Nuva Privacy Policy

Nuva is operated by:

Phileas Retail Corporation Co., Ltd.

Corporate ID: 0105567217675

952 Ramaland Building, 12th Floor

Rama IV Road, Suriyawong Subdistrict

Bang Rak District, Bangkok 10500

Thailand

Where Phileas Retail Corporation Co., Ltd. determines why and how personal data is processed, it acts as the data controller under applicable personal-data protection law.

For privacy questions or requests, contact: legal@nuva-license.com

Certain Producers, payment providers, identity-verification providers and other service providers may separately act as controllers or processors depending on their role and the relevant processing activity.

This Privacy Policy applies to personal data relating to people who interact with Nuva, including:

• website visitors;
• registered account holders;
• Talent;
• Producers and their authorized representatives;
• people appearing in submitted materials;
• individuals participating in identity verification;
• people communicating with customer support;
• people involved in complaints, investigations or misuse reports; and
• other individuals whose personal data is processed through Nuva’s services.

This Policy covers processing through the Nuva Platform and related onboarding, studio asset preparation, licensing, delivery, payment, Production registration, certification, customer support, security and rights-enforcement activities.

Nuva uses separate documents for different legal purposes.

The Terms of Use govern access to and use of the Nuva Platform.

The Talent Agreement governs a Talent’s participation in Nuva and the commercial authorizations applicable to their Likeness Assets.

Each Digital Likeness License Agreement and associated License Scope govern the rights purchased by a Producer or other Licensee.

This Privacy Policy explains how personal data is processed.

Acknowledging or receiving this Privacy Policy does not mean that you consent to every form of processing described in it.

Where consent is required, Nuva seeks consent separately for the relevant purpose.

Contract acceptance, Talent Approval, licensing authorization and personal-data consent may therefore be recorded as separate actions.

A License may authorize certain commercial uses of a person’s likeness, but a License does not remove personal-data obligations that otherwise apply under law.

The personal data Nuva collects depends on how you use the Platform and which services you choose.

4.1 Account and Contact Information

We may collect information such as:

• legal name;
• stage name;
• email address;
• telephone number;
• account identifiers;
• authentication information;
• communications preferences; and
• communications with Nuva.

Where identity or authority verification is required, we may process:

• date of birth;
• age-verification results;
• identity-document information;
• identity-document images;
• information establishing representative authority;
• verification references;
• verification outcomes;
• facial captures;
• Facial compare;
• liveness information; and
• matching results.

The exact information collected depends on the verification process used.

Raw identity information is treated differently from ordinary account information and is subject to additional access and retention controls.

Talent may provide information used to create and manage their Nuva profile, including:

• stage name;
• biography;
• portfolio;
• Selected ethnicity appearance;
• visual appearance information;
• casting persona;
• physical characteristics;
• selected social-media links;
• Likeness Assets;
• pricing;
• licensing preferences;
• permitted or restricted scenarios; and
• other profile information selected by the Talent.

When Talent and Producers use Nuva’s licensing services, we may process:

• Likeness Assets;
• asset versions;
• Talent settings;
• requested usage;
• intended Production descriptions;
• Producer briefs;
• License Scope;
• Territory;
• Duration;
• commercial rights;
• AI Generation permissions;
• AI Training permissions where applicable;
• Sensitive Use information;
• Talent Approval;
• Standing Authorization where applicable;
• License IDs;
• delivery records;
• approval timestamps; and
• information identifying the parties to a License.

Depending on your role and selected payment method, we may process:

• billing information;
• payout information;
• invoice information;
• tax information;
• payment references;
• amounts;
• payment status;
• refunds; and
• disputed-payment information.

Payment credentials may be processed directly by the relevant payment provider.

The exact information accessible to Nuva depends on the implemented payment integration.

To help administer transactions and verify authorizations, Nuva may maintain records including:

• agreement versions;
• License versions;
• acceptance records;
• consent text and versions;
• approval records;
• timestamps;
• User IDs;
• Talent IDs;
• Asset IDs;
• License IDs;
• Delivery IDs;
• technical delivery references;
• watermark mappings;
• digital provenance information;
• file hashes;
• access records; and
• download records.

Where you voluntarily register a Production, apply for certification or report misuse, we may process:

• Production descriptions;
• submitted files or links;
• License references;
• registration information;
• certificates;
• correspondence;
• alleged unauthorized uses;
• supporting evidence; and
• investigation records.

Submitting a Production for registration does not automatically authorize Nuva to use the Production for unrelated marketing, AI Training or other purposes.

Depending on the technologies deployed on Nuva, we may collect:

• IP address;
• browser information;
• device information;
• session information;
• authentication activity;
• security logs;
• technical errors; and
• Platform interaction records.

Optional analytics and advertising technologies are addressed separately under the Cookies and Tracking Technologies section.

Sometimes another person may provide information relating to you, for example:

• an authorized company representative;
• a Producer;
• a Talent representative;
• an identity-verification provider;
• a payment provider;
• another transaction participant; or
• someone submitting a complaint or misuse report.

Where required by applicable law, Nuva will provide appropriate information concerning such processing within the required timeframe, unless a lawful exception applies.

Nuva uses personal data only where there is an identified purpose and an applicable lawful basis.

Depending on the processing activity, relevant bases may include performance of a contract, steps requested before entering a contract, legal obligations, legitimate interests, establishment or defence of legal claims, and consent.

Nuva does not rely on a Producer’s contract alone as a basis to process every Talent’s or third party’s personal data.

Each processing activity must have its own appropriate basis.

Nuva is designed specifically to support authorized commercial use of real-person Digital Likeness.

Because this is central to our service, this section explains how privacy and licensing interact.

6.1 Creating a Digital Likeness Profile

A Talent may upload or create visual assets for use through Nuva.

Depending on the Talent’s settings, approved information may be made available through the Nuva marketplace so Producers can discover Talent and request or purchase appropriate licensing rights.

A Talent’s presence on Nuva does not give Producers unrestricted rights to use that person’s identity, likeness, biography, name or visual assets.

Each License is limited by the applicable License Scope.

This may include restrictions concerning:

• type of Production;
• permitted usage;
• Territory;
• Duration;
• AI Generation;
• AI Training;
• commercial exploitation;
• Sensitive Use;
• additional distribution rights; and
• other applicable conditions.

A Producer must not treat access to a Licensed Asset as ownership of the Talent’s identity or as unlimited authorization to reproduce, clone or reuse the Talent outside the applicable License Scope.

Nuva distinguishes between AI Generation and AI Training.

Permission to use a Licensed Asset within an authorized AI-assisted Production does not automatically authorize training or fine-tuning an AI model on that Talent.

Joining Nuva, uploading Likeness Assets or creating a Talent profile does not itself grant general AI-training permission.

Where AI Training is offered, any commercial permission must be expressly included in the applicable authorization or License.

A commercial AI Training permission does not by itself replace any separate personal-data obligations that may apply to the relevant processing.

Nuva Phase 1 concerns visual and facial likeness.

Voice licensing and voice-model creation are not offered as part of the Phase 1 service.

Audio or incidental voice information appearing in support messages or submitted media does not authorize voice cloning, voice-model training or commercial voice use.

Where Talent Approval is required, Nuva may provide the Talent or authorized reviewer with relevant information about:

• the Producer;
• the intended Production;
• intended use;
• usage category;
• attachments;
• License Scope; and
• other information reasonably necessary to evaluate the request.

Nuva records relevant approval or rejection activity for transaction administration and evidence.

Account closure, Talent delisting, withdrawal of privacy consent, termination of participation and termination of an existing License are not necessarily the same event.

The applicable Talent Agreement and License Agreement govern commercial consequences, subject to mandatory law.

Delisting a Talent does not automatically cancel a previously issued License.

Similarly, the existence of an issued License does not give Nuva or a Licensee unlimited rights to continue processing personal data for unrelated purposes.

Nuva uses Zoloz eKYC technology for identity verification. The eKYC verification process is conducted through Zoloz’s financial-grade identity verification technology, with the relevant verification data processed in Singapore.

Depending on the verification flow enabled at the time, Zoloz may process information such as:

• identity-document information;
• identity-document images;
• facial captures;
• liveness evidence;
• facial matching information; and
• verification results.

Raw identity documents, facial captures, liveness data and biometric verification information processed through the eKYC service are used solely for identity-verification purposes and are not provided to Producers, Licensees or other third parties by Nuva. Such verification data is processed by Nuva’s designated eKYC technology provider in accordance with the applicable verification process, security requirements and data-processing arrangements.

Nuva may receive and retain limited verification results or references necessary to confirm that identity verification has been completed, administer the Talent account, prevent impersonation and maintain appropriate verification records. Nuva does not treat raw eKYC records or biometric verification information as Likeness Assets or make them available for licensing.

A photograph is not automatically biometric data merely because it contains a face. However, technical processing of physical or behavioral characteristics for the purpose of uniquely identifying a person may constitute biometric processing.

Where biometric information is processed for identity verification, Nuva will apply the lawful basis and additional safeguards required under applicable law and, where required, obtain separate explicit consent before such processing occurs.

Declining a required biometric verification process may prevent completion of Talent identity verification where that verification method is necessary for access to the relevant Nuva service.

eKYC and biometric verification information is not used by Nuva to create Licensed Assets, Digital Likeness profiles, AI models or AI Training datasets.

Nuva shares personal data only where relevant to the service, transaction, legal obligation or other justified purpose.

9.1 Marketplace Visitors

Marketplace visitors may be able to view approved public Talent information such as:

• stage name;
• approved portfolio;
• biography;
• casting persona;
• selected profile information; and
• selected social links.

Nuva does not intend to make identity documents, raw eKYC captures, bank details or private contact information publicly available

A Licensee may receive:

• Licensed Assets;
• relevant Talent or public Talent identifiers;
• License information;
• usage restrictions;
• License Scope;
• delivery information; and
• other information reasonably required to administer the License.

Buying a License does not give a Producer access to raw identity-verification records or biometric verification information.

Talent may receive relevant information needed to evaluate or manage a licensing request, such as:

• Producer identity or organization;
• intended use;
• Production brief;
• License Scope;
• relevant attachments; and
• required approval information.

Nuva does not intend to disclose unrelated payment credentials or other unnecessary private information to Talent.

Nuva may use providers supporting functions such as:

• cloud hosting;
• identity verification;
• payments;
• communications;
• customer support;
• security;
• monitoring;
• signing;
• technical operations; and
• data storage.

Providers receive only information appropriate to their function and must be subject to appropriate contractual and security requirements based on their role.

Nuva may use third-party payment service providers, payment gateways, acquiring partners and other financial service providers to process payments, payouts, refunds and related transactions.

Depending on the payment method and provider selected, the relevant provider may collect and process information such as payment credentials, billing information, payer or recipient information, transaction amounts and other information necessary to complete the transaction.

Where payment information is collected directly by a payment service provider, Nuva may receive limited transaction information such as payment status, transaction reference, amount, payment method and other information necessary to administer the transaction, accounting, refunds and dispute resolution.

The payment providers available through Nuva may change from time to time based on factors such as payment method, currency, country, transaction type and operational requirements.

Each payment service provider processes personal data according to its applicable role, legal obligations and privacy practices. Where appropriate, information about the relevant payment provider will be made available at or before the payment process.

Nuva may disclose relevant information where necessary and lawful to:

• courts;
• arbitrators;
• regulators;
• competent authorities;
• professional advisers;
• insurers;
• auditors;
• investigators; or
• other affected parties.

Nuva seeks to limit such disclosure to information reasonably necessary for the relevant purpose.

Some Producer projects may involve confidential client, campaign or Production information.

Nuva may use internal identifiers or restricted project references to reduce unnecessary exposure of those details.

A confidential code is not necessarily anonymous if Nuva can still connect it to a person or transaction.

Access to confidential project information should therefore remain restricted according to role and need.

Where a complaint or misuse report involves another party, Nuva may share information reasonably needed to allow that party to understand and respond to the issue.

Where appropriate, Nuva may redact:

• identity numbers;
• unrelated contact information;
• payment details;
• third-party information;
• confidential business information; and
• unrelated Production materials.

Raw identity documents and complete confidential project files are not intended to be routinely disclosed merely because a complaint has been submitted.

Nuva operates from Thailand and may operate with team members, contractors, service providers and business operations located in multiple countries.

Nuva currently uses cloud hosting infrastructure located in Singapore. Relevant personal data may therefore be stored or processed in Singapore.

11.1 International Nuva Team

Nuva may engage authorized employees, contractors, professional advisers, technical personnel, reviewers, customer-support personnel or other team members located outside Thailand.

Where necessary for their roles, authorized personnel may access certain personal data from the country in which they are located. Access will be limited according to role, business necessity and applicable access controls.

International team access does not mean that all Nuva personnel have access to all personal data. Nuva will seek to apply role-based access controls and restrict access to the information reasonably necessary for the relevant function.

Particularly sensitive information, including identity-verification information, biometric verification information, payment credentials and other restricted data, may be subject to additional access limitations and processing controls.

11.2 International Service Providers

Nuva may use identity-verification, payment, cloud infrastructure, communications, analytics, customer-support, security and other technology or professional service providers that process personal data in jurisdictions outside Thailand.

The country in which information is processed may depend on the provider, service configuration and infrastructure used at the relevant time.

11.3 International Producers and Licensees

Nuva operates a marketplace that may serve Producers and Licensees internationally.

Where permitted under the applicable License, an international Producer or Licensee may receive Licensed Assets and licensing information necessary to exercise the rights granted under that License.

The information provided to a Producer or Licensee will be limited to information reasonably necessary for the relevant licensing transaction and authorized use. Identity-verification records, biometric verification information and other restricted account information are not provided merely because a Producer or Licensee purchases a License.

A License with a Worldwide Territory describes the geographic scope of permitted commercial exploitation. It does not, by itself, constitute a legal mechanism for transferring personal data internationally.

11.4 International Transfer Safeguards

Where personal data is transferred, stored, processed or accessed outside Thailand, Nuva will take appropriate steps to comply with applicable data-protection requirements relating to cross-border transfers.

Where required by applicable law, Nuva will assess the relevant destination, recipient and processing arrangement and implement appropriate contractual, organizational, technical or other safeguards before carrying out the relevant transfer or permitting the relevant access.

Nuva may update its international infrastructure, service providers and operational locations as the Platform expands. Where required, material changes affecting the processing of personal data will be reflected in this Privacy Policy or otherwise communicated to affected individuals.

Nuva retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, unless a longer retention period is required or permitted by applicable law.

When determining an appropriate retention period, Nuva may consider factors including the nature and sensitivity of the personal data, the purpose for which it is processed, the nature and duration of our relationship with you, applicable legal, accounting and regulatory requirements, security and fraud-prevention needs, dispute or complaint handling, and relevant limitation periods.

Certain records relating to identity verification, agreements, Licenses, Talent Approvals, transactions, payments, Productions, Certificates, disputes and compliance activities may need to be retained after an account is closed or a License has expired where reasonably necessary to establish, exercise or defend legal rights, maintain transaction and licensing records, comply with legal obligations, or protect the integrity of the Nuva Platform.

Nuva will erase, destroy or genuinely anonymize personal data where it is no longer required and no lawful ground for further retention remains.

A pseudonymous ID, token or hash may still constitute personal data where it can reasonably be linked back to a person.

Nuva applies technical and organizational safeguards appropriate to the type of information and the risks involved.

The intended security design includes measures such as:

• role-based access;
• stronger controls for identity and verification information;
• access logging;
• protected transmission and storage;
• provider-security requirements;
• backup controls; and
• incident-management procedures.

Only safeguards actually implemented should be represented as operating security measures.

Traceability Without Exposing Identity

Nuva may associate Licensed Asset deliveries with opaque technical identifiers, forensic traceability technologies, digital provenance records or file-integrity information.

These mechanisms are designed to help Nuva:

• identify an authorized delivery;
• verify whether a file corresponds to a Nuva delivery;
• investigate suspected misuse;
• verify provenance; and
• protect the rights of Talent, Producers and Nuva.

Traceability identifiers are not intended to directly contain a Talent’s passport information, biometric verification template, bank information, Producer payment credentials or complete License terms.

Where technical mappings can be connected back to identifiable individuals, Nuva treats those mappings as personal data.

No security system can guarantee absolute security.

If a personal-data breach occurs, Nuva will assess the incident, take appropriate containment and remediation measures, and notify the competent authority and affected individuals where required by applicable law.

Nuva and our service providers may use cookies, pixels, SDKs and similar technologies (“Cookies”) to operate and secure the Platform, understand how our services are used, improve performance and support marketing activities.

Cookies may collect information such as device and browser information, IP address, pages visited, interactions with the Platform and the date and time of your visit.

We may use the following types of Cookies:

• Strictly Necessary Cookies — required for core functions such as login, authentication, security and session management.
• Analytics Cookies — help us understand Platform usage, performance and areas for improvement.
• Marketing Cookies — help us measure campaigns and deliver more relevant advertising.

Where required by law, Nuva will obtain your consent before using non-essential Cookies.

You may manage your Cookie preferences through our Cookie settings or your browser or device settings. Disabling certain Cookies may affect some features of the Platform.

Nuva may use third-party analytics, advertising and technology providers. The providers and technologies we use may change as the Platform evolves.

Marketing messages are different from service communications.

Under Nuva’s proposed launch design, optional marketing communications require a separate choice.

You may withdraw from marketing at any time using an available unsubscribe control or by contacting Nuva.

Even if you opt out of marketing, Nuva may continue sending necessary messages concerning matters such as:

• account security;
• verification;
• purchases;
• licensing requests;
• Talent approvals;
• payments;
• legal changes;
• disputes; or
• other service-related matters.

Depending on applicable law and the circumstances, you may have rights to:

• request access to your personal data;
• request a copy of your personal data;
• obtain information about the source of information not provided directly by you;
• correct inaccurate information;
• request deletion, destruction or anonymization;
• request restriction of processing;
• request portability where applicable;
• object to certain processing;
• object to direct marketing; and
• withdraw consent where processing is based on consent.

To submit a privacy request, contact:

legal@nuva-license.com

Subject: Privacy Request

Nuva may request proportionate information necessary to verify your identity or authority before acting on a request.

You do not need to purchase a License, register a Production or obtain a certificate in order to exercise statutory privacy rights.

Nuva will respond within the periods required by applicable law.

For applicable access requests under Thailand’s Personal Data Protection Act, Nuva will follow the statutory timeframe and conditions then in force.

If Nuva cannot fully satisfy a request because a lawful exception applies, we will explain the applicable reason to the extent permitted.

Nuva may also use redaction or restriction where appropriate to protect another person’s rights instead of refusing an entire request.

You may also have the right to submit a complaint to the Office of the Personal Data Protection Committee of Thailand through its official channels.

Where Nuva relies on consent, you may withdraw that consent through an available control or by contacting us.

Withdrawal should be as straightforward as providing consent, subject to applicable law and the technical implementation of the relevant service.

Withdrawal applies prospectively.

It does not automatically make processing that was lawful before withdrawal unlawful.

Where processing depends entirely on the withdrawn consent, Nuva will stop the relevant future processing unless another lawful exception or requirement applies.

Nuva will not simply substitute a new legal basis after withdrawal for the sole purpose of continuing unchanged processing that genuinely depended on the withdrawn consent.

The following actions are legally and operationally distinct:

• closing a Nuva account;
• removing a Talent from public discovery;
• stopping future licensing;
• withdrawing consent for a specific processing activity;
• terminating participation in Nuva;
• terminating an issued License; and
• requesting deletion of personal data.

A Talent who stops offering future Licenses may still have existing Licenses that remain subject to their applicable terms.

Likewise, an existing License does not authorize unrestricted retention or unrelated processing of personal data.

If a privacy request affects information connected to existing Licenses, Nuva will assess the relevant data, applicable legal grounds, contractual records, Licensee disclosures and required actions.

Nuva does not promise that every copy of a previously distributed Licensed Asset or information already processed by an independent recipient can always be technically recalled immediately.

Technical difficulty, however, does not remove any legal obligations that otherwise apply.

Nuva Phase 1 participation is limited to individuals more than 20 years old as specified in the applicable Nuva Terms.

Nuva does not knowingly activate an ineligible Talent profile.

If you believe Nuva has collected personal data contrary to our eligibility rules, contact us so that we can investigate and take appropriate action.

Information relating to another person may still appear incidentally in submitted materials.

Age eligibility does not remove Nuva’s responsibility to assess unnecessary third-party personal data where it becomes aware of such information.

Where studio capture is used to create Nuva Likeness Assets, capture and transfer operations should use approved devices, accounts and channels.

Studio personnel should:

• use authorized capture systems;
• transfer files through controlled channels;
• verify successful transfer;
• verify file integrity where appropriate; and
• delete unnecessary temporary local copies after successful transfer within the approved retention period.

Nuva does not intend to authorize studio personnel to keep personal portfolio copies, transfer Talent files through personal cloud accounts or private messaging channels, or reuse Nuva Talent material for unrelated advertising.

Nuva may update this Privacy Policy when our services, legal obligations, technologies or processing activities change.

We will identify the version and effective date of the Policy and provide appropriate notice of material changes.

Updating this Privacy Policy does not automatically:

• expand an existing License;
• grant new likeness rights;
• create new AI Training permission;
• retroactively authorize a new processing purpose; or
• replace a new consent where applicable law requires one.

Nuva may record which Privacy Policy version was presented at relevant collection, onboarding or transaction events for accountability purposes.

For privacy questions, requests or concerns, contact:

Phileas Retail Corporation Co., Ltd.

Nuva Privacy Contact

952 Ramaland Building, 12th Floor

Rama IV Road, Suriyawong Subdistrict

Bang Rak District, Bangkok 10500

Thailand

Email: legal@nuva-license.com

Subject: Privacy Request