This policy applies to schools, nurseries, parents, guardians, staff, and individuals whose personal data may be processed as part of photography or filming services.

This policy should be read alongside the Privacy Policy, Image Consent Policy, Safeguarding Policy,
Data Processing Agreement (DPA), and applicable photography contracts.

1. UK GDPR Compliance
Kirsty Bowen Photography processes personal data in accordance with:

• UK GDPR
• Data Protection Act 2018
• Applicable safeguarding and child protection requirements

Procedures and systems are regularly reviewed to support lawful, fair, secure, and transparent processing of personal data.

2. Role of the Parties
For school and nursery photography services:

• The school or nursery normally acts as the Data Controller
• Kirsty Bowen Photography acts as the Data Processor acting on the school’s instructions

For direct-to-parent services:

• Kirsty Bowen Photography may act as Data Controller for gallery delivery, customer communication, order fulfilment, and marketing consent management

The school or nursery remains responsible for determining and managing the lawful basis for pupil photography and filming activities.

Kirsty Bowen Photography relies on the written information, permissions, and restrictions provided by the school or nursery at the time of the session.

3. Personal Data Processed
I may collect the following types of data:

• Identity Data: first name, last name, username, title.
• Contact Data: billing address, delivery address, email address, telephone numbers.
• Financial Data: bank account and payment card details.
• Transaction Data: details about payments and purchases.
• Technical Data: IP addresses, browser type, time zone, location, operating system, platform, and other device technology.
• Profile Data: purchase history, gallery preferences, feedback, and communication records.

• Usage Data: information about how you use my website, products, and services.
• Marketing and Communications Data: preferences for receiving marketing communications.
  
  

Sensitive Data: I do not collect any sensitive data, including details about race, religion, sexual orientation, political opinions, trade union membership, health, or biometric data.

How Data Is Collected:

• Directly from schools, parents, or families
• Automatically via online galleries and website usage.

4. Lawful Basis for Processing
Personal data may be processed under one or more of the following lawful bases:

• Performance of a contract
• Legitimate interests
• Legal obligations
• Consent, where required for marketing or promotional image use

For school and nursery photography services, the school or nursery remains responsible for determining and managing the lawful basis for pupil photography and filming.

5. How Personal Data Is Used
Personal data is used for:

• Providing photography and filming services
• Producing and delivering galleries and products
• Processing orders and payments
• Customer communication and support
• Managing bookings and administration
• Maintaining business and financial records
• Meeting legal, accounting, and regulatory obligations

Images are only used for marketing or promotional purposes where appropriate consent has been confirmed in accordance with the Image Consent Policy.

6. Consent and Image Use
For school and nursery photography services, the school or nursery remains responsible for managing consent and lawful basis requirements for pupil photography and filming.

Kirsty Bowen Photography relies on the consent information and restrictions provided by the school or nursery at the time of the session.

For direct-to-parent portrait services, identifiable images are only used for marketing or promotional purposes where explicit consent has been obtained directly from a parent or guardian.

Further information is available in the Image Consent Policy.