Privacy Policy

Dunns Imaging Group Ltd.

Who we are

Dunns Imaging Group Ltd. provides school and nursery photography services and the online systems used to view and purchase those photographs. We are the data controller for the personal information described in this policy.

Registered in England, company number 598527.

Registered address: Chester Road, Cradley Heath, West Midlands, B64 6AA. Email: schools@dunns.co.uk.

The type of personal information we collect

We currently collect and process the following information:

• Pupil ID and name
• Parent or guardian name
• Address
• Phone number, including mobile number
• Email address
• Images (photographs taken at portrait sessions)
• Site usage and device data, including IP address, pages viewed, browser type and cookie-based analytics data

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you, so that you can view images on our system and purchase photographs taken at your child's portrait session at their school or nursery.

We also receive personal information indirectly, from the following sources:

• The photographer running the session
• The school or nursery

We use the information given to us to facilitate the processing and purchasing of school or nursery photographs, to fulfil orders, to provide customer support and to maintain the security and performance of our systems.

We do not make available or sell any information about you to any third party for marketing purposes.

Our lawful bases for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the lawful bases we rely on are:

• Contract: to take and process orders and provide the photography services you have requested.
• Legitimate interests: processing photographs and related data in line with the agreement between the photographer and the school or nursery, and keeping our systems secure and working properly. We balance these interests against your rights and expectations.
• Consent: where consent is the appropriate basis, for example where the school or nursery has obtained consent for a child to be photographed.
• Legal obligation: retaining order and financial records to meet tax and accounting requirements.

Where we rely on consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before withdrawal.

Cookies and analytics

We may use technology to track the patterns of behaviour of registered and non-registered visitors to our site. This can include using a "cookie" which would be stored on your browser. You can usually modify your browser to prevent this happening, although some parts of the site may then not work as intended. The information collected in this way can be used to identify you unless you modify your browser settings. We also aggregate this data to perform statistical analyses of the characteristics and behaviour of our registered users and non-registered visitors.

Every time you connect to our website we store a log of your visit which shows the IP address used by your machine. This tells us what you looked at, whether the page request was successful or not, and which browser you use to view the pages. The use of this data is for statistical and security purposes. It helps us understand which areas of the site are of particular interest, which pages are not being requested, and how many people are visiting the website in total.

Where required, we ask for your consent before setting non-essential cookies, and you can change your cookie preferences at any time through the cookie banner or settings on our site. To opt out of your data being used by Google Analytics, visit tools.google.com.

Who we share your information with

We share personal information only where necessary, and with:

• Payment processors, to take and refund payments
• Print and fulfilment partners, to produce and deliver orders
• IT and cloud hosting providers who support our systems
• Professional advisers, including accountants and insurers
• The photographer, school or nursery where necessary to resolve a query about your order

Anyone acting on our behalf is required to protect your information and to use it only for the purposes we specify.

International transfers

Our systems are hosted in the UK. Where any provider processes data outside the UK, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement or an adequacy decision, and we will tell you if this applies to your data on request.

How we store your personal information

Information supplied by the photographer, via the school or nursery, is securely stored in our private cloud facility. We use technical and organisational measures including encryption, access controls and restricted staff permissions to protect it.

We keep pupil data and images supplied to us for a period of 18 months, after which the images and data supplied are permanently removed. Order information is kept in line with HMRC guidelines, currently six years from the end of the relevant accounting period.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - you have the right to ask us for copies of your personal information.

Your right to rectification - you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - you have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - you have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - you have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

Rights relating to automated decision-making - you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. We may ask you to verify your identity before we act. In some cases we may need to extend that period, and we will tell you if so.

Where a request relates to images or data about a child, we may need to deal with the request through the parent or guardian, or the school or nursery, depending on the arrangements in place.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at the address details above, or by email to schools@dunns.co.uk. We will acknowledge your complaint and respond within one month.

You can also complain to the Information Commissioner's Office if you are unhappy with how we have used your data:

• Information Commissioner's Office
  Wycliffe House
  Water Lane
  Wilmslow
  Cheshire
  SK9 5AF
  Helpline: 0303 123 1113
  Website: ico.org.uk

Changes to this policy

Dunns Imaging Group Ltd. may amend this policy from time to time. If we make any substantial changes in the way we use your personal information, we will notify you by email or by an announcement on the website.