Data Protection & GDPR

As part of running a small business Richard's Photography collects necessary data from clients to manage and process bookings, and maintain accounts and records. The company only holds information for advertising, marketing and public relations in connection with its core business; this may include past, existing or present customers or suppliers. 

As Richard's Photography only processes personal data for core business purposes, it is exempt from registration with the Information Commissioner's Office (ICO).

GDPR Privacy Notice

Our contact details:

What type of information we have:

We currently collect and process the following information: name and contact details, details of bookings and invoices/payments, hobbies, interests, preferences, and the collection of photographs taken during photoshoots or provided by subjects.

How we get the information and why we have it:

The personal information we process is provided to us directly by you for one of the following reasons: to facilitate running a photo shoot (including taking suitable pictures based on information about you such as interests or hobbies), bookings, invoicing and payments.

On some occasions, we also receive personal information indirectly, for example when a third party makes a booking on your behalf.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• Your consent. (You are able to remove your consent at any time. You can do this by contacting us using the details above.)
• We have a contractual duty.
• We have a legitimate interest.

What we do with the information we have:

We use the information that you have given us in order to organise and run a photoshoot and to produce invoices and take payment.

We will only share this information (in part or in full) if there is a legal duty to do so, or if we have your clear written or electronic consent.

How we store your information:

Personal Information

Your information is securely stored on a secure private server (we do not store information on third party servers).
Unless you give written or electronic consent we keep your personal data for a maximum period of 18 months. We will then dispose your information (or the parts for which you have not given consent) by erasing it from our servers (including the back up server).

Photographs

Photographs are recorded on to memory cards inside the camera. These photos are then transferred to a computer and stored on the computer hard drive and back up drives. Data is not retained on memory cards when the successful transfer of data to a computer has been confirmed.
Occasionally (for editing purposes) we may transfer data to Adobe Creative Cloud.
We may also transfer photographs taken during a photoshoot to a client by the following means:

• Using a link embedded on our website (hosted by WebMate).
• Using Adobe Creative Cloud.
• Using WebMate Cloud service.

Each option has password security (unless explicit confirmation is obtained from a client).

Your data protection rights:

Under data protection law, you have rights including:

• Your right of access: You have the right to ask us for copies of your personal information. 
• Your right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances. 
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your information in certain circumstances. 
• Your right to object to processing: You have the right to object to the processing of your personal data in certain circumstances.
• Your right to data portability: You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us using the details above if you wish to make a request.

How to complain:

You can also complain to the ICO if you are unhappy with how we have used your data. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or telephoning 0303 123 1113.

Updated 28th November 2020