What is the GDPR?
The GDPR is the General Data Protection Regulation which comes into force on 25th May 2018.Its purpose is to ensure that all business holding personal data have strict policies and practices in place for managing and handling such data.
Colourbox Photography in compliance with GDPR has conducted a full audit of our working practices which will be ongoing and reviewed regularly into the future. This includes collection, handling, documentation, processing, storage and deletion procedures.
What data do we store?
We store the photographic images taken from a session within a school, nursery or college for usually around 2 years. The images themselves are not classed as data. They change to data when you fasten information to them for example a name or a place they may have been taken.We do not store any personal data about pupils that we are photographing. Exceptions and how we deal with data accuracy, storage and deletion is detailed in our full compliance and procedures document which is available via request.
How does the GDPR affect school photography?
Usually when we take school photographs, we don't collect any personal data of the students or staff who we are photographing.The photographic files by themselves, as previously stated are not data until we attach information. When information is attached such as a school name or pupils names on a group photograph. These images with data attached are securely stored with the one perpose of fullfilling the parents orders or photography for the school records. After capture they are securely downloaded, prepared for the purpose they are being taken and stored on a secure backup- this can be for an agreed ammount of time at the schools request.
Any information supplied or collected via ordering from parents is destroyed in the shortest amount of time with no backups being kept except for scanned copies of proof cards which we hold for 6 months for later queries.
With the Summer/Autumn portraiture, the school or college can be left copies of the individual portarits taken for use with there school database system. During this process we can receive the following data: First name, last name, Roll number class or tutour group name. This data is deleted securely imediately after we have supplied the images to the school or college with no records being kept whatsoever.
If for any reason a job does require us to collect personal data, we will work within the GDPR requirements regarding the processing handling and deletion of any data we obtain to fulfil our roll as school photographers.
How does this help parents?
GDPR can be used by parents to understand what the parameters are for how, why and how long information we are collecting is being used and stored.The information we collect is only ever used to fulfil our contract or employed purpose to the school/college/nursery. It is there importantly to offer a practice for us to work to and abide by offering parents and us alike, clear information on how to identify and address, unscrupulous usage, inaccuracies, loss and embarrassment.
If you are a parent and would like to know more about how your child's image is being linked to their school database system, please contact your school and they will explain.
If you would like to know about any information we may be collecting regarding your child or the data we temporarily hold when you place an order, please contact us via our email address or letter.
What happens next?
In the process of maintaining our valued relationships with all of our clients, we wrote to each school, college and nursury that we photograph within, suplying them with a copy of our proposal policy for compliancy to the GDPR legislation that was introduced in May 2018. This is to ensure we can be clear about our commitment and the various changes we are making to comply.We have additionally contacted all of the suppliers that receive in any form, images from us for production from file to finished supplied order. This is to ensure they are trustworthy with our data and are additionally compliant with the new legislation. Many of these suppliers had already conacted us in advance of the DDPR legislation taking effect.