GDPR Compliance
Last updated: January 2024
1. Introduction
snug-petal is committed to ensuring the security and protection of the personal information that we process, and to providing a compliant and consistent approach to data protection. We have implemented this policy to ensure compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
snug-petal is the data controller for the personal information we collect. This means we determine the purposes and means of processing personal data.
Contact details:
snug-petal
47 Kensington High Street
London, W8 5NP
United Kingdom
Email: [email protected]
3. Lawful Basis for Processing
We process personal data on the following legal bases:
- Consent: Where you have given clear consent for us to process your personal data for a specific purpose
- Contract: Where processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
- Legal obligation: Where processing is necessary for us to comply with the law
- Legitimate interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests
4. Your Rights Under GDPR
Under the UK GDPR, you have the following rights:
Right to be Informed
You have the right to be informed about the collection and use of your personal data. This includes information about our purposes for processing, retention periods, and who it will be shared with.
Right of Access
You have the right to request access to your personal data and supplementary information. This is commonly known as a subject access request.
Right to Rectification
You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
Right to Erasure
You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
Right to Restrict Processing
You have the right to request the restriction or suppression of your personal data in certain circumstances.
Right to Data Portability
You have the right to obtain and reuse your personal data for your own purposes across different services.
Right to Object
You have the right to object to processing based on legitimate interests, direct marketing, and processing for research purposes.
Rights Related to Automated Decision Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.
5. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.
For photography services, client records and associated imagery are typically retained for a period of seven years following the completion of services, unless otherwise requested.
6. Data Security
We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data where appropriate
- Regular testing and evaluation of security measures
- Staff training on data protection and confidentiality
- Secure storage of physical documents
7. Data Breaches
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
8. International Transfers
We do not routinely transfer personal data outside the United Kingdom. If such transfers become necessary, we will ensure appropriate safeguards are in place to protect your data.
9. Exercising Your Rights
To exercise any of your rights, please contact us using the details provided above. We will respond to your request within one month of receipt.
If you are not satisfied with our response or believe we are processing your personal data in a way that is not compliant with the law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
10. Changes to This Notice
We may update this GDPR notice from time to time. Any changes will be posted on this page with an updated revision date.