H Tempest Limited – Privacy Notice
1. Who we are and how to contact us
H Tempest Limited ("we", "us") is the data controller for the personal data described in this notice, unless section 4 says otherwise. Our registered office is The Colour Laboratory, Lelant, St Ives, Cornwall, TR26 3HU. Our ICO registration number is Z8200167.
This notice explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to our customers, to pupils and their parents or guardians, to schools and nurseries, to website visitors, and to suppliers.
Our Data Protection Manager is Ben Moulton. You can contact him about anything in this notice:
Contact | Detail |
Post | Data Protection Manager, H Tempest Limited, The Colour Laboratory, Lelant, St Ives, Cornwall, TR26 3HU |
The law that applies to us is the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended by the Data (Use and Access) Act 2025. We call these laws "Data Protection Law" in this notice.
2. Who this notice covers
You are | What this means for you |
A customer who orders prints, products or services from us | Sections 3, 5 to 15 apply to you. |
A parent, guardian or pupil in a school or nursery we photograph | Section 4 explains who is responsible for your data and how to order photographs. Sections 3, 5 to 15 also apply. |
A school, nursery or other organisation that books us | Section 4 explains our relationship with you. We hold contact details of your staff under section 3. |
A visitor to our website or app | Sections 3, 8 and 9 apply to you. |
A supplier, contractor or business contact | We hold your business contact details to manage our contract with you. |
A job applicant or employee | A separate notice applies. HR can give you a copy. |
3. Personal data we collect
We collect personal data from you, from our website and app, and from third parties.
3.1 Data you give us
You give us data when you place an order, register an account, contact us, enter a competition or survey, or report a problem. This data can include:
your name, postal address, email address and telephone number
your order details and order history
payment card details, which our payment provider processes on our behalf (we do not store full card numbers)
the name, class or year group of a pupil, when you order school photographs
the content of your messages to us
3.2 Data we collect automatically
When you use our website or app we collect:
technical data: your IP address, login data, browser type and version, time zone, device type and operating system
usage data: the pages you visit, the products you view or search for, how long you stay, the links you click, and errors you meet
We collect analytics and advertising data only with your consent. See section 8.
3.3 Data we receive from others
Schools and nurseries give us pupil names, class or year group, and a unique reference so that parents can find and order the correct photographs.
Our delivery, payment and IT service providers give us data about the status of your order and payment.
Fraud prevention and credit reference agencies give us data when section 5 says we carry out a credit or fraud check.
3.4 Photographs
A photograph of a person is personal data. We create photographs of pupils, staff and other subjects as part of our service. Section 4 explains the rules for school photographs.
4. School photography: pupils, parents and schools
We photograph pupils in schools and nurseries. The school books the session. We decide how the photography is done and how parents can order, so we are the data controller for the photographs we take and sell. The school is the controller for its own use of photographs, for example in its records.
Activity | Our role | Lawful basis |
The school gives us pupil names, class lists and a reference for each pupil | Controller | Legitimate interests (Article 6(1)(f)): to match each photograph to the correct pupil and make it available to that pupil's parent or guardian only |
We take portrait, class and group photographs on school premises | Controller | Legitimate interests: to provide school photography that parents expect and can choose to buy. We have assessed this against pupils' rights and apply the safeguards in 4.1, 4.2 and 4.4 |
A parent or guardian views proofs and orders | Controller | Contract with the parent or guardian (Article 6(1)(b)) |
We keep photographs after the order period so that parents can reorder | Controller | Legitimate interests. See section 11 |
The school asks us to supply photographs for its own records, for example ID cards or its pupil database | Processor for the school | The school's lawful basis. The school's privacy notice applies |
4.1 What this means for parents and guardians
The school decides whether your child is photographed. If you do not want your child photographed, tell the school before photography day.
We give the school a unique reference for each pupil. You use this reference to see your child's proofs. We do not publish photographs where anyone can find them.
You do not have to order. If you do not order, we keep the photograph only for the period in section 11 and then delete it.
4.2 What we do not do with pupil photographs
We do not use pupil photographs for our own advertising or marketing.
We do not sell pupil photographs or pupil data to anyone.
We do not use facial recognition or other biometric analysis on pupil photographs.
4.3 Schools and nurseries
We hold the names, roles and contact details of school staff to manage our contract with the school. Our lawful basis is the contract with the school and our legitimate interest in running our business. Where we process pupil data on the school's instructions, a data processing agreement sets out our duties.
4.4 Safeguarding and photography restrictions
Some pupils need extra protection. A school may tell us that a pupil must not be photographed, must not appear in a class photograph, or must not be named with their photograph. We apply these instructions in the services we provide. We limit access to safeguarding information to the staff who need it to apply the restriction.
Parents and guardians should give these instructions to the school, not to us, so that the school can pass them to us before photography day.
4.5 How we edit photographs
We use editing software, automated image processing and software with machine learning-assisted features to prepare photographs. This includes colour, brightness and exposure correction, cropping, background replacement, retouching and the layout of finished products. This editing does not identify you or make decisions about you. It is part of the photography service, and the same lawful basis applies.
We do not use facial recognition or any other biometric analysis to identify people in photographs.
5. How we use your personal data and our lawful basis
Data Protection Law requires us to have a lawful basis for each use of your personal data. The table shows each purpose and its basis.
Purpose | Data used | Lawful basis |
Take your order, produce your prints or products, deliver them and take payment | Contact details, order details, payment status, photographs | Contract with you (Article 6(1)(b)) |
Answer your questions and complaints | Contact details, your messages, order history | Contract with you; legitimate interests in giving good customer service |
Tell you about changes to our service, prices or terms | Contact details | Contract with you; legal obligation |
Keep financial records and meet tax and accounting rules | Order and payment records | Legal obligation (Article 6(1)(c)) |
Carry out fraud checks and protect our site and systems | Technical data, order and payment data | Legitimate interests in preventing fraud and keeping our systems secure; legal obligation |
Run, maintain and improve our website and app, including troubleshooting and testing | Technical data, usage data | Legitimate interests in running an effective website |
Send you marketing about similar products and services | Name, email address, mobile number, order history | Legitimate interests, with the right to opt out (see section 7) |
Measure website use and show you relevant advertising | Analytics and advertising cookie data | Consent (Article 6(1)(a)) |
Run competitions, promotions and surveys you enter | Contact details, your entry | Contract with you; consent where we say so on the entry form |
Establish, exercise or defend legal claims | Any data relevant to the claim | Legitimate interests in protecting our legal position |
Where we rely on legitimate interests, we have checked that our interest is not outweighed by your rights and freedoms. You can ask for a copy of our assessment by contacting the Data Protection Manager. You have the right to object to any processing based on legitimate interests (see section 14).
Where you must give us data to perform a contract, for example your delivery address, we cannot complete your order without it.
6. Special category data
We do not ask for special category data. This is data about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation, and data about criminal convictions and offences.
If you choose to give us such data, for example a health condition that affects delivery, we use it only for the purpose you give it for. Our lawful basis is your explicit consent (Article 9(2)(a)). You can withdraw that consent at any time by contacting the Data Protection Manager. If you withdraw consent, we delete the data unless we must keep it to meet a legal obligation or to defend a legal claim.
An ordinary photograph is not biometric data under Data Protection Law. It becomes biometric data only if it is processed by technical means to identify a person uniquely. We do not do this (see section 4.5). A photograph can show a person's ethnic origin or a disability. We do not analyze photographs for these characteristics, and we do not use them for that purpose.
7. Marketing
If you have bought from us or asked about our products, we may send you email or SMS marketing about similar products and services. We do this under the "soft opt-in" rule in PECR. We give you a clear way to opt out when we collect your details and in every message we send.
If you are a new customer and have not bought from us, we send you electronic marketing only if you have given consent.
We do not give your details to other companies for their own marketing.
You can stop marketing at any time:
click the unsubscribe link in any email
reply STOP to any SMS
change the settings in your online account
email gdpr@htempest.co.uk
We act on your request within 10 working days. We may still send you messages about your order, your account or changes to our terms, because these are not marketing.
8. Cookies and website analytics
Our website and app use cookies and similar technologies.
Type | Purpose | Your choice |
Strictly necessary | Keep you logged in, remember your basket, keep the site secure | Always on. The site does not work without them. |
Analytics | Measure how visitors use the site so we can improve it | On only if you accept them in the cookie banner |
Advertising | Show you relevant adverts and measure whether they work | On only if you accept them in the cookie banner |
You can change your choice at any time through the cookie settings link at the bottom of every page. Our Cookie Policy lists each cookie, who sets it and how long it lasts.
Where you accept analytics cookies we use Google Analytics 4. Google acts as our processor. Data is pseudonymised and IP addresses are not stored.
9. Who we share your personal data with
We share your personal data only when we need to, and only with the categories below. Each service provider works under a written contract that limits what it can do with your data.
Recipient | What we share | Why |
Our group companies (as defined in section 1161(5) of the Companies Act 2006) | Contact and order data | Internal administration, IT and finance |
Delivery providers | Name, delivery address, order contents | To produce and deliver your order |
Payment providers | Payment details, order value | To take payment securely |
Fraud prevention and credit reference agencies | Name, address, order and payment data | To check for fraud and, for trade accounts, to assess credit |
Schools and nurseries | Pupil reference and order status | To run school photography (see section 4) |
Professional advisers (lawyers, accountants, auditors, insurers) | Relevant records | To get advice and meet legal duties |
Regulators, courts and law enforcement | What the law requires | To meet a legal obligation or court order |
If we sell, buy or restructure a business, we may share your data with the buyer or seller and their advisers. We tell you if this changes who controls your data.
We do not sell your personal data.
10. International transfers
We store your personal data in the United Kingdom.
Some of our service providers process data outside the UK. When this happens we use one of these safeguards:
the country is covered by UK adequacy regulations, which means the UK government has decided its data protection law is adequate (this includes the EEA countries)
the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment
the UK Extension to the EU-US Data Privacy Framework, for certified US providers
You can ask the Data Protection Manager for a list of the countries we transfer data to and the safeguard used for each.
11. How long we keep your personal data
We keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires.
Data | How long we keep it | Why |
Order, invoice and payment records | 7 years from the end of the financial year of the order | Tax and accounting law |
Customer account and contact details | 7 years from the end of the financial year of the order | To serve you and handle any later queries or claims |
School photographs not ordered | 10 Years after photography day, then deleted | To give parents time to order |
School photographs ordered | 10 Years after photography day, then deleted | To allow reorders |
Marketing preferences and opt-outs | For as long as we market to you, plus 1 year after you opt out | To make sure we respect your opt-out |
Customer service correspondence | 7 years from the last contact | To handle follow-up questions and complaints |
Website technical logs | 12 months | Security and troubleshooting |
Analytics cookie data | 14 months | Set by the analytics provider under our configuration |
Competition and survey entries | 6 months after the competition or survey closes | To run and audit the competition |
When the retention period ends we delete the data or make it anonymous so that it no longer identifies you. If a legal claim or an investigation is open, we keep the relevant data until it is closed.
Deleted data can remain in our backup systems for up to 30 days until the backup cycle overwrites it. We do not restore deleted personal data from backups except to recover from a system failure, and we delete it again if that happens.
12. Security
We protect your personal data with technical and organizational measures that match the risk. These include:
encryption of data in transit (TLS) and at rest
access controls so that only staff who need your data can see it
a payment provider that is PCI DSS compliant; we do not store full card numbers
regular security testing, patching and monitoring of our systems
data protection training for all staff who handle personal data
written contracts with every service provider that handles your data
If we give you a password, or you choose one, keep it confidential. You are responsible for activity on your account that uses your password.
No transfer of data over the internet is completely secure. If we discover a breach that puts your rights at risk, we tell you and the Information Commissioner's Office as the law requires.
13. Automated decision-making
We do not make decisions about you that are based only on automated processing and that have a legal or similarly significant effect on you.
We do not use profiling to decide what to offer you, other than to suggest products similar to those you have viewed or ordered.
14. Your rights
You have these rights under Data Protection Law. They are free to use.
Right | What it means |
Access | Ask us to confirm that we process your data, and get a copy of it with information about how we use it. |
Rectification | Ask us to correct data that is wrong or incomplete. |
Erasure | Ask us to delete your data, for example when we no longer need it or you withdraw consent. We can refuse if the law requires us to keep it. |
Restriction | Ask us to stop using your data, but keep it, while we check its accuracy or your objection. |
Objection | Object to processing based on legitimate interests. We stop unless we can show compelling grounds. You can always object to direct marketing, and we stop at once. |
Portability | Receive the data you gave us in a structured, machine-readable format, or ask us to send it to another organization. |
Withdraw consent | Withdraw consent at any time where consent is our lawful basis. This does not affect processing before you withdrew it. |
Automated decisions | Ask for human review of a decision made only by automated means, and contest it. |
14.1 How to use your rights
Contact the Data Protection Manager by email at gdpr@htempest.co.uk or by post at the address in section 1. Tell us which right you want to use and give enough detail for us to find your data, for example your order number.
We may ask you to confirm your identity before we act. We respond within one calendar month. If your request is complex or you make several requests, we may take up to two more months. We tell you within the first month if we need more time and why.
If a request is clearly unfounded or excessive, for example because it repeats a request we have already answered, we may charge a reasonable fee or refuse it. We tell you why.
14.2 Rights of children and parents
A child can use these rights for their own data. A parent or guardian can use them for a child who is too young to understand them. We may ask for proof that you are the parent or guardian.
14.3 Requests about group and class photographs
A class or group photograph is the personal data of every person in it. If you ask us to delete or restrict a group photograph, we must also consider the rights of the other people in it. We may remove your or your child's image from our sale copy instead of deleting the whole photograph. We explain our decision when we respond.
15. How to make a complaint
If you think we have not handled your data correctly, tell us first. You have a legal right to complain to us and we must deal with your complaint.
Email gdpr@htempest.co.uk, or write to the Data Protection Manager at the address in section 1.
We acknowledge your complaint within 30 days.
We investigate and tell you about the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
The ICO expects you to raise your complaint with us first, but you can go to the ICO at any time.
16. Other websites
Our website may link to other websites, including those of schools, partners and advertisers. Those websites have their own privacy notices. We are not responsible for them. Read their notices before you give them personal data.