• English
  • Français
  • Español
TOTEM Worldwide Ltd

Privacy Policy

Last updated 20 October 2026

1. Introduction & Data Controller Structure

Welcome to TOTEM ("we," "us," or "our"). TOTEM Worldwide Ltd. provides international communications, brand strategy, public relations, event production, creative services, and VIP/talent management for luxury, lifestyle, entertainment, fashion, and performance-sport brands (our "Services").

We respect your privacy and are committed to safeguarding personal data in accordance with:

  • The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018;
  • The EU General Data Protection Regulation (EU GDPR 2016/679); and
  • The French Data Protection Act (Loi Informatique et Libertés).

This Privacy Policy explains how we collect, process, hold, disclose, and protect personal data collected via:

  • Our public website (www.totemworldwide.co);
  • Direct client, talent, vendor, and brand engagements;
  • Our specialized media and talent industry database hosted on internal servers, Google Workspace, and industry platforms such as Launchmetrics (the "Industry VIP & Media Database"); and
  • Our live creative and production operations for runway shows, shoots, film sets, showroom previews, dinners, and brand activations (each, an "Event").

Data Controller Identification

TOTEM Worldwide Ltd is the sole data controller responsible for the personal data collected and processed across our business activities, whether initiated in the United Kingdom, France, or other international jurisdictions.

  • Company Details: TOTEM Worldwide Ltd is an entity registered in England and Wales under Company Registration Number 16190048, with its registered office at Office Suite 3, Shrieves Walk, Stratford-Upon-Avon, England, CV37 6GJ.
  • International & European Operations: Although TOTEM Worldwide Ltd is incorporated solely in the United Kingdom, we provide Services, manage media lists, and produce Events internationally across France and the wider European Union. For individuals located in France or the European Economic Area (EEA), TOTEM Worldwide Ltd processes your personal data in accordance with the EU General Data Protection Regulation (EU GDPR 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).

For events produced on behalf of brand clients or venues, the sponsoring client or venue host may also act as an independent data controller. Where third-party front-of-house ticketing providers, hotel partners, or payment gateways collect data independently, their respective privacy policies apply.

Data Protection Desk: privacy@totemworldwide.co

2. Categories of Personal Data We Collect & Sources

Personal data is any information about an individual from which that person can be identified. It does not include anonymous or de-identified data. We process personal data across distinct operational streams:

A. Website Visitors

  • Identity & Contact Details: Name, business email, telephone number, organization/brand name, job title, and message contents submitted via site forms.
  • Technical & Usage Information: IP addresses, browser types, operating systems, referring URLs, access timestamps, and interaction records captured via cookies and standard tracking tools.

B. Industry VIPs, Journalists, Stylists & Talent

In connection with our PR and talent services, we maintain an Industry VIP & Media Database (utilizing tools such as Launchmetrics / Fashion GPS Radar) containing details of editors, journalists, stylists, creators, VIP talent, and public figures.

  • Data Points Collected:
  • Full name, professional biography, company, agency, or editorial masthead affiliation;
  • Professional email address, telephone numbers, and studio/agent contact details;
  • Social media account handles and online metrics;
  • Delivery addresses for lookbooks, press kits, gifting suites, and PR seeding;
  • Sizing profiles (shoe, dress, suit, and garment measurements) for runway fittings, loans, and wardrobe dressings;
  • Dates of birth and passport/travel document details required exclusively for booking flights, hotel accommodations, and event accreditations; and
  • Relevant relationship notes and engagement histories with our client brands.
  • Sources: This information is provided directly by you, your authorized talent manager, agent, or publicist, or gathered from public mastheads, verified social profiles, and accredited industry directories. We never purchase mass commercial data lists.

C. Event Attendees & Live Activations

  • Accreditation & Guest Lists: Basic identity details, organization, role, RSVP status, check-in timestamps, arrival schedules, and seating assignments.
  • Event QR Codes & Digital Entry: Data submitted voluntarily via iPads, digital door apps, or QR check-in desks (name, email, device type, scan timestamp).
  • Photography, Video & Crowd Filming: Still images, video recordings, audio, and likenesses captured across live Events, red carpets, sets, and showroom presentations.

D. Sensitive & Special Category Data

We do not collect sensitive personal data as a matter of course. However, where directly relevant to our Services, we may process:

  • Dietary & Allergy Details: Information disclosing health requirements, medical allergies, or religious/philosophical dietary choices provided voluntarily for event hospitality or press trip catering;
  • Accessibility Accommodations: Physical mobility or accessibility needs required for safe venue entry; and
  • Passport & National Identity Details: Information required for booking international flights, issuing hotel room blocks, securing visa credentials, or completing venue security background checks.

E. Minors & Children

Where minors participate in a fashion show, campaign shoot, or event, we process their data strictly when necessary for safeguarding, performance licensing, or call-sheet management. We obtain explicit consent from a parent, legal guardian, or licensed talent agency and limit processing to what is strictly required.

F. Client & Team Portal Users

TOTEM operates a private, invitation-only portal for its team members, contractors, and brand clients. Through the portal we process:

  • Account Details: Name, business email address, job title, role, office location, optional profile photograph, and sign-in records.
  • Onboarding & Policy Acceptance (team members and contractors): Worker classification, employment type and operational hub, the policies and handbook acknowledged, the typed signature name, the date and time of signing, the IP address used, and a unique signature reference (a cryptographic hash) that evidences each acceptance.
  • Work & Collaboration Records: Project details, tasks, calendars, budgets and client approvals, comments, and messages exchanged in portal chat and client project threads.
  • Not Collected in the Portal: Bank or payment card details, tax or national insurance numbers, and passport or identity documents are never requested or stored in the portal.

3. Lawful Bases & Operational Purposes

Under Articles 6 and 9 of the UK and EU GDPR, we process personal data under the following legal frameworks:

  • Relationship Management (Industry VIPs, media contacts, stylists, creators, and client liaisons): professional contact data, profile, beat, agency representation. Lawful basis: Legitimate Interests (operating an international PR agency and connecting talent/media with relevant luxury and lifestyle campaigns).
  • Event Administration (invitations, RSVPs, check-in, seating, guest lists): identity, contact info, RSVP status, QR check-in data. Lawful basis: Legitimate Interests; Performance of a Contract; Consent (where specifically required by local statute).
  • Gifting, Seeding & Showroom Activity (wardrobe pulls, fittings, deliveries, sample loans): contact info, postal delivery address, sizing measurements, loan records. Lawful basis: Legitimate Interests; Performance of a Contract (fulfilling styling and loan agreements).
  • Travel, Accommodation & Accreditation (press junkets, brand trips, festival transport): passport scans, dates of birth, itinerary records, national ID details. Lawful basis: Performance of a Contract; Legitimate Interests; Legal Obligation; and Explicit Consent (where required for sensitive travel processing).
  • Health, Dietary & Accessibility Accommodations: dietary restrictions, food allergies, physical access requests. Lawful basis: Explicit Consent (GDPR Art. 9(2)(a)); Substantial Public Interest / Legal Obligation (occupational health and safety compliance).
  • Client Campaign Delivery & Reporting: name, media publication, campaign participation metrics, press clips. Lawful basis: Legitimate Interests; Performance of a Contract.
  • Marketing & Future Invitations: contact details, event engagement history, preferences. Lawful basis: Consent (where required by law); Soft Opt-In / Legitimate Interests (for permitted B2B commercial updates).
  • Payments, Invoicing & Financial Administration: contact details, transaction records, billing addresses (no card data stored). Lawful basis: Performance of a Contract; Legal Obligation (complying with UK HMRC, French DGFIP, and commercial accounting standards).
  • Event Photography, Filming & Documentation: photographic imagery, video recordings, audio, likeness. Lawful basis: Legitimate Interests (documenting brand activations, publicity, and historical campaign records); Contractual Necessity (for contracted talent, models, and influencers).
  • Client & Team Portal: account details, onboarding and policy acceptance records, work and collaboration records. Lawful basis: Performance of a Contract (employment, contractor, and client agreements); Legal Obligation (evidencing acknowledgement of workplace policies); Legitimate Interests (operating a secure collaboration platform and maintaining an accurate audit trail).

4. Event Photography, Filming & Crowd Notices

When attending an Event produced, supported, or managed by TOTEM Worldwide Ltd.:

  • Atmospheric & Crowd Filming: We capture atmosphere photography and video for media distribution, publicity, social channels, and client reporting. Clear signage is placed at venue entrances notifying guests of active filming. For incidental crowd capture, we rely on our Legitimate Interests.
  • Featured Talent & Key Attendees: Where you are featured prominently, interviewed, contracted as runway/editorial talent, or participating under a brand agreement, processing is governed by talent release forms, model contracts, or express consent.
  • Opting Out: If you do not wish to be photographed or recorded, please alert an on-site TOTEM Worldwide door representative or contact us in advance at privacy@totemworldwide.co. We will make reasonable operational efforts to accommodate your request.
  • No Biometric Identification: We do not use Event images or footage for facial recognition, surveillance, or automated biometric processing.

5. Marketing Communications & Event Invitations

  • Communications: We may occasionally send relevant event invitations, industry announcements, and updates regarding our Services to existing clients and professional contacts.
  • Unsubscribing: You may opt out of receiving non-transactional communications at any time by clicking the "Unsubscribe" link included in our emails, or by contacting privacy@totemworldwide.co.
  • Suppression Records: When you opt out, we retain minimal suppression contact records to ensure we continue to honor your preferences across all systems. Opting out of marketing does not impact essential operational communications (such as call sheets, security accreditations, or direct client project coordination).

6. Payment Processing via Stripe

Where payment is processed for ticketed activations, services, or events, we use Stripe, LLC and its corporate affiliates as our third-party payment infrastructure provider.

  • Personal data (name, billing address, transaction total, and payment method identifiers) is shared securely with Stripe to complete payments, manage billing, prevent fraud, and comply with tax regulations.
  • No Card Storage: TOTEM Worldwide never receives, processes, or stores raw payment card numbers, expiration dates, or security codes (CVV).
  • Independent Controller: Stripe processes payment data as an independent data controller under its own privacy policy: https://stripe.com/privacy.

7. Disclosures & Sharing of Personal Data

We do not sell, rent, or trade personal data. We disclose personal data only when operationally necessary, under strict confidentiality terms:

  • Brand Clients: Where relevant to a campaign, gifting delivery, seating arrangement, or collaboration, limited contact, attendance, or sizing data is shared on a need-to-know basis. We do not grant clients direct, unrestricted access to our master VIP, media, or talent databases.
  • Event Suppliers & Logistics Partners: Venues, front-of-house staff, security teams, professional photographers/videographers, travel agencies, airlines, hotels, and accredited couriers.
  • Enterprise Infrastructure & PR Platforms: Third-party cloud systems providing secure hosting, CRM, campaign monitoring, media management, and event communications—specifically including Launchmetrics (for VIP and PR workflow operations), Mailchimp (for client communications and invitations), and Google Workspace (for secure internal document collaboration).
  • Website & Portal Infrastructure: Vercel Inc. (website hosting); Supabase (database, sign-in, and file storage, hosted in the European Union in Dublin, Ireland); our transactional email provider (account invitations, password resets, and notifications); and our appointed technology partner, which develops and maintains the website and portal. Each acts as a data processor under a written data processing agreement.
  • Professional Advisers & Regulators: Legal counsel, accountants, auditors, insurers, tax authorities (HMRC, DGFIP), and law enforcement when legally required.

8. International Data Transfers

Because TOTEM Worldwide operates across the United Kingdom, France, and international campaign locations, personal data may be accessed by our cross-border teams or transferred to external service providers, technical development partners, press, brand clients, or venues in jurisdictions outside your country of residence (including the UK, EEA, the United States, Australia, the United Arab Emirates, Pakistan, and other international project destinations).

Core platform databases and hosting infrastructure remain situated in the UK and European Economic Area (EEA). Where personal data is accessed or transferred across international borders, we ensure statutory protections are in place:

  • UK / EEA Continuity: Transfers between the UK and the European Economic Area rely on reciprocal Adequacy Decisions recognised by both the European Commission and the UK Government.
  • Third-Country Transfers: Where data is transferred to or accessed remotely from jurisdictions lacking an adequacy decision (e.g., US-based software hosts or offshore development and support teams), we implement approved statutory safeguards, including:
  • The UK International Data Transfer Agreement (IDTA) or UK Addendum approved by the Information Commissioner’s Office (ICO);
  • Standard Contractual Clauses (EU SCCs) approved by the European Commission;
  • Documented Transfer Risk Assessments (TRAs) / Transfer Impact Assessments (TIAs) evaluating local laws and surveillance risks;
  • Verified certifications under the EU-U.S. Data Privacy Framework and its UK Extension; and
  • Strict technical controls, including encryption in transit and at rest, role-based access, and the exclusion of sensitive identity documents and financial records from development environments.

9. Data Retention Schedules

We retain personal data only for as long as reasonably necessary to fulfill the specific purposes for which it was obtained:

  • Industry VIP & Media Profiles: Retained for as long as you remain active within the media, fashion, luxury, or entertainment sectors and relevant to our Services, unless you object or request deletion. Profiles are audited regularly.
  • Marketing & Event Invitation Contacts: Retained until you opt out or unsubscribe, after which suppression details are kept to respect your communication preferences.
  • Event Guest Lists & Accreditation Records: Retained through event wrap and for up to two (2) years post-event for client reporting, budget reconciliation, tax audits, and dispute resolution.
  • Passport & Sensitive Logistics Data: Sizing, passport scans, and travel identification details collected for bookings or venue security are purged within thirty (30) days following the conclusion of the specific Event or travel program.
  • Special Category (Dietary/Access) Data: Deleted within fourteen (14) days following event completion.
  • Portal Accounts & Collaboration Records: Kept while the account is active, then deleted or anonymised within twelve (12) months of the account being closed, unless needed for an ongoing project, dispute, or legal obligation.
  • Policy Acceptance Records: Retained for the duration of the engagement and for six (6) years afterwards, as evidence that workplace policies were acknowledged.
  • Statutory Accounting & Transaction Records: Retained for six (6) to seven (7) years to comply with statutory UK and French corporate tax and accounting obligations.

10. Your Statutory Legal Rights

Under the UK and EU GDPR, you have the following rights regarding your personal data:

  • Right of Access: Request confirmation of processing and obtain a complete copy of the personal data we hold about you.
  • Right to Rectification: Request the immediate correction of inaccurate or incomplete personal information.
  • Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your data where no overriding legal or contractual requirement justifies continued retention.
  • Right to Object: Object to data processing based on our Legitimate Interests (including the absolute right to object to direct marketing or media pitching lists at any time).
  • Right to Restriction: Request the temporary freeze of data processing under specific statutory circumstances.
  • Right to Data Portability: Request that data you provided directly to us be transferred to you or another provider in a structured, commonly used, machine-readable format.
  • Right to Withdraw Consent: Where processing is grounded in consent, you may withdraw it at any time without affecting past lawful processing.

Exercising Your Rights

To exercise any of your statutory rights, email our Data Protection Officer at: privacy@totemworldwide.co.

  • No Fee: You will not be charged a fee to access your data or exercise your rights. However, we reserve the right under applicable law to charge a reasonable administrative fee or refuse requests that are demonstrably unfounded, repetitive, or excessive.
  • Response Timeline: We respond to verified statutory requests within one (1) calendar month.

11. Data Security Standards

We maintain comprehensive technical, physical, and administrative safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, alteration, or disclosure. Access to personal data—particularly our Industry VIP and guest databases—is restricted to personnel with a verified business need to know, bound by strict contractual duties of confidentiality. The client and team portal uses individual accounts, role-based permissions, encrypted connections (HTTPS), and database-level access controls, so that each client can only see its own projects.

12. Supervisory Authorities & Complaints

If you have questions, concerns, or complaints regarding how we handle your personal data, please contact our Data Protection Desk first at privacy@totemworldwide.co so we can investigate and address the matter.

You maintain the statutory right to lodge a complaint with your local data protection supervisory authority at any time:

13. Policy Updates & Inquiries

We review and update this Privacy Policy periodically to reflect changes in our operational services, digital systems, and legal requirements. Revisions will be published on this page with an updated revision date.

TOTEM Worldwide Operations & Data Protection Desk:

Email: privacy@totemworldwide.co

General Inquiries: hello@totemworldwide.co

Website: www.totemworldwide.co