Danielle Marie Bennun for Danielle Marie Bennun Photography (“I”, “me” or “my”) is committed to handling personal data responsibly and transparently. This policy explains how I collect, use, store and protect personal data when you visit my website, contact me, book photography services, take part in a photography session, receive images, or give permission for images to be used.
This policy applies to photography services including educational organisations, schools and nurseries; children and family photography; events; individual portraits; commercial and brand work; editorials; and personal shoots.
Photographs of an identifiable person are personal data. This can include a person who is recognisable directly from their face or indirectly through other details in an image, such as their clothing, surroundings or accompanying information.
1. Who is responsible for your personal data?
For most photography services, Danielle Marie Bennun Photography is the data controller for the personal data described in this policy. This means I decide how and why personal data is processed for the purposes of providing my photography services and, where permission has been granted, promoting my work.
For school, nursery and educational-organisation photography, responsibilities may differ:
• The educational organisation is normally the data controller for its own internal, educational and parent/carer communication uses of images.
• I may act as a data processor where I process personal data solely on the educational organisation’s documented instructions for those purposes.
• I act as an independent data controller where I process images for my own clearly stated promotional purposes, but only where appropriate permission has been confirmed.
• I may act as a data processor where I process personal data solely on the educational organisation’s documented instructions for those purposes.
• I act as an independent data controller where I process images for my own clearly stated promotional purposes, but only where appropriate permission has been confirmed.
If you have questions about how an educational organisation uses photographs, please contact the organisation directly as well as contacting me where relevant.
2. The personal data I may collect
Depending on the service provided, I may collect and process:
• names, email addresses, telephone numbers and correspondence addresses;
• booking, enquiry, contract and invoice information;
• communications with clients, parents, guardians, schools, nurseries and other authorised contacts;
• information needed to plan or provide a photography service, such as session details, preferred dates, image requirements and relevant permissions;
• photographs, image files and associated information, including metadata;
• parental or guardian consent records and restrictions concerning children’s photography;
• information supplied by a school, nursery or educational organisation about photography permissions or safeguarding restrictions;
• website-related technical information, where collected through necessary cookies or similar technologies.
I do not intentionally ask for special-category personal data unless it is genuinely necessary for a particular service and there is an appropriate lawful basis to process it.
3. How I receive personal data
I may receive personal data:
• directly from you when you contact me, make an enquiry, enter into a contract, provide information or communicate with me;
• from a parent, guardian or other person authorised to make arrangements for a child;
• from a school, nursery, educational organisation, employer, agency or commissioning client;
• during a photography session or event;
• through signed contracts, consent forms and related documentation;
• through my website, where technical information is collected automatically.
4. Why I use personal data and the lawful bases I rely on
I only process personal data where there is a lawful basis under UK data protection law. The basis will depend on the circumstances.
Purpose
Lawful basis
Responding to enquiries and communicating about a possible booking
Legitimate interests, including responding to requests and managing my business
Planning, carrying out, editing and delivering photography services
Performance of a contract, or taking steps at your request before entering into a contract
Managing bookings, payments, invoices, contracts and business records
Performance of a contract; compliance with legal obligations; and legitimate interests in operating my business
Maintaining records of permissions, restrictions and withdrawals of consent
Legitimate interests in demonstrating compliance and protecting the rights of children, parents, guardians and clients; and, where relevant, consent
Photographing and processing images for a school or educational organisation’s stated purposes
Processing on the organisation’s documented instructions, where I act as a processor
Using identifiable images in my portfolio, website, social-media channels, printed materials, competitions, trade features or advertising
Consent, where required and obtained
Using images in which people cannot reasonably be identified, for example, through suitable cropping or blurring
Legitimate interests in presenting my work, provided that the individual is not reasonably identifiable and the use is appropriate
Protecting my business, preventing misuse, resolving complaints and enforcing legal rights
Legitimate interests and, where applicable, legal obligations
Where consent is the lawful basis, it is voluntary and can be withdrawn at any time. Withdrawal will not affect processing that took place before consent was withdrawn.
5. Children’s images and school photography
I treat children’s personal data and images with particular care.
For identifiable images of children used for my own promotional purposes, I will only proceed where explicit permission has been recorded from a parent or legal guardian through the relevant consent process.
For school, nursery and educational-organisation assignments:
• the organisation is responsible for obtaining and managing the relevant parental or guardian permissions for its own use of images;
• the organisation should provide me with clear information about pupils who must not be photographed, who may be photographed with restrictions, or whose parent or guardian has provided permission;
• I will make reasonable efforts to follow the information supplied to me, particularly in group or event settings;
• where a parent, guardian, school or child raises a reasonable concern or restriction, I will consider and action it where practicable;
• where a child does not wish to be photographed at the time, that wish will be respected wherever reasonably possible;
• before I make identifiable images available for my own promotional use, I will require written confirmation that the applicable parental or guardian consent covers that use;
• I will not publish a child’s full name alongside a public image unless separate, specific permission has been provided;
• I will take reasonable steps to avoid including unnecessary information that could identify or locate a child, including location metadata where relevant.
Where consent is withdrawn after an image has been published, I will take reasonable steps to remove or anonymise the image from channels under my control where practicable. I cannot guarantee the removal of copies already downloaded, printed, shared or republished by third parties.
6. Promotional use of images
With the appropriate permission, I may use photographs in my portfolio and to promote Danielle Marie Bennun Photography. This may include:
• my website;
• social media channels;
• printed portfolios and promotional materials;
• photography competitions, awards submissions or trade features;
• editorial or advertising materials relating to my photography business.
The exact use of images will be governed by the relevant contract, model release, parental consent form or other recorded permission.
If permission has not been granted for an identifiable image, I will not use it for my own promotional purposes. I may retain the option to use an image where an individual cannot reasonably be identified, for example where they are appropriately cropped, obscured or blurred, provided doing so is suitable in the circumstances.
7. Who I share personal data with
I may share personal data only where necessary, lawful and proportionate. Depending on the service, this may include:
• schools, nurseries, educational organisations or commissioning clients;
• parents, guardians or other authorised representatives;
• secure online gallery and image delivery providers;
• professional service providers supporting business administration, communication, document management, design, editing, image processing, storage or backup;
• printers, album suppliers or other fulfilment providers, where you order physical products;
• professional advisers, insurers, regulators or authorities where required by law or necessary to protect legal rights.
I do not sell personal data or identifiable images.
I aim to use suppliers and service providers that provide appropriate security and data protection commitments. Where I appoint a provider to process personal data on my behalf, I will take reasonable steps to ensure appropriate contractual and organisational safeguards are in place.
8. International transfers
Some service providers used in the ordinary running of a photography business may store, process or provide support access to personal data outside the UK or European Economic Area. This can include providers of email, business administration, creative software, online galleries or cloud-based services.
Where a transfer of personal data outside the UK occurs, I will take reasonable steps to ensure it is made lawfully and that appropriate safeguards are in place. These may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another valid transfer mechanism.
I may also access business systems while travelling outside the UK or EEA. Any such access will be subject to appropriate security measures.
9. How I protect personal data
I take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include, where appropriate:
• password-protected accounts and devices;
• restricted access to personal data;
• secure home-network storage and backup arrangements;
• keeping records organised so that permissions and restrictions can be identified;
• using reputable service providers;
• limiting sharing to what is necessary for the relevant purpose;
• keeping consent, contract and client records under appropriate access controls.
No method of electronic transmission or storage is completely secure. However, I take reasonable steps to protect the information I hold.
If I become aware of a personal-data breach affecting data processed on behalf of a school or other client, I will notify the relevant controller without undue delay where required.
10. How long I keep personal data
I keep personal data only for as long as it is reasonably necessary for the purpose for which it was collected, to maintain records of permissions and contractual arrangements, to meet legal obligations, or to establish, exercise or defend legal claims.
My current retention approach is as follows:
Type of information
Retention period
Enquiries where no booking is made
Up to 5 years
RAW files and edited/delivered images from general photography work
For as long as necessary to demonstrate the agreement or consent, comply with legal obligations, and establish, exercise or defend legal claims, subject to periodic review and any valid deletion request
RAW files and edited/delivered images from paid children’s photography work
Up to 24 months, unless a different period is agreed, required for a lawful purpose, or permission for photographer use is withdrawn
Contracts, invoices and consent records
For as long as necessary to demonstrate the agreement or consent, comply with legal obligations, and establish, exercise or defend legal claims, subject to periodic review and any valid deletion request
Children’s consent forms
Until withdrawal by the child’s legal guardian, or for as long as necessary to demonstrate the scope and validity of permission
Images and records processed solely for a school’s or educational organisation’s purposes will be deleted or returned in accordance with that organisation’s documented instructions, subject to legal obligations and any legitimate business need to retain limited records.
11. Your rights
Under UK data protection law, you may have the right to:
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent;
• request the transfer of certain personal data to another organisation;
• complain to the UK data protection regulator.
To make a request, please email daniellemariebennun@gmail.com or post your request to the following address:
Danielle Marie Bennun Photography
Unit 172752
PO Box 7169
Poole BH15 9EL
Unit 172752
PO Box 7169
Poole BH15 9EL
I may need to confirm your identity and authority before responding, especially where a request concerns a child’s personal data or images. I will respond within the applicable legal timeframe.
If you are unhappy with how I handle your personal data, you can contact the Information Commissioner’s Office: Information Commissioner’s Office.
12. Cookies and website technologies
My website is hosted using Adobe Portfolio.
I do not currently knowingly use website analytics, advertising pixels, mailing list sign-ups, online booking tools, or embedded social media feeds that I have set up myself. However, the website platform or other technical providers may use strictly necessary cookies or similar technologies to operate, secure and deliver the website.
I will not knowingly use non-essential analytics, advertising or tracking cookies without first providing clear information and, where required, obtaining your consent through an appropriate cookie banner or preference tool.
You can manage cookies through your browser settings. Please note that blocking strictly necessary cookies may affect how parts of a website function.
13. Third-party websites and social-media platforms
My website or communications may contain links to third-party websites or social-media platforms. Those services operate under their own privacy policies, and I am not responsible for their privacy practices.
Where an image is published on a public platform with valid permission, it may be viewed, copied, shared or otherwise used by others. Although I can remove content under my control following a valid withdrawal of consent, I may not be able to remove third-party copies.
14. Changes to this policy
I may update this policy from time to time to reflect changes to my services, business practices or legal obligations. The most recent version will be published on my website with the date it was last updated.