1. Information I Collect
I may collect:

•  Parent/Guardian Contact Information: Name, email, phone number, billing/delivery address
•  Student Information: Name, class, and images of pupils
•  School Information: Name, address, contact details
•  Orders & Payments: Transaction details for purchasing images
•  Technical Information: IP addresses and device information if using online galleries.
•  Feedback and Communication: Forms, surveys, and emails.

I do not collect sensitive personal data unless explicitly required and agreed with the school.

2. How I Use Information
I use personal data to:

•  Deliver photography services and galleries to families
•  Manage orders and payments
•  Maintaining records and operating the business efficiently.
•  Comply with legal obligations
•  Send marketing communications only with explicit opt-in consent from parents

Consent for Image Use

• Marketing or promotional use of individual or sibling portrait images is only carried out with explicit parental consent.
• Images taken for prospectuses, highlight films, or other school purposes rely on the school confirming parental consent.

For full details on how consent is obtained and managed, see the Image Consent Policy.

3. How I Share Information
Information may be shared with:

•  Service providers necessary for delivering photography services (e.g., print labs, online galleries)
•  Regulatory authorities if required by law

Some of my service providers may process personal data outside the European Economic Area (EEA). I ensure appropriate safeguards are in place to protect your information.

All third parties are required to protect personal information and use it only for the specified purpose.

4. Data Storage and Retention 

• Student + Parent Data: Names, class information, and parent/guardian contact details are kept until galleries and orders are complete, usually 3 months after gallery delivery, then securely deleted.
• Parental Consent Records: Are kept as a legal record for 6-7 years to demonstrate compliance with GDPR and safeguarding requirements.
• Financial and Contractual Records: Are retained for 6 years to comply with HMRC requirements.
• Delivered Images: Are retained for up to 18 months to allow for reorders or dispute resolution.
• RAW Files: Are retained for up to 6 months solely to enable selection and editing of images for delivery or marketing purposes.
• Marketing/Promotional Images: Only images with valid consent are kept for marketing purposes. Once consent is withdrawn, these images, including any associated RAW files are immediately and securely deleted.
• End-of-Retention Deletion: Once the 18-month period for delivered images expires, all remaining JPGs and RAW files are securely deleted unless specific marketing consent has been obtained.

5. Your Rights
Parents, guardians, and schools have the right to:

• Request access to the information I hold about them
•  Request correction of inaccurate or incomplete data
•  Request deletion after the retention period
•  Withdraw marketing consent at any time

To exercise any rights, contact: hello@kirstybowen.com

6. Safeguarding & Confidentiality
Children without photography consent are managed discreetly. Pupil information is kept confidential and only used to provide the photography service.

For full details on safeguarding procedures, please see my Safeguarding Policy.

7. Changes to This Policy
Privacy practices are reviewed regularly. Changes will be published on my website.

Contact
Kirsty Bowen Photography
Email: hello@kirstybowen.com

Policy last reviewed: January 2026
Signed: Kirsty Bowen