KITTLE PHOTOGRAPHIC is committed to protecting and respecting your privacy.

Introduction

This Privacy Notice, together with our Terms of Use and any other documents referred to in it, sets out how KITTLE PHOTOGRAPHIC LTD uses and protects any Personal Data that you provide us or we collect about you.

Your privacy is of the utmost importance to us. Please read the following privacy notice carefully to understand our views and practices regarding your Personal Data and how we will treat it.

Whenever we process your Personal Data, we are legally obliged to use it in accordance with the laws concerning the protection of Personal Data.

Who we are

KITTLE PHOTOGRAPHIC LIMITED is a company incorporated and registered in England and Wales with company number 04072260. Our registered office address is PO Box 5693, Chelmsford, Essex, CM3 8JE, England. For the purposes of the Data Protection Act 2018, the UK General Data Protection Regulation, and any other applicable data protection and privacy laws and regulations (“Data Protection Legislation”), Kittle Photographic is the ‘data controller’ for all Personal Data that we determine the means and purpose of processing. We are registered with the Information Commissioners Office under registration number Z8800450.

By “Personal Data,” we refer to information collected or held by Kittle Photographic that identifies and relates to you as an individual.

Who this privacy notice applies to

This privacy notice applies to you if:

• You visit our website
• You enquire about our products and/or services
• You purchase our products
• We take a photograph of you
• We contact you to promote our products and/or services

Information we collect, how we use it, how long we keep it, and our lawful bases

1. Customers (purchasers): We collect your name, postal address, invoicing details, email address, telephone numbers, and information regarding the services you request. This information is used to ship orders to your address, process the services you request, ensure our records are accurate, and provide the specific services agreed upon. The lawful basis is a contract, and we retain this data for 7 years following your last purchase.
2. People making enquiries: We collect your name, email address, telephone numbers, and information regarding the services you request. This information is used to provide you with the information you request, notify you about changes to our services, and undertake sales analysis and business management. The lawful basis is legitimate interests, and we retain this data for 2 years from the date of the last meaningful contact.
3. Representatives of the schools where we provide our services: We collect your name, job title, email address, work telephone number, and the name and address of the school you represent. This information is used to make arrangements for photoshoots in the school and to provide you with information about our services. The lawful basis is legitimate interests, and we retain this data for 6 years from the date of the last meaningful contact.
4. People attending our premises: We collect CCTV footage to provide information about our services and ensure the security of our premises. The lawful basis is legitimate interests, and we retain this footage for 30 days.
5. Individuals being photographed: We collect your first name, last name, admission number (an ID number), and class or form. This information is used to identify which photograph relates to which individual. The lawful basis is legitimate interests, and we retain this data on school archives for 5 years. We also collect photos to provide our photography services, retaining them for 5 years from the date of the photoshoot, after which they are archived for a further 5 years.
6. Website visitors: We collect your Internet protocol (IP) address, browser type and version, time zone setting, operating system and platform, and information on your website interaction. This information is used to operate the website efficiently, troubleshoot, test, perform statistical analysis, and keep the website secure. The lawful basis is consent, and retention varies per cookie, as detailed in our Cookie Policy.

What we don’t collect

Card payment details taken via the website are processed and managed via Sage Pay. Further details regarding Sage Pay can be found at www.sagepay.com.

Protecting your Personal Data

We are committed to ensuring that your Personal Data is secure. We have procedures in place to prevent unauthorized access or disclosures and to safeguard and secure the Personal Data that we collect online. All Personal Data collected by us and stored electronically is held on a secure server in the UK only. Where required, this information is encrypted for additional security. We use computer safeguards such as firewalls and data encryption, enforce physical access controls to our buildings and files, and authorize access to Personal Data only for those employees who require it to fulfill their job responsibilities.

However, you should be aware that providing information over the internet can never be completely safe, and if you choose to send such information to us via the internet, you do so at your own risk.

Data protection officer

Kittle Photographic has appointed a data protection officer (DPO) to monitor our obligations under Data Protection Legislation. If you wish to contact the DPO regarding any specific elements of Kittle Photographic’s data handling, please send your enquiries to the attention of the DPO at info@kittlephoto.com.

Transfer of data outside of the UK

We shall not transfer any Personal Data to any country outside of the UK or the European Economic Area unless we ensure that such Personal Data is subject to an adequate level of protection and appropriate legal safeguards, in accordance with Data Protection Legislation. In particular, we will ensure that:

• Your Personal Data is only processed in a country with adequacy status, or
• We use an International Data Transfer Agreement (IDTA) approved by the ICO, together with supplementary measures where necessary.

This will ensure that your Personal Data will be afforded the same level of protection as it has in the UK.

Sharing your information with others

We will not share your Personal Data for any reason unless required by law or permitted to do so under this privacy notice. The main circumstances in which we will be permitted or required to disclose this by law will be by court order, to government bodies, and law enforcement agencies.

However, we may share your Personal Data with third parties in the following ways:

• We may use carefully selected sub-processors to help us collect, store, or manage your Personal Data. This will always be managed under the terms of a written data processing agreement, ensuring that the processors act under our strict instructions and are not permitted to use your Personal Data for their own purposes.
• Analytics and search engine providers may assist us in improving and optimizing our website.
• If Kittle Photographic is acquired by a third party, Personal Data held by it about its customers will be one of the transferred assets. We process your Personal Data for this purpose because we have a legitimate interest in ensuring our business can be continued by the buyer. If you object to our use of your Personal Data in this way, the relevant seller or buyer of our business may not be able to provide services to you.

Your rights

You have rights in relation to any Personal Data that we hold about you, including the right of access. If you wish to access your Personal Data, you may make a formal subject access request by contacting Kittle Photographic using the contact details below.

The information you request must relate to you. If you request Personal Data relating to another person, you must have the authority to act on their behalf. Kittle Photographic will require confirmation of your ID before processing your request. If you are unable to prove your ID, Kittle Photographic reserves the right to refuse your request for access to Personal Data.

Other rights you have in relation to your Personal Data include:

• The right to rectify any inaccuracies in the information we hold
• The right to erasure of information in specific circumstances
• The right to request transfer of your information to another controller
• The right to object to processing in specified circumstances
• The right to restrict the processing of your Personal Data

You also have rights in relation to automated decision-making. However, we do not use automated decision-making.

If you have provided us with consent to process your Personal Data, you have the right to withdraw this consent at any time. We are committed to ensuring that your wishes are respected, and upon notification that you wish to withdraw your consent, Kittle Photographic will immediately cease processing the Personal Data in question.

If you wish to exercise any of your rights, please send your request to Kittle Photographic by emailing info@kittlephoto.com or telephoning us on 01245 401313. We will process your request within one month.

Changes to this privacy notice

We may change this Privacy Notice at any time to ensure it always accurately reflects the way we collect, use, and safeguard your Personal Data.

Please check this notice from time to time to ensure you are aware of any updates we may have made to our Personal Data handling practices. The date of the changes will be listed in the 'Last updated' section below. We will endeavor to notify all of our current clients of any updates to this notice via email and will post the relevant announcement on our website homepage.

We recommend that you print a copy of this page for your reference.

Cookies

Our website uses cookies to help us recognize different users of our website and to provide users of our website with a good experience when using it. Please see our Cookies Policy for further information.

How can you make a complaint?

If you are not satisfied with the processing of your Personal Data as set out in this privacy notice, please contact us at info@kittlephoto.com.

You have the right to issue a complaint directly with the Information Commissioners Office, the data protection supervisory authority for England and Wales (https://ico.org.uk/concerns/).