*The following operational documents implement the commitments made in the Terms and Privacy Policy. Publish Documents A and B as consent flows in your upload/checkout process; Documents C and D may be published as help-centre pages.*

Document A — Biometric Data Consent Statement (upload / checkout flow)

*Present this at the point of Reference Photo upload, with an unticked checkbox. Do not bundle it with acceptance of the Terms.*

Explicit Consent to Biometric Data Processing

I am uploading 8–20 photographs of my own face (or of an adult who has given me documented consent, as required by Section 8 of the Terms of Service) for the purpose of receiving the Done-for-You AI headshot service from Manifesto Agency.

I understand and explicitly consent to the following:

1. My photos contain biometric data (facial characteristics), which is sensitive personal data under the Personal Data Protection Act 2010 (as amended 2024).

2. Manifesto Agency will process this data only to generate, curate and deliver my headshots, perform quality control on my order, communicate with me about my order, and prevent fraud and misuse — as described in Section 5 of the Privacy Policy.

3. Where generation requires submission of my photos to a third-party AI platform, this will occur only as described in Section 5.5 of the Privacy Policy.

4. My photos and biometric data will be securely deleted within 30 days after final delivery and the end of the revision window, unless I request otherwise in writing.

5. My photos will not be used to train AI models, sold, or used in marketing without my separate consent.

6. I may withdraw this consent at any time by emailing hello@manifesto.studio. If I withdraw before delivery, my order will be treated as cancelled under Section 15.7 of the Terms of Service.

7. Providing this data is voluntary and is required only for the Done-for-You service.

☐ I have read the Privacy Policy and I explicitly consent to the processing of my biometric data as described above.

Document B — Marketing and Testimonial Release (optional, separate consent)

*Optional opt-in, presented separately (e.g., after delivery). Never pre-ticked. The DFY Service must not be conditioned on giving this consent.*

Optional: Let us showcase your results

Manifesto Agency would love to feature your AI headshots in our marketing — for example in case studies, social media posts, website galleries and portfolio examples. This is entirely optional and does not affect your order or any refund rights.

If you agree, you grant Manifesto Agency a non-exclusive, royalty-free, worldwide licence to use, reproduce, display, crop and resize the AI headshots delivered under your order (and, if you provide one, your testimonial) in its marketing materials and channels.

- We will not publish your name, employer or contact details unless you separately agree in writing.

- We will never publish your original uploaded reference photos.

- You may withdraw this consent at any time by emailing hello@manifesto.studio; we will stop new uses and remove the material from channels we control within 30 days (material already lawfully published or shared by third parties before withdrawal may be beyond our recall).

- No payment or credit is due for these uses.

☐ Yes, I consent to Manifesto Agency using my delivered AI headshots (and my testimonial, if provided) in its marketing as described above.

☐ You may also mention my first name (optional)

Document C — Refund Request Procedure

1. Eligibility check. Digital Products carry a 14-day money-back guarantee (Terms, Section 14). The Done-for-You service is refundable per Terms, Section 15.7 (in full before work commences; after commencement only in the cases listed there).
2. How to request. Email hello@manifesto.studio from the email address used at purchase, with subject "Refund Request", within 14 days of purchase (for Digital Products). Include: your order number or receipt, the product concerned, and a brief description of what you tried and the results you obtained.
3. Assessment. We review requests in good faith, normally within five (5) Business Days. We may ask follow-up questions or (optionally) to see sample outputs — both to assess the claim and to try to fix your results first.
4. Outcome. Approved refunds are returned to the original payment method, normally within ten (10) Business Days of approval (bank and card-scheme timelines may add time). If we refuse a request, we will explain why.
5. After a refund. Your licence to the refunded product ends immediately; you must delete all copies (Terms, Section 14.4).
6. Billing problems. For duplicate charges, unrecognised transactions or payment errors, contact us first — most issues are resolved faster with us than through a bank dispute. Nothing in this procedure limits your statutory rights, including under the Consumer Protection Act 1999.

Document D — Data Subject Rights Request Procedure

1. Scope. This procedure covers PDPA requests: access, correction, withdrawal of consent, cessation of processing (damage/distress or direct marketing), data portability (where available), and deletion requests.
2. How to submit. Email hello@manifesto.studio with the subject "PDPA Request". State: (a) which right you are exercising; (b) the data or processing concerned; and (c) the email address you used with us.
3. Identity verification. To protect your data, we verify identity before disclosing or altering personal data — normally by confirming control of the email address on file; for biometric-data requests we may require additional confirmation. We will not process requests we cannot verify, and will tell you if verification fails.
4. Timelines. Access and correction requests: within twenty-one (21) days as prescribed by the PDPA (with notice to you if a permitted extension applies). Withdrawal of consent and direct-marketing opt-outs: actioned promptly. Other requests: within a reasonable period consistent with the PDPA.
5. Fees. Access requests may attract the modest fee prescribed under the PDPA; we will tell you the fee (if any) before proceeding. All other requests are free of charge.
6. Refusals. Where the PDPA permits or requires refusal (for example, where disclosure would reveal another person's data), we will explain the ground relied on and your right to complain to the Personal Data Protection Commissioner (JPDP).
7. Records. We keep a log of requests and outcomes as evidence of compliance.