Last updated: 31st August 2026

This notice explains how we use personal information when providing school photography, including individual portraits, sibling and group photographs, online galleries and photograph orders.

It is intended for parents, carers, pupils and school staff. If anything is unclear, please contact us and we will explain it.

1. Who we are

Tom Handbury trades as Tom Handbury Photography.

Address: 10 Bromley Road, Bingley, BD16 4BU
Email: info@tomhandbury.co.uk
Website: www.tomhandbury.co.uk

We are responsible for personal information where we decide how and why it is used for our photography business, including managing customer enquiries, parent orders and our business records. In these circumstances, we act as a data controller.

The school is responsible for its own use of pupil information, including decisions about sharing information with us and using photographs in its records.

Where we carry out a specific activity solely on the school’s documented instructions, we act as its data processor for that activity. This may include preparing pupil photographs for the school’s management information system. The school’s privacy notice also applies to its use of that information.

The applicable responsibilities are established before photography takes place. Please contact us or the school if you would like clarification about your child’s photography arrangements.

2. Information we collect

Depending on the photography and ordering arrangements, we may use:

• pupil names, school names and class, year or form groups;

• individual, sibling, class and other group photographs;

• pupil identifiers needed to match photographs to school records;

• parent or carer names and contact details;

• gallery access codes, QR codes and account information;

• order details, payment status and transaction references;

• billing and delivery addresses;

• messages, enquiries and records of permissions or objections;

• technical information about online-shop use, such as device information, IP addresses and interactions with the shop.

We request only the information needed for the relevant activity. Providing optional contact details or marketing permission is not a condition of purchasing photographs.

Some information is needed to fulfil an order. For example, we need a delivery address for home delivery and sufficient information to identify the photographs being purchased.

Medical, accessibility and safeguarding information

Please tell us about practical adjustments or photography restrictions rather than sending detailed medical or safeguarding records.

Where optional health information is genuinely needed to arrange an adjustment, we will explain what is needed and seek explicit consent from the appropriate person before collecting it.

We ask schools to retain detailed safeguarding information and communicate only the instructions necessary for us to work safely. If exceptional circumstances require us to process sensitive information on another legal basis, we will identify the applicable legal conditions and explain them where it is appropriate and lawful to do so.

3. Where information comes from

We obtain information from:

• the school, nursery or organisation arranging photography;

• parents, carers and, where appropriate, pupils;

• photographs we take;

• information entered into our online gallery and shop;

• payment, production and delivery providers handling an order.

Schools may provide pupil lists so that we can identify children accurately and assign photographs to the correct galleries.

We arrange with the school for families to receive information about the photography and relevant privacy arrangements before photo day.

4. Why we use information and our lawful bases

Organising photography and providing galleries

Where we act as a controller, we rely on legitimate interests for the pupil information and photographs necessary to organise the agreed school photography service, match images accurately and make photographs available to the appropriate families.

Our interests are in providing the photography service safely and efficiently and enabling families to view and purchase photographs. We must balance these interests against the rights, expectations and welfare of the children and adults concerned.

Where a particular optional session operates on consent instead, this will be explained when participation is arranged. We do not treat the school’s commercial booking agreement as consent on behalf of every pupil.

Parent orders

We rely on performance of a contract to use the purchasing adult’s information where necessary to process their order, receive payment, deliver products and resolve order-related problems.

This does not automatically provide a contractual lawful basis for a child’s information. We use the applicable basis described above for the child’s photograph and identification details.

Enquiries, security and disputes

We rely on legitimate interests to answer enquiries, protect galleries, prevent misuse and establish, exercise or defend legal claims.

Accounting and legal requirements

We rely on legal obligation for information we must retain or disclose under applicable law, including required financial records.

Optional marketing and promotional photographs

We rely on consent for optional marketing subscriptions and promotional use of identifiable photographs, as explained in section 9.

Work carried out for the school

Where we act solely as the school’s processor, the school determines the purpose and lawful basis. We handle the information on its documented instructions.

5. Individual galleries and access details

Individual photographs are assigned to access-controlled galleries using codes, QR codes or account permissions. Sibling photographs may be made available through the relevant family access arrangements.

Anyone given access details may be able to view the associated photographs. Please keep codes private and share them only with people you intend to have access.

If you see another child’s individual photographs unexpectedly, or think access details have been disclosed incorrectly, please contact us promptly.

We will investigate privacy or safeguarding concerns and restrict access where appropriate.

6. Class, sibling and friendship-group photographs

Group photographs contain more than one person. They may be available to other families entitled to view and purchase photographs of that class or group.

A purchased group photograph will therefore include other children. Access controls cannot prevent someone from subsequently copying or sharing a photograph.

Please respect other families’ privacy and do not publish photographs containing other children without appropriate permission.

The school and families should raise any restrictions or concerns before group photography takes place. Any proposed inclusion of pupil names on a finished group photograph will be explained in advance.

7. Information shared with schools

Where agreed and appropriate, we may provide the school with:

• pupil photographs and identifiers needed for its school records;

• information needed to check pupil identification or gallery allocation;

• limited information necessary to resolve an order or privacy issue;

• information needed to distribute school-delivery orders;

• sales summaries used to calculate agreed commission.

Commission reports should use totals or other non-identifying information wherever individual customer details are unnecessary.

For school deliveries, labels or distribution lists may include pupil name, class, order reference and information needed to identify the package.

The school’s own privacy notice explains its subsequent use and retention of photographs supplied for school records.

8. Service providers and other recipients

We share information only where needed for the relevant service or another purpose explained in this notice.

Online galleries and ordering

We use GotPhoto, operated by Fotografen Online Service GmbH in Germany, to provide our gallery and ordering platform.

GotPhoto processes information on our behalf for these services. Where we act as the school’s processor, GotPhoto may act as a subprocessor.

Photograph production and delivery

We use SIMLAB and, where applicable, other professional production providers to manufacture orders. They receive the photographs, product specifications and identification or delivery information necessary to fulfil the order.

Postal and delivery providers receive the information needed to deliver packages.

Payments and business support

Other recipients may include payment providers, website and email providers, secure storage and IT providers, professional advisers and authorities where disclosure is legally required.

Payment providers may have their own responsibilities and privacy notices for payment processing, fraud prevention and regulatory checks.

We do not sell personal information.

GotPhoto’s anonymised statistics

GotPhoto’s published agreement also permits it to anonymise information for statistical analysis and service development. It acts as an independent controller for that anonymisation activity. The resulting information must no longer identify individuals.

Further details are available in GotPhoto’s UK data-processing agreement.

9. Communications, marketing and promotional use

We use contact details to send necessary communications about an order, delivery or enquiry.

Optional sales reminders, offers and marketing messages are separate from necessary order communications. Where we use consent for these messages, you can withdraw it through the unsubscribe facility or by contacting us.

Buying school photographs does not automatically subscribe you to marketing about family sessions, weddings or other services.

We do not use identifiable pupil photographs on our public website, social media or advertising without separate, appropriate consent. Refusing permission does not affect access to the school photography service.

Consent can be withdrawn at any time. This does not affect processing that was lawful before withdrawal. We will stop new promotional use and remove material from channels we control where applicable. We cannot recall printed material already distributed or guarantee removal of copies independently shared by others.

10. How long we keep information

We keep information only for as long as it is needed for its stated purpose.

Gallery ordering periods

The normal ordering period is stated in the gallery or school communications. Closing a gallery to new orders is separate from deleting its contents.

Photographs and pupil-identification information

We normally retain selected school photographs and the information needed to identify them for no longer than 24 months after photo day, where needed for reorders, replacements and resolving queries.

We delete unnecessary duplicate files and working lists sooner. Where we hold information solely on the school’s instructions, the agreed retention and deletion arrangements apply.

Keeping financial records does not, by itself, justify retaining all pupil photographs.

Purchased digital downloads

Separate copies used to fulfil digital purchases may remain available temporarily after the main job is deleted. GotPhoto currently states that purchased downloads can remain available for approximately 92 days following job deletion.

This is separate from our general image-retention period. Please download and back up purchased files promptly; permanent storage is not included.

Orders and financial records

We normally retain relevant order, transaction and accounting records for up to six years, or for the period required by applicable tax and accounting law.

Enquiries

Routine school-photography enquiries are normally retained for up to 12 months after resolution. Messages forming part of an order, complaint or legal matter may follow the relevant longer retention period.

Permissions and marketing preferences

We retain evidence of consent while relying on it and, where necessary, for a limited period afterwards to demonstrate how information was used.

If you unsubscribe, we may keep a minimal record to ensure you are not added back to the marketing list.

Disputes and exceptional cases

Relevant information may be retained longer where necessary for an unresolved complaint, legal claim or specific safeguarding matter. We limit this to the information needed and review whether continued retention remains necessary.

Deletion and backups

Deletion from active systems may be followed by a limited recovery or backup-retention period. GotPhoto’s agreement provides for protected backup copies to expire through its standard backup cycles.

We do not use retained backup information for new marketing or routine gallery sales.

11. International processing

GotPhoto is based in Germany and identifies Frankfurt as the main hosting location for its UK platform.

Transfers from the UK to Germany and other European Economic Area countries can take place under the UK’s adequacy arrangements.

Some platform support, monitoring and analytics services may involve processing in other countries, including the United States. GotPhoto’s published supplier information describes the relevant providers, locations and transfer arrangements.

Depending on the recipient and transfer, protection may be provided through an applicable adequacy arrangement, including the UK Extension to the EU–US Data Privacy Framework for eligible recipients, or appropriate contractual safeguards.

You can contact us for further information about the safeguards relevant to your information and how to obtain a copy where applicable.

[Before publication: add the verified countries and safeguards for any additional email, storage, payment or optional editing providers used outside the arrangements described above.]

12. Cookies and online-shop usage

Our website and online shop use cookies or similar technologies for functions such as security, gallery access, shopping baskets and remembering preferences.

Optional analytics may collect information about page use, navigation and other shop interactions. GotPhoto’s supplier documentation includes analytics and privacy-masked session-recording tools. Their use depends on the platform configuration and applicable consent settings.

Where consent is required, optional technologies must not operate before consent is given. Cookie notices explain the relevant technologies and how to change preferences.

Our main Squarespace website and GotPhoto shop are separate services. Cookie choices made on one may not automatically apply to the other.

13. Keeping information secure

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss and misuse.

Access is limited to people who need information for their work. We use controlled gallery access and take care when transferring pupil lists, photographs and order information.

Please do not send gallery passwords, payment-card details or unnecessary medical or safeguarding information through ordinary enquiry forms.

Contact us promptly if you suspect that a photograph or personal information has been disclosed incorrectly.

14. Your rights

Depending on the circumstances, you may have the right to:

• access your personal information;

• correct inaccurate or incomplete information;

• request deletion;

• restrict how information is used;

• object to processing based on legitimate interests;

• object to direct marketing;

• receive certain information in a portable format;

• withdraw consent where consent is the lawful basis.

These rights belong to the person whose information is being used. A parent or carer may act for a child where appropriate, taking account of the child’s understanding and the requester’s authority.

Please contact info@tomhandbury.co.uk to make a request. We may need proportionate information to confirm identity or authority before disclosing personal information.

We normally respond within one month. If the law allows additional time or a right does not apply, we will explain why.

Where the school is responsible for the relevant processing, we will help direct your request to the appropriate contact.

15. Complaints and updates

Please contact us if you are unhappy with how we have handled personal information. We will consider your concern and try to resolve it.

You can also complain directly to the Information Commissioner’s Office. You do not have to contact us first.

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

We review this notice when our services or data-processing arrangements change. The latest version will be available on our website and through the school photography gallery. Where appropriate, we will actively inform affected people about significant changes.

.