Privacy Policy

PHOTOKOVA LTD, a company registered in England and Wales under number 17457226, with its registered office at 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE, decides why and how the information described on this page is handled. In data protection law that makes the company the controller of it.

Anything on this page - a question, a request, a complaint - goes to work@photokova.com . There is no separate data protection officer; the company is not of a kind that is required to appoint one.

Four things, and nothing beyond them.

• What you write to us. Your name, the address you asked us to reply to, the organisation if you gave one, and the contents of the message or the brief - which rooms, what the photographs are for, what has to stay visible.
• The photographs themselves. The image files you send, everything visible in them, and the information the camera writes into them: the date and time, the phone model, the exposure settings and, if your phone records it, the place the photograph was taken.
• The record of the work. Quotations, order confirmations, delivery notes and the correspondence around them, together with what was paid and when, which the company is required to keep as part of its accounting records.
• The hosting log. The provider that serves these pages records the ordinary details of a web request - the network address it came from, the time, the page asked for, the browser - to keep the site running and to deal with abuse of it. That happens for every visitor, including one who never writes to us.

Photographs of a working room can contain more than the room: a face at a desk, a name on a door, a document left out, a delivery label. If you would rather something was not in a file that leaves your premises, take that frame again before you send it, and tell us if it is already in one we have.

From you, and only from you. Nothing on this page is bought from a list, taken from a data broker, scraped from a directory or passed to us by anybody else, and there is no tracking on this site that could add to it behind your back.

To look at the photographs and tell you what can be done with them; to write a quotation; to do the work and deliver the files; to answer you and keep the thread of a job in one place; and to keep the accounting records a company has to keep. Nothing is used to advertise anything to you, and nothing is sold.

Each of the uses above rests on one of three grounds in Article 6(1) of the UK GDPR.

• Article 6(1)(b), the contract and the steps before it. Assessing the photographs, quoting, doing the work and delivering it are either the contract itself or the steps you asked for before entering into one.
• Article 6(1)(f), legitimate interests. Keeping correspondence so that a question asked later can be answered, and keeping the hosting log so the site can be kept running and defended against abuse. The interest is being able to run the service and account for what was agreed; it is balanced against your interests by keeping only what the work needs and deleting it on the timetable in clause 10.
• Article 6(1)(c), a legal obligation. Accounting records, which a company has to preserve whatever anyone would prefer.

If a photograph you send shows an identifiable person, it is handled only to do the work you asked for and deleted on the same timetable as the rest of the set. Tell us if anyone in a frame has asked not to be photographed, and that frame is dropped from the job.

These rights are yours by law and cost nothing to use. Write to work@photokova.com and say which one you want; we answer within one month, and say so if a request is one we cannot act on and why.

• See what is held about you, and get a copy of it.
• Have anything wrong put right.
• Have it erased, including the photographs, where there is no longer a reason to keep it.
• Have its use restricted while a disagreement about it is sorted out.
• Object to a use that rests on legitimate interests, in which case that use stops unless there is a reason for it that overrides the objection.
• Have what you gave us handed to you, or to somebody you name, in a form a machine can read.
• Withdraw consent, where consent is what a particular use rests on. Withdrawing it does not unmake anything done before you did.

Tell us first, at work@photokova.com : most things are quicker to fix than to report. You do not have to come to us first, though, and you can complain to the Information Commissioner's Office at any point.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. The office publishes how to complain, and what it will do about it, at ico.org.uk.

Nobody who does not have to. There is no advertising network on this site, no analytics service, no social media plugin and no mailing list, so the list is short and each entry has a job on it.

• The company that hosts this website and serves its pages, which holds the log described in clause 02.
• The provider of the company's email, through which every message and every file you send necessarily passes.
• The payment provider, Stripe, which takes your card details directly and handles the payment. We never see a card number, and none is ever entered on this site.
• The company's accountant and, where the law requires it, HM Revenue & Customs, in respect of the accounting records.
• Anybody a court or a regulator obliges us to tell, which is the only circumstance in which your photographs would go anywhere else.

Your photographs and the finished files are not published, not shown to other customers, not used as examples of the work and not used to train anything.

Some of the providers in clause 08 run their services outside the United Kingdom, so information can rest on equipment abroad. Where it does, the transfer is made under adequacy regulations made by the Secretary of State for the country concerned, or under the International Data Transfer Agreement or the United Kingdom Addendum to the European Commission's standard contractual clauses. Ask and we will tell you which applies to which provider.

Keeping a file for ever is not caution, it is a liability, so everything here has an end date.

• An enquiry that comes to nothing. The message and any photographs sent with it are deleted once it is clear there will be no order, and no copy is kept in case you come back.
• The photographs for a job that goes ahead. Your originals and our working copies are kept while the work runs and for the period the order confirmation states, so that you can ask for the files again or ask for a revision. At the end of it they are deleted, and it is worth keeping your own copy of the finished set.
• Quotations, confirmations and payment records. Six years from the end of the accounting period they fall in. That length comes from the tax rules - paragraph 21 of Schedule 18 to the Finance Act 1998 - rather than from company law, which asks a private company for three. Six covers both, so six is what we keep.
• The hosting log. For the short period the hosting provider keeps it, which is a matter of their retention settings rather than ours.

There is no legal obligation on you to give us anything. Without a name, an address to reply to and the photographs, though, there is nothing to look at, nothing to quote for and no way to send anything back, so an order cannot be taken. Everything else on the form is optional and only makes the quotation more accurate.

There is no automated decision-making and no profiling here. Enquiries are not scored, sorted or rejected automatically; a person reads every one, and a person decides what a set of photographs can be brought to.

This site sets no cookies. It stores nothing in your browser, carries no analytics, no advertising tags and no social media buttons, and loads no fonts, scripts or images from anybody else's servers - the typefaces are served from this site along with everything else. The pages are static files.

That is why there is no banner asking you to accept anything: there is nothing to accept and nothing to switch off. The hosting log in clause 02 is made by the server, not by your browser, and blocking storage on your device does not change it. The law does not require a separate cookie policy where a site sets none, so there is not one.

This page is changed by replacing it, and the date of the edition you are reading is at the top. If something on it changes in a way that matters to an order already under way, the customer concerned is told in writing rather than left to notice.