric identifier.
### Derived Biometric Data
- scans or measurements of face geometry;
- facial embeddings;
- facial similarity or match scores;
- liveness signals and results;
- voiceprints;
- voice embeddings;
- Project-specific voice models;
- identity-verification confidence values; and
- related technical identifiers used to verify or replicate the Participant.
---
## 3. SPECIFIC PURPOSES
Celestial may collect and use Biometric Data only to:
1. confirm that the Customer matches the consenting Participant;
2. confirm liveness or reduce impersonation risk;
3. prevent another person’s face or voice from being used without consent;
4. generate the Participant’s authorized Synthetic Depiction;
5. generate an authorized synthetic voice where separately selected;
6. perform continuity and identity quality checks;
7. investigate a Project-specific verification or security issue;
8. complete and document the Project; and
9. comply with a valid legal requirement.
Celestial may not use Biometric Data for:
- advertising;
- data brokerage;
- sale;
- unrelated surveillance;
- employment decisions;
- credit, insurance, housing, health, or eligibility decisions;
- general model training;
- another customer’s project;
- creation of a reusable identity marketplace; or
- any purpose not affirmatively disclosed here.
---
## 4. COLLECTION TIMING
Celestial may collect or derive Biometric Data only after:
1. the Participant receives this written notice;
2. the Participant is informed of the purpose and retention term;
3. the Participant signs the required consent;
4. the Participant completes the visual-likeness consent in Document 1; and
5. the relevant service providers and storage locations are listed in Schedule 1.
Voice Biometric Data requires the separate optional voice consent below.
---
## 5. STORAGE LOCATION
Active Project data will be stored and processed only in the provider systems and geographic regions listed in Schedule 1.
**Launch blocker:** Schedule 1 must identify the actual provider, contracting entity, product, processing purpose, storage region, applicable data-processing agreement, retention setting, and training-use setting before the first outside Customer.
Celestial must not represent that data remains in the United States unless the actual provider configuration and contract support that statement.
---
## 6. SERVICE-PROVIDER DISCLOSURE
Celestial will not sell, lease, trade, license, or otherwise profit from Biometric Data.
Celestial will not share Biometric Data with advertisers, data brokers, unrelated companies, other Customers, or another party for that party’s independent benefit.
Celestial may disclose Biometric Data to a contracted service provider only when:
1. the disclosure is necessary to perform the Customer’s Project;
2. the provider is listed in Schedule 1;
3. the Participant has consented to the disclosure;
4. the provider is contractually restricted to Celestial’s instructions;
5. the provider may not use the data for advertising, general model training, or an independent purpose;
6. the provider uses reasonable security controls; and
7. the provider must delete or return the data at the end of the authorized processing period.
If those conditions cannot be established, the affected processing is not authorized and the Project must not proceed through that provider.
---
## 7. RETENTION AND DESTRUCTION SCHEDULE
### Failed or Rejected Verification
Reference Media and Biometric Data associated with a failed, abandoned, or rejected verification will be deleted from active production systems within **7 days** after the Project is closed, unless:
- the Customer is actively completing an authorized re-verification;
- a fraud investigation is reasonably necessary;
- the Customer requests a shorter period that can technically be honored; or
- a legal hold applies.
### Successfully Delivered Project
Unless the Customer expressly purchases a longer retention or hosting service:
- raw Reference Media will be deleted from active systems within **30 days after final delivery**;
- face embeddings, face-geometry data, liveness data, voiceprints, and voice models will be deleted from active systems within **30 days after final delivery**;
- temporary production files containing reconstructable likeness or voice data will be deleted within the same 30-day period; and
- inaccessible disaster-recovery or rolling backups will be overwritten or purged within **90 days after active deletion**.
### Cancellation
If the Project is canceled, the 30-day period begins when cancellation is confirmed, subject to the shorter failed-verification period above.
### Non-Biometric Records
Celestial may retain signed consent records, Project identifiers, transaction records, authorization timestamps, non-reconstructable hashes, deletion receipts, and the non-biometric Custody Receipt for **7 years**, subject to attorney confirmation.
Those records must not include a reusable face embedding, voiceprint, voice model, or raw identity document.
### Legal Hold
A legal hold may pause deletion only for data reasonably necessary to respond to:
- a valid subpoena or warrant;
- a pending legal claim;
- a documented security investigation; or
- another binding legal obligation.
The hold must end when the lawful need ends.
---
## 8. CUSTOMER DELETION RIGHTS
The Participant may request deletion of retained Reference Media and Biometric Data at any time by contacting:
**Privacy contact:** [INSERT EMAIL AND POSTAL ADDRESS]
Celestial will:
1. authenticate the request without collecting more information than reasonably necessary;
2. stop future processing where applicable;
3. delete active Biometric Data within **30 days**;
4. instruct affected service providers to delete the data;
5. complete backup deletion within the disclosed backup cycle;
6. provide a deletion confirmation or explain any narrow legal exception; and
7. record a non-biometric deletion receipt.
Deletion may prevent Celestial from completing, revising, re-rendering, hosting, or supporting the Project.
Deletion does not remove copies already downloaded by the Customer.
---
## 9. NO SALE, PROFIT, OR INDEPENDENT-PURPOSE USE
Celestial will not:
- sell Biometric Data;
- lease Biometric Data;
- trade Biometric Data;
- use Biometric Data as consideration in a data exchange;
- permit a provider to train a general-purpose model with it;
- combine it with an advertising profile;
- use it to identify the Participant outside CelestialTV;
- disclose it to another Customer; or
- retain it merely because it may be useful later.
---
## 10. SECURITY
Celestial will apply security measures appropriate to the sensitivity of Biometric Data, including:
- encryption in transit;
- encryption at rest where technically supported;
- access limited to authorized personnel and systems;
- role-based or least-privilege controls;
- separation of Biometric Data from public provenance records;
- access and deletion logging;
- provider authentication and credential controls;
- incident-response procedures;
- contractual processor restrictions; and
- protection at least as strong as that used for other confidential identity and authentication data.
**Launch gate:** These statements must be verified against the actual production system before publication. An unimplemented security control must not be promised as an existing fact.
---
## 11. SECURITY INCIDENTS
If Celestial discovers unauthorized access to Biometric Data, it will:
1. contain and investigate the incident;
2. stop affected processing where appropriate;
3. preserve necessary evidence;
4. notify affected Participants and authorities as required by applicable law;
5. require affected processors to cooperate;
6. document corrective action; and
7. prevent continued use of compromised data where reasonably possible.
---
## 12. FACE BIOMETRIC CONSENT
The Participant acknowledges receiving written notice that Celestial intends to collect, derive, store, use, and disclose facial-geometry information, face embeddings, identity-match data, and liveness results for the purposes and terms stated in this Addendum.
- [ ] **I CONSENT to the collection, storage, use, and disclosed service-provider processing of my facial Biometric Data for this Project.**
- [ ] **I DO NOT CONSENT. Celestial may not process my facial Biometric Data or produce the Project.**
**No box checked means no consent.**
**Participant initials:** __________
---
## 13. SEPARATE VOICE BIOMETRIC CONSENT
Facial biometric consent does not authorize voice processing.
- [ ] **YES — I separately consent to the collection, derivation, storage, use, and disclosed service-provider processing of my voice samples, voiceprint, voice embeddings, and Project-specific synthetic voice model for this Project.**
- [ ] **NO — I do not consent to voice biometric processing. Celestial may not create or use a voiceprint or voice model derived from me.**
**No box checked means no voice consent.**
**Participant initials:** __________
**Separate voice-consent signature:** _____________________________
**Date:** __________________
---
## 14. SERVICE-PROVIDER DISCLOSURE CONSENT
The Participant authorizes disclosure to the providers specifically listed in Schedule 1 solely for the listed Project purpose and retention period.
- [ ] **I consent to the limited processor disclosures stated in this Addendum and Schedule 1.**
- [ ] **I do not consent. Celestial may not disclose my Biometric Data or proceed with processing requiring an outside provider.**
Consent to service-provider processing does not authorize sale, advertising, independent model training, or an unrelated use.
---
## 15. PARTICIPANT SIGNATURE
I understand:
- what Biometric Data Celestial intends to process;
- why it is being processed;
- how long it will be retained;
- which provider categories may receive it;
- that voice processing is optional and separate;
- that I may request deletion; and
- that refusing required facial processing means Celestial cannot produce the Project.
**Participant legal name:** ______________________________________
**Participant signature:** _______________________________________
**Date and time:** ______________________________________________
**Project ID:** __________________________________________________
**Consent receipt ID:** __________________________________________
---
## SCHEDULE 1 — PROVIDERS, STORAGE, AND PROCESSING
This schedule must be complete before Customer processing.
| Provider and contracting entity | Product/service | Data processed | Exact purpose | Storage/processing region | Provider retention | General model training disabled? | DPA/contract verified by | Deletion mechanism |
|---|---|---|---|---|---|---|---|---|
| Google / [PENDING VERIFICATION] | Veo / [PENDING VERIFICATION] | Authorized image/video/audio inputs | Film generation | [PENDING VERIFICATION] | [PENDING VERIFICATION] | [PENDING VERIFICATION] | **[name/date]** | [PENDING VERIFICATION] |
| **[Identity provider]** | Identity/liveness verification | Identity media, face data, match result | Participant verification | [PENDING VERIFICATION] | [PENDING VERIFICATION] | [PENDING VERIFICATION] | **[name/date]** | [PENDING VERIFICATION] |
| **[Cloud/storage provider]** | Secure storage | Reference Media and production files | Temporary Project storage | [PENDING VERIFICATION] | [PENDING VERIFICATION] | N/A or [PENDING VERIFICATION] | **[name/date]** | [PENDING VERIFICATION] |
| **[Delivery provider]** | File delivery | Finished film, Customer contact | Secure delivery | [PENDING VERIFICATION] | [PENDING VERIFICATION] | N/A | **[name/date]** | [PENDING VERIFICATION] |
---