Privacy Policy | Concept Photography

Concept Photography Ltd Unit 9, Londonderry Farm Keynsham Road Willsbridge BS30 6EL Company number: 05768963

1. About This Privacy Policy

Concept Photography Ltd understands that privacy and the protection of personal information are particularly important when working with children and families. We provide professional nursery, preschool and school photography services and operate an online ordering service through which parents and guardians can securely view and purchase photographs. This Privacy Policy explains how we collect, use, store, protect and share personal information relating to:

children who are photographed by us;
parents and guardians;
customers using our online ordering service;
nurseries, preschools, schools and other childcare settings;
setting managers, staff and organisers;
visitors to our websites; and
people who contact us about our services.

We process personal information in accordance with applicable UK data-protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, together with the Privacy and Electronic Communications Regulations where applicable.

2. Who We Are

Concept Photography Ltd is a professional photography company specialising in nursery, preschool and early-years photography. For the purposes of data-protection law, Concept Photography Ltd will normally act as the data controller for personal information we collect and use in connection with our photography, ordering and customer-service activities. We also use specialist organisations to provide parts of our service. Where those organisations process personal information on our behalf, they act as data processors and are required to protect that information appropriately. Our contact details are: Concept Photography Ltd Unit 9, Londonderry Farm Keynsham Road Willsbridge BS30 6EL Telephone: 0117 955 8100 Email for data-protection enquiries: online@conceptphotographyltd.co.uk Data Protection Contact: Lewis Winter

3. The Information We Collect

The personal information we collect depends upon the service being provided.

Information relating to children

This may include:

photographs taken during a photography session;
the child's name or other identifier where required to administer the photography session;
nursery, preschool or school attended;
class, room or group information;
an administration or photography reference number; and
information necessary to correctly associate photographs with the appropriate child and family.

We aim to minimise the amount of identifying information associated with children's photographs. Printed proof sheets supplied to settings are anonymised and children's names are not printed on the proofs.

Information relating to parents, guardians and customers

This may include:

name;
postal or delivery address;
email address;
telephone number;
order details;
products purchased;
photographs selected;
payment and transaction information;
correspondence with our customer-service team;
complaints, requests or enquiries;
IP address and basic technical information associated with use of our online services; and
information collected through cookies and similar technologies where applicable.

Payment card transactions may be processed by third-party payment providers such as Stripe or PayPal. We do not need to retain full payment-card details ourselves where the transaction is handled by the payment provider.

Information relating to nurseries, schools and other settings

We may also process business contact information such as:

setting name and address;
staff or manager names;
telephone numbers and email addresses;
photography booking information;
session dates and operational information; and
correspondence relating to photography sessions.

4. How We Obtain Personal Information

We may receive information:

directly from parents, guardians and customers;
from nurseries, preschools, schools or other settings arranging photography;
during photography sessions;
when photographs are uploaded and processed;
when customers access our online ordering service;
when an order is placed;
when someone contacts our office; and
automatically through our websites or online systems, for example through server logs or cookies.

The setting is responsible for managing its own safeguarding, participation and parental-permission procedures and for identifying which children may participate in photography in accordance with its policies. Our photographers will follow reasonable safeguarding and operational instructions provided by the setting.

5. How We Use Personal Information

We only use personal information where we have an appropriate reason and lawful basis for doing so. Information may be used to:

arrange and administer photography sessions;
photograph children participating in a session;
associate photographs with the correct child or photography reference;
securely transfer photographs to our processing and ordering systems;
professionally process, edit and prepare photographs;
produce proof sheets;
allow authorised parents and guardians to view photographs online;
process photographic orders;
take payment;
print and manufacture photographic products;
package and deliver orders;
provide digital image downloads where purchased;
respond to customer enquiries;
deal with complaints, refunds or reprints;
maintain appropriate financial and business records;
protect our systems against misuse or unauthorised access;
comply with legal and regulatory requirements; and
analyse anonymised or aggregated sales and operational information.

We do not allow staff or photographers to copy, publish, share or use customer photographs for their own personal purposes. Photographs of children will not be used publicly for advertising, social media, portfolio or promotional purposes unless appropriate separate permission has been obtained.

6. Our Lawful Bases for Processing

Depending upon the information and purpose involved, we may rely upon one or more lawful bases.

Contract

We process information where it is necessary to provide a product or service requested by a customer, including processing orders, taking payment, delivering products and providing customer support.

Legitimate Interests

We may process information where this is necessary for the legitimate operation of our photography business, provided those interests do not override the rights and interests of the individuals concerned. This can include administering photography sessions, securely processing photographs, maintaining our systems, providing customer support, preventing misuse and maintaining appropriate business records. When children's information is involved, we recognise that additional care is required and the interests and rights of the child are an important consideration.

Legal Obligation

We may retain or process information where necessary to meet legal, accounting, taxation, regulatory or other statutory obligations.

Consent

Where consent is the appropriate lawful basis, we will obtain it before carrying out the relevant processing. Where we rely on consent, that consent may be withdrawn at any time, although withdrawal will not affect processing that was lawful before the consent was withdrawn.

7. Children's Photographs and Privacy

We recognise that photographs of children require particular care. Our photographers are experienced in working within childcare settings and photographs are handled through authorised Concept Photography processes. Following a photography session, images are securely submitted through our software systems for processing by our authorised team. Access to photographs is restricted to people who require access in order to perform their role. Staff and photographers must not:

retain unauthorised personal copies of children's photographs;
send photographs through unauthorised systems;
publish customer photographs;
use photographs for personal purposes; or
provide photographs or access details to unauthorised individuals.

Children's names are not printed on the proof sheets we provide to nurseries or settings.

8. Online Viewing and Ordering

Concept Photography uses a specialist online photography and ordering system supplied by Netlife. The system allows parents and guardians to:

access the photographs associated with their child;
view photographs online;
select photographic products;
purchase prints and digital products;
make payment;
receive order confirmation; and
provide delivery information where required.

Access to photographs is controlled through the systems, identifiers and access procedures used by Concept Photography and Netlife. Parents and guardians are responsible for keeping any access code, login information or other credentials provided to them secure and should not knowingly provide them to unauthorised individuals. If you believe somebody has gained unauthorised access to photographs or an account, you should contact Concept Photography as soon as possible.

9. Netlife and Image Storage

Netlife provides technology used by Concept Photography for secure image storage, photography workflow and online ordering. Images submitted following a photography session are stored on protected systems with access restricted through authentication and authorisation controls. Netlife advises that its systems include measures such as:

controlled access to personal information;
individual authenticated user access;
TLS encryption for information transmitted over public networks;
encrypted off-site backup storage;
regular off-site backups and/or replication;
resilient data-storage systems;
redundant infrastructure; and
physical security controls at its data-centre facilities.

Access by Concept Photography staff is limited according to operational requirements and individual login credentials are used where applicable.

10. Printed Proofs and Orders

Following photography, images are professionally proofed by our team. Where printed proof sheets are supplied to the nursery or setting, these are sent using appropriate postal or courier services. Proof sheets are anonymised and do not display children's names. Parents and guardians place orders through the ordering system. Depending upon the products purchased, relevant order information may then be used to:

produce photographs or other products;
identify the photographs selected;
package the order;
produce order documentation;
arrange delivery; and
provide customer service, replacements or reprints.

Only information reasonably required to fulfil the order is used for these purposes.

11. Who We Share Information With

We do not sell personal information. We may share information with organisations that provide services necessary for the operation of Concept Photography. These may include: Netlife For image storage, photography workflow, online galleries, ordering and related technical services. Stripe and/or PayPal For payment processing. Printing and photographic-production providers Where required to manufacture or fulfil photographic products. Postal, courier and delivery companies Where required to deliver proofs or customer orders. IT, hosting, email and technical-service providers Where access is necessary to provide or maintain systems used by Concept Photography. We only provide service providers with the information reasonably necessary for them to perform the relevant service and expect appropriate confidentiality and data-protection safeguards to be in place. We may also disclose information where required by law, a court order, regulatory authority or other lawful requirement.

12. International Transfers

Some organisations providing services to Concept Photography may process information outside the United Kingdom. Where personal information is subject to a restricted international transfer, we take appropriate steps to ensure that the transfer complies with UK data-protection law. Depending upon the destination and circumstances, this may include relying upon UK adequacy regulations or appropriate contractual and other safeguards.

13. How Long We Keep Information

We do not intend to retain identifiable personal information for longer than is reasonably necessary for the purpose for which it was collected. Different categories of information may therefore be retained for different periods. When deciding how long information should be retained, we consider:

the purpose for which the information is held;
whether photographs remain available for ordering or customer support;
the potential need for reprints or replacement products;
complaints or ongoing enquiries;
legal, taxation and accounting requirements;
contractual requirements;
security requirements; and
whether there is a continuing legitimate business reason for retaining the information.

Order information may be retained following fulfilment where reasonably required for customer support, complaints, refunds, reprints, accounting or legal requirements. Photographs may be retained after the original ordering period to enable customer service, additional orders or reprints. Customers may contact us to request deletion, subject to any lawful reason requiring us to retain particular information. Where identifiable information is no longer required, it may be securely deleted or anonymised. Anonymised and aggregated information which no longer identifies an individual may be retained for longer periods for purposes such as historical sales reporting, statistical analysis and business planning.

14. Security

Concept Photography takes reasonable technical and organisational measures to protect personal information against:

unauthorised access;
accidental loss;
disclosure;
alteration;
misuse; and
destruction.

Measures include controlled system access, password-protected accounts, appropriate access permissions, encrypted transmission, secure online systems, backups and staff procedures. Access to children's photographs and customer information is limited to authorised individuals where access is necessary for their role. All staff and photographers are required to protect confidential and personal information and to follow Concept Photography's data-protection and security procedures.

15. Data Breaches

Any suspected loss, unauthorised access, disclosure or misuse of personal information or photographs must be reported internally and investigated. We maintain procedures for assessing and responding to personal-data breaches. Where a breach meets the legal threshold for notification, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where required by data-protection law, we will also inform affected individuals.

16. Marketing

We may send marketing communications where you have requested them or where we are otherwise permitted to do so by law. You can opt out of marketing communications at any time by logging into your shop account and turning off communication in the settings. Opting out of marketing will not prevent us from sending service communications which are necessary in connection with an existing photography session, customer enquiry or order.

17. Cookies and Website Information

Our websites and online services may use cookies and similar technologies. Some cookies are required for websites and ordering systems to operate correctly. Other cookies may be used for functionality, security, analytics or other purposes. Further information about the cookies used by our services should be provided through the relevant Cookie Policy or cookie-management information made available on the website.

18. Your Data-Protection Rights

Depending upon the circumstances and lawful basis being used, you may have rights including:

the right to be informed about how your personal information is used;
the right to access personal information held about you;
the right to have inaccurate information corrected;
the right to request deletion of information in certain circumstances;
the right to restrict processing in certain circumstances;
the right to object to certain processing;
the right to data portability in applicable circumstances;
the right to withdraw consent where processing relies upon consent; and
rights relating to certain forms of automated decision-making.

These rights are not absolute and may depend upon the circumstances and lawful basis on which information is being processed. Concept Photography does not currently use personal information to make significant decisions about customers or children solely through automated decision-making or profiling.

19. Subject Access Requests

You may ask us whether we hold personal information about you or your child and request a copy of that information. This is commonly known as a Subject Access Request (SAR). Requests can be made using the contact details in this policy. We may need to verify your identity and, where a request relates to a child, that you are authorised to exercise the relevant rights on their behalf. We will respond without undue delay and normally within one month of receiving a valid request. Where permitted by law, this period may be extended where a request is particularly complex or where a number of requests have been received. If an extension is required, we will explain this to you. There is normally no fee for exercising your data-protection rights, although the law allows fees or other action in certain limited circumstances.

20. Requests to Delete Photographs or Personal Information

Parents, guardians and other individuals may contact us if they would like personal information or photographs deleted. We will consider each request in accordance with applicable data-protection law. The right to deletion is not absolute. In some situations, we may need to retain certain information because of legal obligations, an ongoing transaction, a dispute or another lawful reason. Where there is no continuing lawful reason for retention, information will be deleted or anonymised as appropriate.

21. Data-Protection Complaints

If you have concerns about the way Concept Photography has collected, used, stored, shared or protected personal information, you may make a data-protection complaint directly to us. Complaints can be made using: Email: online@conceptphotographyltd.co.uk Telephone: 0117 955 8100 or by writing to: Concept Photography Ltd Unit 9, Londonderry Farm Keynsham Road Willsbridge BS30 6EL We will acknowledge receipt of a data-protection complaint within 30 days. We will take appropriate steps to investigate the complaint without undue delay, make reasonable enquiries where necessary, keep the complainant informed where appropriate and communicate the outcome of our investigation. We may request reasonable information to confirm identity or authority where this is necessary to properly investigate a complaint. If you remain dissatisfied, you also have the right to raise your concerns with the Information Commissioner's Office (ICO).

22. Contacting Us About Privacy

For questions about this Privacy Policy, requests concerning your personal information, requests concerning photographs or data-protection complaints, please contact: Data Protection Contact: Lewis Winter Concept Photography Ltd Unit 9, Londonderry Farm Keynsham Road Willsbridge BS30 6EL Email: online@conceptphotographyltd.co.uk Telephone: 0117 955 8100

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, suppliers, working practices or applicable legislation. The latest version will be published through our website or online services as appropriate.

24. Safeguarding and Photographer Vetting

The safety and protection of children is fundamental to the way Concept Photography operates. All photographers working for Concept Photography are required to have an appropriate Enhanced DBS check before undertaking photography assignments involving children. Relevant DBS details and evidence of checks are held or recorded by Concept Photography's main office for safeguarding, compliance and verification purposes. Our photographers are experienced in working with children and receive guidance and training regarding the professional standards expected when working within nursery, preschool, school and childcare environments. Photographers are expected to:

maintain appropriate professional boundaries with children;
follow the safeguarding procedures of Concept Photography and the setting they are attending;
comply with reasonable visitor, contractor and safeguarding requirements;
immediately report any safeguarding concern through the appropriate procedure; and
conduct themselves professionally and appropriately at all times.

Nurseries and other settings may contact Concept Photography if they require confirmation of a photographer's DBS status before a photography session.

Other safeguarding risks

Concept Photography recognises that there may be circumstances in which access to a child's photographs could create a safeguarding or privacy risk. For that reason, we may carry out additional checks before providing access to photographs, issuing or replacing access details, discussing a child's images, or supplying copies of photographs. This may be particularly relevant where:

a person requesting access does not have the original access code or other information normally used to access the photographs;
we are unable to verify the identity or authority of the person making the request;
there is information suggesting that parental responsibility, contact arrangements or access to the child may be restricted or disputed;
parents or guardians are separated and there may be safeguarding or legal restrictions affecting access;
a nursery, school or childcare setting has identified a safeguarding concern; or
the circumstances of the request otherwise give us reasonable cause to carry out further verification.

Where appropriate, Concept Photography may contact the relevant nursery, school or childcare setting to verify that providing access is appropriate before photographs or access information are released. We will not ask settings to disclose more information than is reasonably necessary for this purpose. Where we are unable to satisfy ourselves that access can be provided safely and appropriately, we may decline or delay the request while appropriate checks are completed. These procedures are intended to protect children and families and to reduce the risk of photographs being disclosed to an unauthorised person.