This Notice explains how Ivan Burn Photography and Shutterbugz Photography complies with the DPA, GDPR and PECR.
1. Identity and contact information
This Privacy Notice (“Notice”) is provided by Ivan Burn trading as Ivan Burn Photography and Shutterbugz Photography (“me”, or “I”), of 8 Hedley Rd Wylam Northumberland NE41 8EG. It covers your rights in relation to the Data Protection Act 1998 (“DPA”), the General Data Protection Regulation (“GDPR”) and the Privacy and Electronic Communications Regulations (“PECR”).
Ivan Burn Photography is both the controller and processor of all personal data collected.
Date this Notice was created: 10th May 2018
Date this Notice was last modified: 10th May 2018
2. Compliance declaration
Both Ivan Burn Photography and the websites Ivanburnphotography.co.uk & Shutterbugz.co.uk, comply with the DPA, GDPR and PECR. The GDPR comes into effect on the 25th May 2018. This Notice is updated whenever changes are made to relevant data protection legislation.
3. Your rights under the GDPR
Under the GDPR, you have a number of different rights relating to your personal data and how it is processed. They are as follows:
- Right to be informed about the collection and use of your personal data.
- Right to access your personal data, and any supplementary information which constitutes personal data.
- Right to have your personal data rectified; this means you can ask me to correct your personal data if it changes, turns out to be inaccurate, or is incomplete.
- Right to have your personal data deleted; this means that you have the right to request the deletion or removal of your personal data. There are some circumstances where you do not have this right.
- Right to restrict me from processing your personal data.
- Right to data portability.
- Right to object to the processing of your personal data.
- Rights related to automated decision making including profiling.
Most of these Rights will apply to your personal data and how it is processed by Ivan Burn Photography, but some (such as the right to data portability and rights related to automated decision making including profiling) are not relevant to this business at the time of writing.
If you want to know more about your rights, please click here. For other information relating to data protection legislation, please visit the ICO Website directly.
4. The data I collect, how I use it and why
Client contact information
I use personal data, provided directly and voluntarily to me by clients, for two purposes. The first is to carry out my contractual obligations. This means that it’s information that I need to do my job. This personal data includes (but is not limited to) names, addresses, email addresses, phone numbers and wedding information including (but not limited to) venue, date, time and number of guests.
Mailing lists
At the time of writing, I do not currently engage in email marketing, but in the future, I may make use of mailing lists to help market my business. Any new mailing lists created from this point, will be populated with personal data collected from you on the basis of explicit consent for this single purpose.
5. Security, storage and data retention
Ivan Burn Photography stores your personal data in the EEA and retains full details of your personal data for as long as it takes to complete your photography requirements. I will delete your personal data six years after completion of your photography requirements (I am obliged to keep a 6 year record of works carried out for my HMRC tax records), but you retain the right for your personal data to be deleted before this point which can be exercised by submitting a formal request for deletion via email.
6. Clients And Guests Captured In Photos
Under GDPR legislation, a photograph may in some instances constitute a form of personal data where they can be processed to allow “the unique identification or authentication of a natural person”. Ivan Burn Photography will never photograph an individual as a means of unique identification or authentication unless consensually contracted to do so. Guests at weddings appear in photos taken by Ivan Burn Photography as a part of the visual recording of the event in photos. Guests captured in portraits or in group photos do so as part of the event and their rights are protected by Ivan Burn Photography as detailed in this privacy policy.
In terms of explicit GDPR compliance, Wedding clients and guests are photographed within the parameters of GDPR legislation on the basis of ‘legitimate interests’. The taking of photographs of wedding guests when viewed as a form of processing personal data is necessary for the legitimate interests of Ivan Burn Photography as a photography business unless there is a good reason to protect a given individual’s personal data which overrides those legitimate interests.
Operating within the parameters of legitimate interests as laid out in GDPR legislation, the disproportionate effort involved in providing privacy policy information to all wedding guests at the event and the degree to which it would distract me from performing my job renders it infeasible to do. Wedding clients are therefore requested in their contract to direct their guests to read this privacy policy in advance of the event and to advise them to contact me in advance with any concerns around the processing of their personal data, namely being photographed.
7. Storage of images.
All images taken by Ivan Burn Photography and Shutterbugz Photography will be stored securely on encrypted hard drives within my password protected home office computer. Where cloud technology is used for storage backup, the provider will be vetted to ensure they comply with the relevant regulations on data privacy and data security. Below, shows an up to date list of any cloud technology that I am currently using to store images.
- Code42 CrashPlan service. – Used for final jpg image backup.
8. Social Media Policy And Usage
I adopt a safe and responsible Social Media Policy. While I may have official profiles on social media platforms users are advised to verify the authenticity of such profiles before engaging with, or sharing information with such profiles. I will never ask for personal details on social media platforms. Users are advised to conduct themselves appropriately when engaging with me on social media.
9. Your consent
By using this site and/or engaging me on my Terms and Conditions, you agree to be bound by this Notice.
10. Your right to withdraw consent
You have the right to withdraw your consent to be bound by this Notice at any time. If you wish to do so, please use the contact form at the bottom of this page. You also have the right, as set out above, to withdraw your consent to me processing your personal data.
11. Your right to lodge a complaint
As well as the right to withdraw consent and exercise any of the above rights mentioned under ‘Your rights under the GDPR’, you also have the right to raise a complaint with a regulatory body. In the United Kingdom, this is the Information Commissioner’s Office (ICO). If you have concerns about the way your data is being processed by an organisation, you can find out more here.