Privacy Policy

The Organisation is committed to protecting and respecting your privacy and providing fair processing information in accordance with The Data Protection (Bailiwick of Guernsey) Law, 2017. This statement and the documents referred to in it set out the basis on which any personal information that we collect directly from you, or indirectly from other sources, will be controlled and processed by us specifically in the course of providing you with contractual/agreed photography services and/or photography information. Please read the following carefully to understand our practices regarding your personal information/data and how we will treat it.

This privacy statement sets out below:

1. The types of information the Organisation may collect
2. How the Organisation collects your Personal Data/Information
3. How the Organisation uses, controls and processes your Personal Data/Information
4. Grounds/Legal Bases for processing your Personal Data/Information
5. Data Sharing
6. Data Security Procedures
7. Your Rights
8. Data Retention
9. Changes to this Privacy Policy
10. Complaints or Queries

1. The types of information the Organisation may collect

We collect personal information and personal data on clients to whom we provide photography services, in order to provide and in the course of providing photography services. "Personal Data" and "Personal Information" is any information that can be used to identify you or that we can link to you as an individual and may include:

• Personal contact details such as: name, residential and/or business address, telephone numbers and email addresses
• Location of employment or workplace
• Photographs of you
• Information we collect automatically through cookies and similar technologies through our website/online services (please see our Website Policy below for more details).
• Special Category Data
  • The Organisation does not collect, store, control or process any Special Category Data.
• Failure to Collect
  • If we fail to collect required Personal Information from you, we may unfortunately be unable to assist you with photography services.

2. How the Organisation collects your Personal Data/Information

Clients

We may request information from you initially by email and/or via our website. You may provide your name and contact information and you may also provide information regarding the type of photography services you require. In order to assist you with photography services, we may be in touch to request further information.

We may also request information from you at one or more meetings to discuss our photography services, and throughout the photography service period, until you let us know that you no longer require our photography services or until we decide that we can no longer assist you with photography services.

Information we may collect from Third Party Sources

In addition to the above, for all categories we may receive information about you from other sources, including third parties and publicly available information that help us: update, expand and analyse our records; identify new clients, or prevent or detect fraud. We may also receive information about you from social media platforms including, but not limited to, when you interact with us on those platforms or access our social media content. Please note that the information we may receive is governed by the privacy settings, policies and/or procedures of the third party or applicable social media platform, and we encourage you to review them.

3. How the Organisation uses, controls and processes your Personal Data/Information

We will only use your personal data/information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform the contract (written or verbal) that we are about to enter into or have entered into with you for the provision of photography services.
• Where we have received your consent, in order to provide you with photography services.
• Where it is necessary for our legitimate interests, and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

4. Grounds/Legal Bases for Processing your Personal Data

We have set out below, in a table format, a description of all the ways we plan to use your personal data and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Please note that we may process your personal data for more than one lawful ground, depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground/s we are relying upon to process your personal data where more than one ground has been set out in the table below.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will first contact you for consent, or we will notify you and will explain the legal basis which allows us to do so.

According to The Data Protection (Bailiwick of Guernsey) Law, 2017, other conditions/grounds for processing personal information (other than Special Category Data) are:

• Vital Interests – The processing is necessary to protect the vital interests of the data subject or other individual.
• Public Function/Interest – The processing is necessary for the exercise or performance of a public function or task carried out in the public interest or by a public authority.
• Information made Public – The information contained in the personal data has been deliberately made public by the data subject.
• Enactment – The processing is necessary for the exercise of a right or power imposed by enactment.
• Court Order/Judgement – The processing is necessary in order to comply with a court order or judgement.
• Health or Social Care Purpose – The processing is necessary for a health or social care purpose.
• Public Health – The processing is necessary for reasons of public health.
• Legal Proceedings – The processing is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), discharging any court or tribunal functions, obtaining legal advice, or otherwise for the purposes of establishing, exercising or defending legal rights.
• Administration of Justice – The processing is necessary for the administration of justice or the exercise of any function of the Crown, a Law Officer of the Crown, the States or a public committee.
• Law Enforcement – The processing is necessary for a law enforcement purpose.
• Not-For-Profit Organisations – The processing is in the context of not-for-profit organisations that exist for political, philosophical, religious or trade union purposes.
• Historical/Scientific – The processing is necessary for historical or scientific purposes.
• Equal Opportunity – The processing is necessary for the purposes of equal opportunity.
• Regulation – The processing is authorised by regulation or other enactment.

Recipients of Personal Information

Recipients of personal information that the Organisation processes are the Organisation's owner and any staff, who receive personal information from clients.

5. Data Sharing

We will not share your personal data/information with any third parties in the course of providing you with photography services and/or photography information.

If we do need to share your personal data/information with any third party at any point, we will always seek your consent before doing so, and we will only share your data within Guernsey, Jersey, the UK, the European Economic Area (EEA) and the Crown Dependencies. There is an adequacy decision by the European Commission in respect of Guernsey, Jersey and the Isle of Man, so these jurisdictions are considered to provide an adequate level of protection for your personal information.

We do not sell, rent or otherwise share information that reasonably identifies you with unaffiliated entities for their independent use except as expressly described in this Privacy Policy or with your prior consent.

We may also disclose Personal Information that we collect to third-party service providers that perform services on our behalf in the course of our providing photography services or information, or alternatively to law enforcement or government authorities as may be required by law. If we do share your Personal Information in this way you can expect a similar degree of protection.

If the Organisation's business is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchasers and their advisers, and will be passed on to the new owners of the business.

6. Data Security Procedures

The Organisation takes every precaution to protect your Personal Information. Details of these measures are available upon request.

We have put in place appropriate security procedures to prevent your Personal Information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Information to those Company employees who have a business need to know. They will only process your Personal Information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and the regulators of a suspected breach where we are legally required to do so.

7. Your Rights

You have the following 10 rights under The Data Protection (Bailiwick of Guernsey) Law, 2017:

1. Right to information about why personal data is collected from you
2. Right of access
3. Right to object to processing for direct marketing purposes
4. Right to object to processing on grounds of public interest
5. Right to object to processing for historical or scientific purposes
6. Right to rectification
7. Right to erasure
8. Right to restriction of processing
9. Right to not be subject to decisions based on automated processing (The Organisation does not undertake any automated processing.)
10. Right of data portability

Updating Personal Information

It is important that Personal Information we hold about you is accurate and current. If your Personal Information changes (such as your surname or address) or is incorrect, please inform us and we will endeavour to update the Personal Information as quickly as possible.

Data Subject Access Request

This enables you to receive a copy of the Personal Information we hold about you and check that we are lawfully processing it. If this request is made, then the data will be provided to you for free within 1 month of the request.

Data Portability - Transfer of your Personal Information

This enables you to request that the Personal Information be transferred to another party. In this case, we will return your Personal Information to you and you may then transfer that Information wherever you wish.

Erasure of Personal Information

This enables you to ask us to delete or remove Personal Information where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your Personal Information where you have exercised your right to object to processing. In this circumstance the data will be erased within one month of the request.

Restriction of Processing of your Personal Information

This enables you to ask us to suspend the processing of Personal Information. For example, if you want us to establish its accuracy or the reason for processing it.

Right to Withdraw Consent

Where you have provided your consent to the collection, processing and transfer of your Personal Information for a specific purpose, you have the right to withdraw your consent for that specific purpose at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If you wish to exercise any of the foregoing rights, please contact Simon Campbell (Data Protection Officer & Owner of the Organisation) at shoot@sc.photo. No fee is required to access your Personal Information or exercise any of your other rights listed above.

We may request specific information from you to help us to confirm your identity and ensure your right to access the information or exercise any of your other rights listed above.

8. Data Retention

We will retain your Personal Information for 5 years, as follows:

In some circumstances, we may anonymise your Personal Information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

9. Changes to this Privacy Policy

If we decide to change our Privacy Policy, we will post those changes on our website home page, so our users are always aware of what information we collect, how we use it and under which circumstances, if any, we will disclose it. We will use information in accordance with the privacy policy under which the information was collected.

10. Complaints or Queries

The Organisation tries to meet the highest standards when collecting and using personal data/information. We take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our data protection procedures.

If you wish to contact the Organisation in relation to this Privacy Policy or how we handle your personal information, please email: Simon Campbell (Data Protection Officer & Owner) at shoot@sc.photo.

Office of Data Protection Authority, Guernsey (known as "ODPA")

You have the right to make a complaint at any time to the supervisory authority for data protection issues in Guernsey:

Furthermore, you have the right to appeal to the Court against a determination by the Guernsey Data Protection Commissioner / Office of Data Protection Authority in Guernsey.

Website Policy

The Organisation collects information from our users at several different points on our website sc.photo. The Organisation is the sole owner of the information collected on its website. The Organisation will not sell, share or rent this information to third parties without your specific prior permission.

Log Files

The Organisation uses IP addresses to analyse trends, administer the site, track users' movements and to gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.

Links

The Organisation's website may contain links to other external websites. Please be aware that the Organisation is not responsible for the privacy policies or practices of such other sites. We encourage you to be aware of this when you leave our website and to read the privacy policies/statements of each and every website that collects personally identifiable information. This Privacy Policy applies solely to information collected by the Organisation's website.