Privacy Policy

Gdpr policy

What is the GDPR?
The GDPR is the General Data Protection Regulation which replaced the
Data Protection Act from May 2018. It's written to ensure that
organisations have strict policies and practices in place for managing
and handling personal data. 

How does the GDPR affect Nursery and school photography?
For the most part, when we take photographs, we don't store any personal
data of the children or staff who we are photographing beyond the shoot.
For Schools, We receive a list of all children’s names and classes and
convert this information in to barcodes to use on shoot day. In all
cases We refer to children by their first name only during their shoot
to build rapport then each image is assigned unique identifier. This is
the reference parents see on their order forms.
After the photographs have been taken, they are then ready for in-house
editing. 
We then make a proof sheet for each child and deliver back to setting
for distribution.
On request, Schools are also given a USB with coded images to be
uploaded on to their ID systems. During this process, we do not receive
any additional, personal data about the pupils. 
If for any reason a job does require us to collect more personal data,
we will work within the GDPR requirements.
For Your interest - The School or education trust maintains the position
of Data Controller in all Dealings and Your Story Photography is the
Data Processor
Each child is then assigned a personal, password protected gallery on
our hosting site to view their images only. There, they can place orders
for digital images and prints to be posted to their home address or to
school.
We are committed to working closely with all of our schools to ensure
that we assist them with GDPR compliance.
Images are stored on a secure website during the ordering process and
removed after 90 days of order deadline. We do not use your images for
any marketing or display purpose without parent/schools express consent.
They are not shared with any other parents or third parties. The School
or setting are responsible for gaining parent permissions to take photos
initially and to reuse the images for display if selected for marketing
purposes

If you are a parent and would like to know more about how your child’s
image is linked to their school ID please contact your school.

How does the GDPR affect family photography?
When we take your family portraits, we only ask information that’s
relevant to the shoot to get the best from the session. This might be
but not limited to;
First names, children’s birthdates and abilities , family relationships,
address, telephone number and email contact. This information is not
stored with or connected to images online and is for shoot purposes
only.

After the photographs have been taken, they are then ready for in-house
editing then each family shoot is assigned a personal, password
protected gallery on our  secure hosting website to view their images
only. There, they can place orders for digital images and prints to be
posted to their home address.

We do not use your images for any marketing or display purpose without
your express consent. They are not shared with any other parents or
third parties.


What happens next?
We are committed to being fully compliant with the GDPR, We review and
test our data processes and continue to work effectively with all our
schools and family sessions






Privacy Policy

We are committed to protecting and respecting your privacy.
1. Information we collect from you
When interacting, photographing and placing orders, We will collect and
process data about you.
Eg Information that you give us by filling in forms on our sites or by
corresponding with us by phone, e-mail etc. It includes information you
provide when you have a photoshoot, register to use our site, place an
order, enter a competition, and when you report a problem with our site,
products or services. The information you give us may include your name,
address, e-mail address and phone number, financial and credit card
information and personal description.

This information is never shared without your knowledge or permission
with any third parties for the purpose of marketing or direct contact

2. Purposes for which we may process the information
We use information held about you in the following ways:
•  to carry out our obligations arising from any contracts entered into
between you and us and to provide you with the information, products and
services that you request from us;
• to provide you, with your permission,  information about other goods
and services we offer that are similar to those that you have already
purchased or enquired about;
•  to notify you about changes to our service;

3. Information we collect about you.
We will use this information:
* to administer our site and for internal operations, including
troubleshooting and data analysis,
* For editing, payment processing, printing and delivering product
* to allow you to participate in interactive features of our service,
when you choose to do so;
* as part of our efforts to keep our site safe and secure;
* to make suggestions to you and other users of our site about goods or
services that may interest you or them

4. Legal basis of processing
4.1. Data Protection Law requires us to meet at least one “legal ground”
for processing, currently set out in Article 6 of the General Data
Protection Regulation. The grounds applicable to the personal data to
which this policy relates are:
4.1.1. Where the processing is necessary for us to perform a contract
that you are party to, or to take steps at your request prior to
entering a contract, that is the ground on which we are processing that
data; 
4.1.2. Where the processing is necessary for compliance with a legal
obligation to which we are subject, that is the ground on which we are
processing that data;
4.1.3. Where processing is necessary for the purposes of our legitimate
interests or the legitimate interests of a third party, that is the
ground on which we are processing that data, provided that your
fundamental rights and freedoms which require protection of your data
override those legitimate interests (our legitimate interests comprise
the management, marketing and promotion of our business, products and
services;
4.1.4. If you have given your consent to our processing the data, that
is the basis on which we are processing that data.
If more than one of the above grounds apply to the processing of data in
question, the applicable ground will be the one that is set out first
above.

5. Where we store your personal data
5.1. The data that we collect from you will be stored on our servers or
those of our service providers.
5.2. All information you provide to us is stored on our secure servers.
Any payment transactions will be encrypted using SSL technology. Where
we have given you (or where you have chosen) a password which enables
you to access certain parts of our site, you are responsible for keeping
this password confidential, and for all use made of your account with
such password. We ask you not to share a password with anyone.
5.3 Unfortunately, the transmission of information via the internet is
not completely secure. Although we will do our best to protect your
personal data, we cannot guarantee the security of your data transmitted
to our site; any transmission is at your own risk. Once we have received
your information, we will use strict procedures and security features to
try to prevent unauthorised access.

6. Your rights
You have various rights under Data Protection Law. These include:
6.1 The right to ask us not to process your personal data for direct
marketing purposes, even if you have given consent;
6.2 If our processing is based on your consent, the right to withdraw
any consent you may have given for our processing of your data – if you
exercise this right, we will be required to stop such processing if
consent is the sole lawful ground on which we are processing that data;
6.3. The right to ask us for access to the data we hold about you
6.4 The right to ask us to rectify any data that we hold about you that
is inaccurate or incomplete;
6.5. The right to ask us to delete your data in certain circumstances;
6.6 The right to ask us to restrict our processing of your data in
certain circumstances;
6.7 The right to object to our processing of your data in certain
circumstances;

7. Accessing your data
You have the right to obtain from us:
7.1. Confirmation as to whether we are processing (including holding)
personal data about you; and with what purpose we are processing your
data
7.2 Information as to the recipients or categories of recipients to whom
the data has or will be disclosed;
7.3 Information as to the envisaged period for which we will store the
data, or if the basis on which that period will be determined;
7.4 A copy of the data (further copies are available at a reasonable
charge, which we will inform you of should you request further copies).
Please note that this right is subject to the rights of others in
relation to their own personal data, meaning that we cannot disclose
data to you if it would involve disclosing data about someone else.

8. Changes to our privacy policy
Any changes we make to our privacy policy in the future will be posted
on this page. Please check back frequently to see any updates or changes
to our privacy policy.