Last updated: 28 August 2026

Tom Handbury Photography respects your privacy and handles personal information with care. This policy explains what information is collected, why it is used, who it may be shared with and the choices available to you.

1. Who is responsible for your information?

Tom Handbury Photography, operated by Tom Handbury as a sole trader, is the data controller for information used to manage enquiries, bookings, client relationships, sales and marketing.

Contact: info@tomhandbury.co.uk | 07523 538658 | 10 Bromley Road, Bingley, BD16 4BU

For school photography, the school and Tom Handbury Photography may have different data-protection roles for different activities. These responsibilities are recorded in the agreement with the school. Parents may contact either the school or Tom if they are unsure who is responsible for a particular use of information.

2. Information collected

·       Names, postal addresses, email addresses and telephone numbers.

·       Enquiry, booking, questionnaire and session information, including information you choose to share about children or accessibility needs.

·       Photographs and, where applicable, video or audio created during a commissioned service.

·       Order, invoice, payment-status and delivery information. Full card details are handled by the relevant payment provider and are not retained by Tom Handbury Photography.

·       For school services: pupil names, class or year group, sibling relationships, identification codes, consent or objection information supplied by the school, photographs and order information.

·       Website and device information, such as IP address, browser information and analytics data, where the relevant cookies have been accepted.

·       Correspondence, complaints, feedback and records of permissions or consent.

3. How information is received

Information may be provided directly by you, by someone booking on behalf of a family or wedding party, by a school organising photography, or automatically through the website and its cookies. Where a school provides pupil information, it must have an appropriate lawful basis and must tell families how that information will be used.

4. Purposes and lawful bases

Responding to enquiries: Contact and enquiry information. Legitimate interests in responding to requests and developing the business.

Providing booked services and products: Booking, session, photograph, order and delivery information. Performance of a contract and steps requested before entering a contract.

School photography administration: Pupil and school information. Contract, legitimate interests and/or performance of a task documented with the school, depending on the arrangement.

Accounting, tax and legal records: Transaction and correspondence records. Legal obligation and legitimate interests in establishing or defending legal claims.

Portfolio, website and social media: Identifiable client photographs only with separate, optional permission. Consent may be withdrawn for future use.

Email marketing: Contact details and preferences. Consent, or the limited existing-customer rules where legally available. Every marketing message includes an unsubscribe route.

Website security and essential operation: Technical information. Legitimate interests and strictly necessary technologies.

Optional analytics or advertising: Cookie and device information. Consent where required.

5. Children’s information

Most commissioned photographs include children. Their information is treated with particular care, collected only where necessary and not used for public marketing without appropriate, specific permission. A parent or person with parental responsibility normally manages a family or school order on a child’s behalf. Older children’s wishes will also be respected where appropriate.

School galleries use access controls intended to limit viewing to the relevant families. Gallery links, passwords and access codes should not be shared publicly.

6. Who information may be shared with

Information is not sold. It may be shared only where necessary with categories of carefully selected service providers, including:

·       secure website, contact-form, email and cloud-storage providers;

·       client-management, gallery and online-ordering providers;

·       payment processors and banks;

·       professional print laboratories, album makers, couriers and delivery services;

·       schools, where needed to organise school photography, safeguarding, pupil identification, SIMS-compatible images or order distribution;

·       professional advisers, insurers, regulators or law-enforcement bodies where required.

Current providers can be identified on request. Providers are permitted to use information only for the agreed service and must protect it appropriately.

7. International transfers

Some technology providers may store or access information outside the United Kingdom. Where this happens, appropriate safeguards are used, such as UK adequacy regulations or approved contractual protections. Further information about the relevant safeguard is available on request.

8. How long information is kept

Unsuccessful enquiries: Up to 24 months after the last meaningful contact.

Client contact, contract and order records: Normally up to 6 years after the end of the client relationship where needed for tax, contract or legal purposes.

Family and wedding image files: Normally up to 24 months after gallery delivery. Long-term backup is not guaranteed.

School pupil administration data and galleries: For the period agreed with the school, normally no longer than 12 months after photo day unless needed for an unresolved order or legal obligation.

Financial records: For the period required by tax and accounting law.

Marketing consent records: Until consent is withdrawn, plus a minimal suppression record to ensure no further marketing is sent.

Portfolio photographs: Until permission is withdrawn or the work is no longer used, subject to practical limits for material already printed or published.

Information may be retained for longer where reasonably necessary to resolve a complaint, establish or defend a legal claim, meet an insurer’s requirement or comply with law.

9. Security

Reasonable technical and organisational safeguards are used, including access controls, secure galleries, password protection where appropriate, software updates and restricted access to client and pupil information. No internet service can be guaranteed completely secure, but suspected breaches are assessed and reported where the law requires.

10. Your rights

·       Ask for access to your personal information.

·       Ask for inaccurate information to be corrected.

·       Ask for information to be erased in circumstances where the right applies.

·       Ask for processing to be restricted.

·       Object to processing based on legitimate interests or for direct marketing.

·       Ask for portable information where the right applies.

·       Withdraw consent at any time, without affecting earlier lawful use.

Requests should be sent to info@tomhandbury.co.uk. Identity may need to be verified. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, although you are welcome to contact Tom first so that the concern can be addressed directly.

11. Cookies and links

The website uses essential technologies and, where accepted, optional analytics or similar tools. Please see the separate Cookie Notice. Links to other websites are governed by those organisations’ own privacy information.

12. Changes

This policy may be updated when services, providers or legal requirements change. The current version and date will be published on the website.