Last updated 25 August 2026
This explains what personal data JBR Photography collects, why, how long it is kept and what you can ask for. It covers both this website and the private albums shared from it — and, because photography is the work, it also covers people who appear in a photograph and have never visited this site at all.
JBR Photography Limited, trading as JBR Photography, is the data controller for the personal data described here.
A company registered in England and Wales. Company number 17409761. Registered office 66 Paul Street, London, England, United Kingdom, EC2A 4NA.
You can reach us at photos@jbrphotography.uk, or by post at 66 Paul Street, London, EC2A 4NA.
We are registered with the Information Commissioner's Office under registration number ZC227878.
Four groups of people, and most privacy notices only mention the last one:
Photographs are taken at commissioned shoots and at events such as local sport. Where the work is commissioned, we handle those images to perform the contract with the client. Otherwise we rely on legitimate interests — practising and showing photographic work — and we have written down the assessment that balances that interest against the privacy of the people photographed. You can ask for a summary of it.
Consent for club, school and organisation work follows one of two routes, settled with that organisation before a camera is ever taken along. Where the organisation already asks its own members about media use, we do not duplicate that question — we ask a further, separate one, covering only our own use beyond the organisation's own channels. Where no such process exists, we ask directly: a short form is sent by a private link to the right person — a committee member, a parent or guardian, or the person photographed — asking separate questions rather than one bundled one, so agreeing to appear on an organisation's own channels is never treated as agreeing to anything more. Each question is answered Full, Limited or No — "Limited" meaning group or action images only, with no caption naming who is in them — and a question left unanswered is treated as No, never as Full. For individual commissioned portraits, the same choices are captured as part of booking, alongside a model release.
Consent recorded this way can be withdrawn at any time by writing to photos@jbrphotography.uk. Withdrawal stops future use but cannot undo a photograph already delivered, published or sold.
Against a photograph we may record which of the people already listed on that shoot appear in it. This exists so that a photograph can be used only as the people actually in it agreed — without it, one person's decision applies to every frame from that day, including frames they do not appear in.
This is done by hand, from a list we already hold. No face recognition, no biometric measurement and no automated identification of any kind is used, and nothing is derived from the image itself. The name attached is one you already gave us in order to arrange the shoot; the record is simply which of those names goes with which frame.
A photograph nobody has reviewed carries no such record, and is treated exactly as it was before: governed by the agreement covering the shoot as a whole. Where a shoot was photographed on legitimate interests — an event where individuals could not reasonably be asked — no such record is made at all, because that basis rests on people not being identified.
Which photographs you are recorded as appearing in is part of the record you can ask for — it is shown on your own record page — and it is deleted with the photographs themselves.
When a photograph is imported, the embedded metadata is stripped from the stored file in the browser, and the server checks the uploaded file again and refuses anything still carrying it. That means the file we keep, and any file shared from it, has no EXIF, XMP or IPTC data attached.
Location is never stored. Where a camera or phone recorded GPS coordinates, we record only that coordinates were present — so that their removal can be demonstrated — and discard the coordinates themselves. They are not read into our records and cannot be recovered from us.
Camera model, capture time and our own internal rating are kept in our records where only the photographer can see them. Album pages are built from an explicit list of four fields — the image, its dimensions and its colours — so those details are not merely hidden from a viewer, they are never sent to the page.
Family and youth sport work means photographs of children are a routine part of this library, and children's data is given particular protection under UK law. Consent for photographing a child is obtained from a parent or guardian, and through the organising club or school where one is involved.
Photographs of a child are held for 12 months from the date of the shoot and are then deleted. Deleting our copy is not the same as unpublishing: anything already posted to a website or social media stays there until it is taken down, which we will do on request — but a copy somebody else has screenshotted or re-shared is beyond our reach.
If you are a parent or guardian and want a photograph of your child removed, email photos@jbrphotography.uk and it will be deleted. You do not have to give a reason, and we will not ask you to justify the request.
Albums are shared by private link, never by browsing, and are not indexed by search engines. A link can require you to confirm your email address before it opens.
Where it does, this is what happens:
Removing an address from a link ends that person's access on their very next page load. Withdrawing a link ends it for everyone it was sent to.
This site sets only cookies that are necessary for it to work. There is no analytics, no advertising, no tracking, and no third-party content — the fonts are served from this site rather than from a font network, so opening a page here does not tell anyone else that you did. Because nothing optional is stored, there is nothing to consent to and no banner to dismiss.
| Cookie | What it does | Lasts |
|---|---|---|
ptfm_view | Keeps you signed in to a shared album after you enter your code. | Up to 30 days |
ptfm_manage | Signs the photographer in to the management tool. | 30 days |
CF_Authorization | Cloudflare Access sign-in for the management tool. | Set by that sign-in |
__cf_bm, cf_clearance | Cloudflare security and bot protection. | 30 minutes to 1 year |
Resend is certified under the EU–US Data Privacy Framework and its UK Extension.
Each is bound by a data processing agreement and may only act on our instructions. Where data is handled outside the UK, that transfer relies either on the UK Extension to the Data Privacy Framework or on the standard contractual clauses with the UK Addendum. We do not sell personal data, and we do not share it for anyone else's marketing.
| What | How long |
|---|---|
| One-time verification codes | Deleted 24 hours after they are issued. They stop working after ten minutes. |
| Viewer sessions | A maximum of 30 days, and deleted a week after they end. |
| Removed allowlist entries | Deleted 90 days after an address is taken off a link. |
| Photographs taken for a client | Reviewed every 12 months and deleted when that review says so. |
| Client records and correspondence | Six years after the last transaction, to meet tax and limitation periods. |
| Server logs | Three to seven days, held by Cloudflare and not adjustable by us. |
Under UK data protection law you can ask us to do any of the following:
Email photos@jbrphotography.uk and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you raised it with us first so we can put it right.
If this notice changes, the date at the top changes with it. Where a change materially affects people whose photographs we hold, we will say so rather than rely on the date alone.