Champion Shotz – Data Protection & Privacy Policy for School/Sports Team Photography Services
Data Controller: Champion Shotz
Contact: Andrew Davies
Email: hello@championshotz.com
Telephone: 07786378967
Address: 2 Shaw Avenue, Welton, Brough, East Yorkshire, HU15 1YA
1. Purpose of this policy
This policy sets out how Champion Shotz (“we”, “us”, “our”) handles and protects personal data collected while providing school/sports club photography services, in compliance with the **UK General Data Protection Regulation (UK GDPR)** and the **Data Protection Act 2018**.
Our aim is to ensure all personal data relating to pupils/players, parents, and school/club staff is processed lawfully, fairly, and transparently.
2. Data controller and data processor roles
In most cases, Champion Shotz acts as a Data Processor on behalf of the school/club, which remains the Data Controller.
The school/club determines the lawful basis for processing and ensures appropriate consent or legitimate interest is in place for photography to take place.
Champion Shotz processes images and associated data strictly under the written instructions of the school/club.
3. Data we collect
We may collect and process the following data:
* Pupil/Player photographs and staff photographs (digital image files)
* Pupil/Player names and class details (to ensure correct identification)
* Parent or guardian contact details (where provided for order fulfilment)
* Unique access codes for online ordering
* Order and payment information (if parents/guardians purchase images)
We do **not** collect unnecessary personal information or use it for any unrelated purposes.
4. Lawful basis for processing
Champion Shotz processes pupil/Player and staff images under the following lawful bases:
Contractual necessity – to fulfil orders for photographic products.
Legitimate interest – providing the school/club with professional photography services as part of their educational activities.
Consent – where required by the school’s/club’s own data protection policy (for example, if parental consent is obtained before taking or using pupil photos).
5. How data is used
Personal data is used solely for:
* Producing, organising, and delivering school/player portraits.
* Providing parents and guardians with secure access to their child’s photographs.
* Fulfilling orders for prints or digital images.
* Managing accounts and payments related to these orders.
* Communicating order updates or resolving customer enquiries.
No personal data is used for marketing without explicit consent.
6. Data storage and security
All digital images and personal data are stored securely on encrypted systems with restricted access.
Security measures include:
* Encrypted file storage and backups.
* Password-protected systems and databases.
* Secure HTTPS access to the online photo portal.
* Role-based access control to ensure only authorised staff handle data.
Printed photographs and any associated paperwork are kept securely and disposed of confidentially when no longer required.
7. Data sharing
To deliver our school photography service safely and efficiently, we share limited personal data with trusted third-party partners who help us process, print, and deliver orders.
We may share data with:
The school/club, for administrative and identification purposes.
Our secure photography software provider, which hosts the password-protected online galleries and ordering portal.
Our professional print and fulfilment partner, which produces and ships physical photo prints and products directly to parents or the school.
All third-party partners act strictly under our written instructions, are UK GDPR compliant, and only process personal data for the specific purpose of providing school photography services on our behalf.
They are not permitted to use or retain data for any other reason.
We do not sell or share personal data with any other organisations for marketing or unrelated purposes.
8. Data retention
Data will be retained only as long as necessary to fulfil the purpose for which it was collected:
* Unpurchased images: retained for up to **12 months** after the photography date, unless otherwise instructed by the school.
* Purchased images: retained securely for up to **24 months** to allow reorders.
* After these periods, data and images will be securely deleted or destroyed.
9. Data subject rights
Under UK GDPR, parents, guardians, staff, and pupils (where applicable) have the right to:
* Access their personal data.
* Request correction of inaccurate data.
* Request deletion (“right to be forgotten”).
* Object to processing.
* Restrict processing.
* Request data portability (where applicable).
Requests can be made via email to hello@championshotz.com, and we will respond within one month as required by law.
10. Data breaches
In the unlikely event of a personal data breach, Champion Shotz will:
* Notify the school (data controller) immediately upon discovery.
* Provide details of the breach, affected data, and actions taken.
* Cooperate fully with the school and the Information Commissioner’s Office (ICO) if required.
11. Data transfers outside the UK
We do not transfer personal data outside the UK.
If any third-party service provider is based outside the UK, we ensure that appropriate safeguards (such as adequacy regulations or standard contractual clauses) are in place.
12. Responsibilities
Champion Shotz ensures all staff and subcontractors handling personal data:
* Receive appropriate data protection training.
* Understand their obligations under this policy.
* Follow the school’s/club’s safeguarding and data handling procedures while on school/club premises.
13. Contact information
For questions or data protection enquiries, please contact:
Champion Shotz
Email: hello@championshotz.com
Tel: 07786378967
Address: 2 Shaw Avenue, Welton, Brough, East Yorkshire, HU15 1YA
If you are unsatisfied with our response, you may contact:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: [https://ico.org.uk](https://ico.org.uk)
14. Policy review
This policy is reviewed annually or sooner if legislation or operational practices change.