This Privacy Policy explains how Kirsty Bowen Photography collects, uses, stores, and protects personal data when providing school, nursery, and portrait photography services.

This policy applies to schools, nurseries, parents, guardians, staff, and individuals whose data may be processed as part of photography services.

This policy should be read alongside the Image Consent Policy, Safeguarding Policy, Data Processing Agreement (DPA), and applicable photography contracts.

1. Data Controller Information
Kirsty Bowen Photography
Email: hello@kirstybowen.com
Website: https://schools.kirstybowen.com 

For school and nursery photography services, the school or nursery normally acts as the Data Controller and Kirsty Bowen Photography acts as a Data Processor acting on the school’s instructions.

For direct-to-parent services, Kirsty Bowen Photography acts as Data Controller for gallery delivery, order fulfilment, customer communication, and marketing consent management.

2. Information Collected
The following personal data may be collected and processed:

Parent and Guardian Information

• Names
• Email addresses
• Telephone numbers
• Billing and delivery addresses

Pupil and Student Information

• Photographic images
• Names
• Class or year group information
• Image reference numbers

School and Staff Information

• School or nursery contact details
• Staff names and email addresses where relevant to the booking

Order and Payment Information

• Purchase records
• Transaction information
• Order fulfilment details

Technical Information

• IP addresses
• Device and browser information
• Online gallery access data

Communication Records

• Emails
• Enquiry forms
• Feedback forms
• Customer support communication

Special category data is not intentionally collected unless specifically required and provided lawfully by the school or nursery.

3. How Personal Data Is Used
Personal data is used for:

• Providing photography services
• Producing and delivering galleries
• Processing orders and payments
• Customer support and reorders
• Managing bookings and administration
• Maintaining business and financial records
• Meeting legal and regulatory obligations

Images are only used for marketing or promotional purposes where appropriate consent has been obtained in accordance with the Image Consent Policy.

4. Lawful Basis for Processing
Depending on the service provided, personal data is processed under one or more of the following lawful bases:

• Performance of a contract
• Legitimate interests
• Legal obligations
• Consent, where required for marketing or promotional image use

For school photography services, the school or nursery is responsible for determining and managing the lawful basis for pupil photography.

5. Sharing of Information
Personal data may be shared with trusted service providers where necessary for delivering photography services, including:

• Online gallery providers
• Professional print laboratories
• Payment processors
• Secure cloud storage providers
• Delivery and postal services
• Professional advisers where legally necessary

All providers are required to handle personal data securely and only for authorised purposes.

Personal data may also be disclosed where required by law or regulatory obligation.

6. International Transfers
Some service providers may process data outside the United Kingdom or EEA.

Where this occurs, appropriate safeguards are used to protect personal data in accordance with UK GDPR requirements.

7. Data Storage and Retention
A two-stage storage system is used consisting of active storage and archive storage.

Data is retained only for as long as reasonably necessary for service delivery, legal obligations, customer support, and business record-keeping before being securely deleted or archived.

Retention periods are managed in accordance with internal retention procedures and applicable agreements

8. Data Security
Appropriate technical and organisational measures are used to protect personal data, including:

• Password-protected systems
• Secure cloud storage
• Restricted file access
• Secure gallery systems
• Controlled device access

While reasonable safeguards are used, no online system can be guaranteed completely secure.

9. Your Rights
Under UK GDPR, individuals may have rights including:

• Access to personal data
• Correction of inaccurate data
• Restriction of processing
• Objection to processing
• Erasure where applicable
• Withdrawal of marketing consent

Requests should be made in writing to: hello@kirstybowen.com

Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Where processing is controlled by a school or nursery, requests relating to pupil photography may need to be directed to the school as Data Controller.

10. Safeguarding and Confidentiality
Photography services are carried out in line with safeguarding and child protection best practice.

Children without consent are managed discreetly in accordance with information and procedures provided by the school or nursery.

Further safeguarding information is available in the Safeguarding Policy.

11. Policy Updates
This policy may be updated periodically. The latest version will always be published on the website.

Policy last reviewed: May 2026

Signed: Kirsty Bowen