Data &
Privacy

Depending on how you use the platform, we process:

1. A) Photographer account data

• Name and contact details (email address, telephone number) 
• Information about the photographer profile and online shop 
• Billing and payment information 
• Information about use of the platform account 

1. B) Customer and order data (processed on your behalf)

• Photographs of individuals 
• First and last names 
• Class, group or school information 
• Contact details 
• Order and delivery details 
• Payment-related information 
• Usage data relating to the online shop 

This data is either provided by you or entered by your customers when using the platform.

1. C) Technical usage data

When you use our website or admin area, technically necessary usage data may be processed, including:

• IP address (in shortened or anonymised form, where possible) 
• Browser and device information 
• Operating system 
• Session and usage data 
• Information about the use of individual features or pages

We process personal data in order to:

• provide and secure the GotPhoto platform 
• provide password-protected online galleries
• process orders and payments 
• enable the automatic matching of photographs 
• provide technical information and service-related communications 
• handle support requests and resolve technical issues
• improve the stability, security and performance of the platform 
• provide information about features, product changes and training opportunities. 

Processing takes place exclusively in connection with the provision and development of our services.

If you collect personal data directly from parents or other customers, you will generally be the controller under the UK GDPR. GotPhoto processes this data as a processor on your behalf.

If you receive personal data from a school or nursery under its arrangements with parents, the relevant institution acts as the controller. You act as a processor and GotPhoto acts as a sub-processor.

GotPhoto processes personal data solely for the purpose of providing the agreed services and on the basis of its contractual agreements with you.

Yes. Where GotPhoto processes personal data as a processor, it does so solely for the purpose of providing the agreed services and in accordance with the contractual agreements entered into with you.

In addition, we may use anonymised or aggregated information to analyse the security, stability and performance of the platform and to further develop our services. This information cannot be used to identify individual people.

If parents, students or other data subjects contact us directly with questions or requests relating to their personal data, we will generally refer them to the relevant photography business or other controller.

This includes, for example, requests for access, rectification, erasure or restriction of the processing of personal data.

Where GotPhoto processes personal data as a processor, we generally act only in coordination with the relevant controller, unless we are legally required to deal with the request directly.

No.

GotPhoto does not claim ownership of the photos you upload to the platform and we do not acquire any ownership rights in them.

As the photographer, you retain the rights you hold in the photos you upload. To operate the platform, you grant GotPhoto a worldwide, non-exclusive, royalty-free licence to use your photos only as necessary to provide our services. This includes:

• securely storing your photos 
• creating thumbnails and previews 
• reproducing images for prints and photo products; 
• adjusting or formatting files for production 
• displaying images in online galleries (including password-protected galleries) 
• processing and fulfilling customer orders. 

This licence is limited to operating and delivering the GotPhoto services. We do not use your photos for unrelated purposes or sell or commercialise your photos outside of providing those services.

Data is stored on secure cloud infrastructure within the European Union, in particular at ISO 27001-certified data centre locations in Frankfurt, Germany.

GotPhoto uses established infrastructure providers and technical service providers to operate the platform, including AWS and Snowflake. We use technical and organisational measures to protect personal data, including encryption, access controls and measures to separate customer data.

Personal data is predominantly processed within Germany and the European Union.

As GotPhoto serves UK customers from Germany, personal data may be transferred from the UK to Germany and other countries within the European Economic Area (EEA). The UK has adequacy regulations in place covering the EEA, which allow personal data to be transferred to those countries without additional transfer safeguards.

In some cases, service providers used by GotPhoto may process personal data in countries outside the UK and EEA, including the United States. Where this involves a restricted transfer under UK data protection law, GotPhoto ensures that an appropriate transfer mechanism or other lawful basis for the transfer is in place.

To operate and further develop the platform, GotPhoto works with selected technical service providers. These include providers of cloud infrastructure, payment processing, support and communication services, as well as security and analytics services.

All service providers are carefully selected and contractually bound. Where they process personal data, GotPhoto ensures that appropriate data protection and technical safeguards are in place.

GotPhoto uses technical and organisational measures to protect personal data and image files against unauthorised access, loss or misuse.

These include encryption, role-based access controls, technical measures to separate customer data and ongoing security and system monitoring.

Further information about our technical and organisational measures can be found here: https://www.gotphoto.co.uk/toms-and-sub-processors/

As a photographer, you are responsible for ensuring that personal data is collected and used lawfully in connection with your photography services. In particular, this includes:

• providing individuals with appropriate privacy information 
• obtaining consent where consent is required 
• only sharing personal data with GotPhoto where you have a lawful basis for doing so 
• ensuring that your use of the GotPhoto platform complies with applicable data protection requirements. 

GotPhoto supports you through technical and organisational safeguards and contractual arrangements for data processing.

GotPhoto has internal processes for detecting, assessing and responding to security and data protection incidents.

Where an incident involves personal data and notification is legally required, GotPhoto informs affected photographers in accordance with applicable legal requirements.

Personal data is generally retained only for as long as necessary for use of the GotPhoto platform and to comply with applicable legal, contractual or tax retention requirements.

If a photographer removes galleries or account content, instructs us to delete personal data or the contractual relationship ends, personal data is deleted in accordance with our applicable deletion and retention processes, unless legal retention requirements require us to retain it.

Under applicable UK data protection law, you have rights including:

• the right to access your personal data 
• the right to have inaccurate personal data corrected 
• the right to erasure 
• the right to restrict processing 
• the right to data portability 
• the right to object to certain types of processing. 

To exercise your data protection rights, contact privacy@gotphoto.com.

No. GotPhoto does not use automated decision-making processes that produce legal or similarly significant effects on individuals.