Summary of how we use your data

• Andrew Stevens Photography uses your personal data to manage and administer your involvement with its activities, and to keep in contact with you for these purposes. This includes information on other services that Andrew Stevens Photography feels will be of interest, such as upcoming events and news items.
• Data is also shared with Mailchimp.com for the distribution of informational email communications. The extent of data shared is limited to email address and first name only. All informational email communications include an unsubscribe opttion.
• Where Andrew Stevens Photography rely on your consent, such as any consent we seek for email marketing, you can withdraw this consent at any time.
• Amongst the data we collect from you may be medical (including injury) information. We will hold this where you (or the relevant parent/guardian) have given consent, so that we can ensure we are aware of any conditions and that you are supported appropriately.

What does this policy cover?

This policy describes how Andrew Stevens Photography (also referred to as “ASP”, “we” or “us”) will make use of the data we handle in relation to our customers:

• your involvement in particular ASP events
• your payment and/or bank account details, where you provide these to pay for ASP events
• your marketing preferences, including any consents you have given us
• your medical conditions or disability, where you provide this to us with your consent (or your parent’s consent) to ensure we are aware of any support we may need to provide to you

Some information will be generated as part of your involvement with us, in particular data about your involvement and attendance at ASP events.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. For example, if you are a child, we may be given information about you by your parents.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• To fulfil a contract, or take steps linked to a contract: this is relevant where you make a payment for any ASP events, any merchandise, or enter a competition. This includes:
  • taking payments;
  • communicating with you;
  • providing and arranging the delivery or other provision of products, prizes or services;
• As required by ASP to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to manage and administer your involvement with ASP events, and to keep in contact with you for these purposes;
  • we will also use data to maintain records of our performances and history;
  • we may choose to send you promotional materials and offers by email where we want to send you offers relating to similar events and services that you have already bought.
  • we use data of some individuals to invite them to take part in market research;
• Where you give us consent:
  • we will send you direct marketing or promotional material by email;
  • we may handle medical or disability information you or your parent provides to us, to ensure we support you appropriately;
  • on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.
• For purposes which are required by law:
  • we maintain records such as health and safety records and accounting records in order to meet specific legal requirements;
  • where you hold a role with ASP requiring us to check your right to work, we may process information to meet our statutory duties;
  • we may respond to requests by government or law enforcement authorities conducting an investigation.

How does Andrew Stevens Photography use any of my information?

ASP may make its own use of the following information:

• your name;
• your gender;
• your date of birth;
• your home address, email address and phone number; and
• your history of your involvement in particular ASP events, or any key role you may have been allocated.

Andrew Stevens Photography uses this information as follows:

• As required by ASP to conduct its business and pursue its legitimate interests, in particular:
  • communicating with you or about you where necessary to administer company evets, including responding to any questions you send to ASP;
  • maintaining records of events and activities provided or attended;
  • maintaining feedback and statistical analysis on the make-up of ASP event participants;
  • ensuring compliance with current Regulations;
  • communicating with you to ask for your opinion on ASP events and activities.
• For purposes which are required by law:
  • ASP may respond to requests by government or law enforcement authorities conducting an investigation.

Withdrawing consent or otherwise objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above.

In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below in the “How do I get in touch with you?” section.

Who will we share this data with, where and when?

We may share your data with:

• Some limited information may be shared with other stakeholders in ASP, so that they can maintain appropriate records and assist us in organising events and activities.
• Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.
• Personal data will also be shared with third party service providers, who will process it on our behalf for the purposes identified above. Such third parties include Mailchimp for email broadcasts.
• Personal information is never knowingly sent outside the EEA. Emails and information distributed may be received outside the EEA, but this will be in relation to the recipient’s location upon receipt (such as being on holiday etc).

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.

To exercise any of these rights, you can get in touch with us using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at data@andrewstevensphotography.co.uk or by writing to Andrew Stevens Photography c/o 1, Canterbury Close, West Moors, Ferndown, Dorset, BH22 0PJ.

How long will you retain my data?

We process the majority of your data for as long as you are an active ASP customer and for 3 years after this.

Where we process personal data for marketing purposes or with your consent, we process the data for 3 years unless you ask us to stop, when we will only process the data for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.

Where we process personal data in connection with performing a contract, event or activity, we keep the data for 6 years from your last interaction with us.

We will retain information held to maintain statutory records in line with appropriate statutory requirements or guidance.

ASP will maintain records of individuals who have registered with the company, records of DBS checks and the resulting outcomes and other necessary matters for such period as is set out in this document.

Records of your involvement in a particular activity may be held indefinitely both by us in order to maintain a record of events.

If you would like to download a copy of this Privacy Policy, please click here.