GDPR – October 2019

Go West Schools Photography has always prioritised data and system security as part of its obligation to provide secure and well-managed systems which positions us well for the recent changes in legislation.  We adhere to best practice guidelines such as The Data Protection Act as given by the Information Commissioner’s Office (ICO) / GDPR.

Go West Schools Photography is following updates to the GDPR interpretation using information provided by the ICO ensuring the most recent guidelines are followed.

Data Processing

  • Go West Schools Photography are booked to take either Individual, Class or website photographs and parents will have given consent to the school if they are happy for their child to be photographed.
  • Data is requested from the school which we process as part of our business activity to provide individual and class images to your school as agreed on our Booking Form both for your SIMS database and for parents to order photographs as part of their documentation of their child’s school life.
  • All information received for the creation of  barcodes and photo processing are stored on our encrypted computer system while in use and deleted as soon as the orders are completed.
  • All printed information containing data for the images produced while processing orders are destroyed via our confidential waste processor.
  • All systems are developed along industry standard best practice guidelines.
  • Access to our systems is governed by sophisticated Firewall configuration and audited quarterly by our IT support specialist.
  • We do not use any images or information received through ordering photographs for any e-mail marketing – we do not use e-mail marketing at Go West Schools Photography.
  • Similarly, all images are stored on a dedicated encrypted School Images Hard Drive, locked in a secure location, whereby Olivia Robinson (the Data Processor) is the only member of our staff with access and no passwords are stored. These images will be held for a maximum period of 18 months, a period we deem acceptable for parents to order.
  • All staff who assist when packing school photographs have signed confidentiality contractual agreements.
  • As part of our existing PCI DSS accreditation we do not store any credit card information for Go West Schools Photography or Active Photographic Ltd.
  • Parental access to individual images via our online service is limited to a unique Access Code, these are non-sequential and unique to each student. Online access is not available for Class/Group Photos.
  • Personal details received from parents for us to produce their orders through our online system will be destroyed once the orders from the relevant school have been processed. The information received by us from parents when ordering through the school will only be used should there be a query regarding their order.  As per our current system all personal details will be destroyed via our shredding system waste processor as soon as orders are completed.
  • Digital image purchases made via our online ordering system are delivered via download from within the client’s secure area under https encryption.
  • All online ordering will now only be available for 18 months and images will be permanently deleted from the system.
  • Please note we must keep a record of order data when it is a mandatory requirement for HMRC, but this will be kept on our designated schools encrypted system.