1. Identity and contact information

This Privacy Notice (“Notice”) is provided by School House Photography (“SHP”), of Dawcross, Hill Foot Lane, Harrogate. It covers your rights in relation to the Data Protection Act 1998 (“DPA”), the General Data Protection Regulation (“GDPR”) and the Privacy and Electronic Communications Regulations (“PECR”).

This Notice also explains how SHP complies with the DPA, GDPR and PECR as well.

SHP is both the controller and a processor of all personal data collected.

Date this Notice was created: 13th November 2018

Date this Notice was last modified: 26th June 2025

2. Compliance declaration

We comply with the DPA, GDPR and PECR. The GDPR comes into effect on the 25th of May 2018. This Notice is updated whenever changes are made to relevant data protection legislation.

3. Your rights under the GDPR

Under the GDPR, you have a number of different rights relating to your personal data and how it is processed. They are as follows:

  • Right to be informed about the collection and use of your personal data.

  • Right to access your personal data, and any supplementary information which constitutes personal data.

  • Right to have your personal data rectified; this means you can ask me to correct your personal data if it changes, turns out to be inaccurate, or is incomplete.

  • Right to have your personal data deleted; this means that you have the right to request the deletion or removal of your personal data. There are some circumstances when you do not have this right.

  • Right to restrict me processing your personal data.

  • Right to data portability.

  • Right to object to me processing your personal data.

  • Rights related to automated decision making including profiling.

Most of these Rights will apply to your personal data and how it is processed by SHP, but some (such as the right to data portability and rights related to automated decision making including profiling) are not relevant to this business at the time of writing.

If you want to know more about data protection legislation, please visit the ICO website directly.

4. The data we collect, how we use it and why

Cookies and website visitor tracking

When using this website, you have the choice to agree to cookies. Cookies are small files installed on your browser device that allow websites like this, and many others, to find out more about your browsing behaviour. For SHP, the purpose of using cookies is to better understand visitor demographics to this site so that improvements can be made, as well as informing marketing and sales strategies in the future.

Client contact information

We use personal data, provided directly and voluntarily to us by clients, for two purposes. The first is to carry out my contractual obligations. This means that it’s information I need to do my job. This personal data includes names, addresses, email addresses, phone numbers and further information which I need to complete your photography requirements and communicate directly with you about our services.

The second purpose is for the analysis of the behaviour of our clients to assist us in relation to sales and marketing exercises. For example, to better understand where you heard about our business and whether or not you choose to employ our services. This is a legitimate interest and a reasonable expectation that most people would have about a business. We collect this personal data via email or via our online platform, Shootproof and may from time to time use it for these purposes.

Email addresses for gallery login

To deliver images to clients, we make use of a gallery and proofing service: Shootproof.com. When clients share their galleries with friends and family, they may need to enter their email address to gain access to certain services from Shootproof, with the email address acting as a future login. This allows users to create favourite lists, leave comments and also share and download images effectively. This is also necessary for the ordering of prints. For further information about how Shootproof collects and processes personal data please visit the Shootproof web site.

Mailing lists

At the present time, SHP does not make use of any mailing lists.

More detailed information

If you want to contact us with questions about your personal data, wish to exercise any of your rights, or ask for further detailed questions, please use our contact form.

5. Sharing information with third parties

Other than those third parties mentioned in this Notice and listed below, SHP shall not pass your personal data to any third party.

Your personal data may, subject to my obligations to comply with data protection legislation, be shared with the following third parties:

  • Shootproof.com, as further described above;

  • ‘Associate photographers’ who may be recruited to join us in the very rare case that we require additional support;

  • Where we are required to share personal data with the ICO, and other legal, regulatory and law enforcement bodies;

  • In anonymised form, I may in the future share personal data with a third party in relation to the sale of some or all of my business, or its assets, or as part of any business restructuring or reorganisation, or for the analysis of user metrics in relation to the efficacy of the SHP website

6. Security, storage and data retention

SHP stores your personal data on a private hard drive and retains full details of your personal data for as long as it takes to complete your photography requirements, plus some archiving time in case of follow-up requests. We will delete your personal data not before two years after completion of your photography requirements. If you would like SHP to delete your personal data before this time, you have the right to request us to do so.

7. Your consent

By using this site and/or engaging us on my Terms and Conditions, you agree to be bound by this Notice.

8. Your right to withdraw consent

You have the right to withdraw your consent to be bound by this Notice at any time. If you wish to do so, please use the contact form on the contact page of my website. . You also have the right, as set out above, to withdraw your consent to us processing your personal data.

9. Your right to lodge a complaint

As well as the right to withdraw consent and exercise any of the above rights mentioned under ‘Your rights under the GDPR’, you also have the right to raise a complaint with a regulatory body. In the United Kingdom, this is the Information Commissioner’s Office (ICO). If you have concerns about the way your data is being processed by an organisation, you can find out more there.