Last updated 11 September 2026
This explains what personal data JBR Photography collects, why, how long it is kept and what you can ask for. It covers both this website and the private albums shared from it — and, because photography is the work, it also covers people who appear in a photograph and have never visited this site at all.
JBR Photography Limited, trading as JBR Photography, is the data controller for the personal data described here.
A company registered in England and Wales. Company number 17409761. Registered office 66 Paul Street, London, England, United Kingdom, EC2A 4NA.
You can reach us at photos@jbrphotography.uk, by telephone on 07346 815927, or by post at 66 Paul Street, London, EC2A 4NA.
We are registered with the Information Commissioner's Office under registration number ZC227878.
Four groups of people, and most privacy notices only mention the last one:
Photographs are taken at commissioned shoots and at events such as local sport. Where the work is commissioned, we handle those images to perform the contract with the client. Otherwise we rely on legitimate interests — practising and showing photographic work — and we have written down the assessment that balances that interest against the privacy of the people photographed. You can ask for a summary of it.
Consent for club, school and organisation work follows one of two routes, settled with that organisation before a camera is ever taken along. Where the organisation already asks its own members about media use, we do not duplicate that question — we ask a further, separate one, covering only our own use beyond the organisation's own channels. Where no such process exists, we ask directly: a short form is sent by a private link to the right person — a committee member, a parent or guardian, or the person photographed — asking separate questions rather than one bundled one, so agreeing to appear on an organisation's own channels is never treated as agreeing to anything more. Each question is answered Full, Limited or No — "Limited" meaning group or action images only, with no caption naming who is in them — and a question left unanswered is treated as No, never as Full. For individual commissioned portraits, the same choices are captured as part of booking, alongside a model release.
Consent recorded this way can be withdrawn at any time by writing to photos@jbrphotography.uk. Withdrawal stops future use but cannot undo a photograph already delivered, published or sold.
Against a photograph we may record which of the people already listed on that shoot appear in it. This exists so that a photograph can be used only as the people actually in it agreed — without it, one person's decision applies to every frame from that day, including frames they do not appear in.
This is done by hand, from a list we already hold. No face recognition, no biometric measurement and no automated identification of any kind is used, and nothing is derived from the image itself. The name attached is one you already gave us in order to arrange the shoot; the record is simply which of those names goes with which frame.
A photograph nobody has reviewed carries no such record, and is treated exactly as it was before: governed by the agreement covering the shoot as a whole. Where a shoot was photographed on legitimate interests — an event where individuals could not reasonably be asked — no such record is made at all, because that basis rests on people not being identified.
Which photographs you are recorded as appearing in is part of the record you can ask for — it is shown on your own record page — and it is deleted with the photographs themselves.
When a photograph is imported, the embedded metadata is stripped from the stored file in the browser, and the server checks the uploaded file again and refuses anything still carrying it. That means the file we keep, and any file shared from it, has no EXIF, XMP or IPTC data attached.
Location is never stored. Where a camera or phone recorded GPS coordinates, we record only that coordinates were present — so that their removal can be demonstrated — and discard the coordinates themselves. They are not read into our records and cannot be recovered from us.
Camera model, capture time and our own internal rating are kept in our records where only the photographer can see them. Album pages are built from an explicit short list of fields — the image, its dimensions, its file size and its colours — so those details are not merely hidden from a viewer, they are never sent to the page.
Family and youth sport work means photographs of children are a routine part of this library, and children's data is given particular protection under UK law. Consent for photographing a child is obtained from a parent or guardian, and through the organising club or school where one is involved.
Photographs of a child are held for 12 months from the date of the shoot and are then deleted. Deleting our copy is not the same as unpublishing: anything already posted to a website or social media stays there until it is taken down, which we will do on request — but a copy somebody else has screenshotted or re-shared is beyond our reach.
If you are a parent or guardian and want a photograph of your child removed, email photos@jbrphotography.uk and it will be deleted. You do not have to give a reason, and we will not ask you to justify the request.
Albums are shared by private link, never by browsing, and are not indexed by search engines. A link can require you to confirm your email address before it opens.
Where it does, this is what happens:
Removing an address from a link ends that person's access on their very next page load. Withdrawing a link ends it for everyone it was sent to.
A print order records your name, your email address, the delivery address, what you ordered and the price, and anything you write in the “anything to add” box. A download records only the email address you buy it with, the album and the amount. A booking records your name and email address, the date and package you asked for, the quoted price and the deposit, and — if you give them — your telephone number, your postcode and whatever you write in the message box.
Payment is taken by Stripe on its own payment page. We send Stripe your email address, a description of what you are buying and the amount; you type your card details into Stripe’s page rather than ours, and we never see or hold them. We receive confirmation that the payment succeeded and its amount. The delivery address you give us is not sent to Stripe.
A print order is passed to our print supplier, Prodigi, with the photograph, your name, your email address and the delivery address, and nothing else — the email address because Prodigi sends its own dispatch and tracking notices. Nothing is sent to them until an order is placed and paid. If we cannot fulfil a paid order — for example because permission to use the photograph was withdrawn after you paid — we refund it in full and tell you why.
This site sets only cookies that are necessary for it to work. There is no analytics, no advertising, no tracking, and no third-party content — the fonts are served from this site rather than from a font network, so opening a page here does not tell anyone else that you did. Because nothing optional is stored, there is nothing to consent to and no banner to dismiss.
| Cookie | What it does | Lasts |
|---|---|---|
ptfm_view | Keeps you signed in to a shared album after you enter your code. | Up to 30 days |
ptfm_manage | Signs the photographer in to the management tool. | 30 days |
CF_Authorization | Cloudflare Access sign-in for the management tool. | Set by that sign-in |
__cf_bm, cf_clearance | Cloudflare security and bot protection. | 30 minutes to 1 year |
Resend is certified under the EU–US Data Privacy Framework and its UK Extension.
Each is bound by a data processing agreement and may only act on our instructions. Where data is handled outside the UK, that transfer relies either on the UK Extension to the Data Privacy Framework or on the standard contractual clauses with the UK Addendum. We do not sell personal data, and we do not share it for anyone else's marketing.
If you tick the box asking for occasional marketing email, we keep your name and email address for that purpose, on the basis of your consent. Every message carries a one-click unsubscribe, and unsubscribing changes nothing about your photographs or your booking. If you are on that list and put prints in the basket in a gallery we sent to your email address, we keep the basket so it is there when you come back, and may send you one email about it a day later.
| What | How long |
|---|---|
| One-time verification codes | Deleted 24 hours after they are issued. They stop working after ten minutes. |
| Viewer sessions | A maximum of 30 days, and deleted a week after they end. |
| Removed allowlist entries | Deleted 90 days after an address is taken off a link. |
| Photographs taken for a client | Reviewed every 12 months and deleted when that review says so. |
| Client records and correspondence | Six years after the last transaction, to meet tax and limitation periods. |
| Print orders, downloads and bookings | Six years after the order or the session, to meet tax and limitation periods. A print order — what was bought, what was paid and where it was sent — is kept even if the rest of your data is erased at your request, and the record of that erasure says so. |
| Server logs | Three to seven days, held by Cloudflare and not adjustable by us. |
A marketing permission is kept while it stands. If you unsubscribe we keep a record of that, so we remember not to write to you; if you ask for erasure instead, the permission and the unsubscribe record are deleted outright. The log of which marketing emails were sent to an address is kept, as the evidence a complaint is answered with. A kept print basket is deleted when you order through that gallery, when the gallery link closes, or when you unsubscribe, whichever comes first.
Under UK data protection law you can ask us to do any of the following:
Email photos@jbrphotography.uk and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you raised it with us first so we can put it right.
If this notice changes, the date at the top changes with it. Where a change materially affects people whose photographs we hold, we will say so rather than rely on the date alone.