Privacy Notice

Last updated: September 2026

Cracking Capture takes the privacy and security of our customers and the children we photograph seriously.

This Privacy Notice explains what personal information we collect, why we use it, how we protect it, who we may share it with and the rights individuals have under UK data protection law.

1. Who we are

Cracking Capture is a photography business operated as a partnership.

For the purposes of UK data protection law, Cracking Capture is the controller of the personal information described in this Privacy Notice.

Cracking Capture
Pincott Close, Painswick Road
Brockworth
Gloucester
GL3 4RX

Email: info@crackingcapture.com
Telephone: 07545 123292 / 07581 259828

ICO Registration Number: ZC278231

2. Personal information we collect

Depending on the service being provided, we may collect and use:

photographs of children and other individuals;
a child’s name or photography/order reference number;
the nursery or school attended;
parent or guardian name and contact details;
order details and order-form numbers;
payment and transaction information;
permissions, preferences and authorisations relating to photographs;
correspondence and customer-service records; and
limited technical information generated when you use our website.

We may receive some information directly from parents or guardians and some limited information from nurseries or schools where this is necessary to organise photography, identify orders, distribute photographs or respect instructions that a child should not be photographed.

An identifiable photograph is personal data. We recognise that children’s personal information requires particular care.

3. Why we use personal information

We use personal information to:

provide nursery and school photography services;
prepare proofs and order forms;
process photography orders;
produce prints and photographic products;
provide purchased digital photographs;
process and reconcile payments;
respond to enquiries and customer-service requests;
manage late orders and reorders;
maintain appropriate business and financial records; and
comply with legal and regulatory obligations.

We only process personal information where we have an appropriate lawful basis under UK data protection law.

4. Our lawful bases

For the processing of children’s photographs needed to provide nursery and school photography services, prepare proofs, fulfil photography orders and provide purchased photographs, we rely where appropriate on our legitimate interests in operating and administering the photography service.

When relying on legitimate interests, we consider:

the purpose of the processing;
whether the processing is necessary;
the reasonable expectations of families;
the nature of the information involved; and
the rights and interests of the child.

The ICO requires organisations relying on legitimate interests to identify the legitimate interest, show that the processing is necessary and balance it against the individual’s rights and freedoms, with particular care where children are involved.

For information relating directly to a parent or guardian’s order, payment or customer relationship with us, we may rely on contract where processing is necessary to take steps requested by you or to fulfil an order you have placed.

We may also process information where necessary to comply with a legal obligation, including accounting, tax and record-keeping requirements.

Where we wish to use a child’s photograph for advertising, our website, social media or promotional literature, we request separate permission. Purchasing photographs does not automatically give us permission to use them for publicity.

5. Nursery and school photography

We work with nurseries and schools to provide parents and guardians with the opportunity to purchase professional photographs of their children.

The nursery or school will normally inform families that photography is taking place and communicate to us where a child should not participate.

Photographs are used to prepare proofs, process orders and produce the products requested by parents or guardians.

We aim to limit identifying information associated with children’s photographs and restrict access to photography files to those who need it for the operation of the service.

6. Digital image delivery and ShootProof

Where a parent or guardian purchases a Digital Download, selected photographs may be uploaded to ShootProof for the purpose of securely providing the purchased digital images.

We do not routinely upload every child photographed at a nursery to ShootProof. We upload selected images where a digital product has been ordered and the required parent or guardian authorisation has been provided.

Digital images are delivered using access-controlled galleries or albums. Parents or guardians are provided with a private link or QR code together with the appropriate password or PIN.

Parents and guardians should keep gallery links, QR codes and passwords private and should not share them with anyone who is not authorised to view the photographs.

For end-user personal data processed through the service on our behalf, ShootProof states that the photographer is the controller and ShootProof is the processor. ShootProof’s current Data Processing Addendum forms part of its Terms of Use and expressly covers UK GDPR and the UK Data Protection Act 2018.

ShootProof’s DPA also requires it to process personal data on documented instructions, apply confidentiality and security measures, assist with data-subject rights and data-protection assessments, and place equivalent obligations on subprocessors.

7. International transfers

Some service providers we use may process personal information outside the United Kingdom.

ShootProof is based in the United States and may process personal data there or through approved subprocessors.

For UK personal data, ShootProof’s current DPA incorporates the UK Addendum to the EU Standard Contractual Clauses or, where appropriate, the UK International Data Transfer Agreement (IDTA) as its transfer mechanism. The DPA also states that ShootProof does not currently rely on the UK Extension to the EU-U.S. Data Privacy Framework as its transfer mechanism.

Where personal information is transferred outside the UK, we seek to ensure that an appropriate legal transfer mechanism or safeguard is in place as required by UK data protection law.

8. Online payments and PayPal

Online payments are processed using PayPal.

When you make a payment, PayPal processes personal and transaction information in accordance with its own Privacy Statement and may act as an independent data controller for relevant payment activities.

PayPal states that it processes personal information to provide payment services, administer transactions, prevent fraud, comply with law and manage the customer relationship.

We receive the information reasonably necessary to identify and reconcile your payment with your photography order.

We do not need to collect or store your full payment-card details ourselves where payment is processed directly by PayPal.

9. Who we share personal information with

We do not sell children’s photographs or customer personal information.

We may share personal information where reasonably necessary with:

the nursery or school involved in administering or distributing the photography service;
ShootProof for private digital-image hosting and delivery;
PayPal for online payment processing;
website, email, storage, backup or other technical service providers;
professional advisers where necessary; and
public authorities or other organisations where disclosure is required by law.

The ICO requires privacy notices to explain recipients or categories of recipients and any international transfers.

10. ShootProof subprocessors

ShootProof may use subprocessors to help provide its services.

Under its DPA, ShootProof must place data-protection obligations on subprocessors that are no less protective than the obligations in the DPA and remains responsible for their performance. ShootProof also publishes a current subprocessor list and provides a mechanism for photographers to object to new subprocessors on reasonable data-protection grounds.

11. How long we keep photographs and personal information

We do not keep personal information for longer than we reasonably need it.

Photography files may be retained after the original order period so that we can deal with:

late orders;
reorders;
customer enquiries;
complaints;
replacement products; and
other legitimate business requirements.

We periodically review retained photography files and remove them when there is no longer a reasonable business or legal need to keep them.

Digital galleries provided through ShootProof are intended to be temporary. They are removed when they are no longer reasonably required for delivery of the digital order, a reasonable opportunity to download or re-download purchased photographs, or to resolve related customer enquiries.

Order, payment and financial records may be retained for longer where necessary for accounting, taxation, legal claims or other record-keeping obligations.

Records relating to permissions or authorisations may be retained where reasonably necessary to demonstrate what permission was given and how photographs were used.

The ICO permits organisations to state either a specific retention period or the criteria used to determine retention, provided the information is clear.

12. How we protect personal information

We take reasonable technical and organisational measures to protect photographs and other personal information against loss, unauthorised access, misuse, alteration or disclosure.

These measures may include:

restricting access to photography files;
password-protecting computers and systems;
secure backup arrangements;
limiting access to online galleries;
using private links, QR codes and passwords or PINs;
keeping customer information only for as long as reasonably necessary; and
using service providers with appropriate contractual and security safeguards.

ShootProof’s current DPA states that its security controls include encryption, confidentiality and integrity measures, resilience and recovery procedures, regular testing of safeguards, protection during storage, limited data retention and erasure controls.

No online or electronic storage system can be guaranteed to be completely secure, but we seek to use safeguards appropriate to the nature and sensitivity of the information we handle.

13. Promotional use of photographs

We do not treat the purchase of photographs as permission to use a child’s image for advertising or promotional purposes.

Where we wish to use nursery or school photographs on our:

website;
social media;
advertising;
promotional literature; or
other marketing materials,

we request separate permission.

Where processing is based on consent, consent may be withdrawn by contacting us.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

14. Website, cookies and analytics

Our website may use cookies and similar technologies required for it to operate.

Where non-essential cookies, analytics or similar technologies are used, we provide appropriate information and request consent where required.

Information submitted through our website, including enquiries and photography-payment information, is used only for the purposes described in this Privacy Notice and for operating our business.

15. Your data protection rights

Depending on the circumstances and the lawful basis being relied upon, individuals may have rights including:

the right to access personal information;
the right to have inaccurate information corrected;
the right to request deletion;
the right to request restriction of processing;
the right to object to processing based on legitimate interests;
the right to data portability in certain circumstances; and
the right to withdraw consent where processing is based on consent.

Rights relating to a child’s personal information belong to the child. Depending on the child’s age, understanding and circumstances, a parent or guardian may exercise those rights on the child’s behalf.

To make a request, please contact:

info@crackingcapture.com

We may need to verify the identity or authority of someone making a request before releasing photographs or other personal information.

The ICO says privacy information should explain available rights, the right to withdraw consent where relevant and the right to complain to a supervisory authority.

16. Automated decision-making

We do not use children’s photographs or customer information to make solely automated decisions that have legal or similarly significant effects on individuals.

17. Changes to this Privacy Notice

We may update this Privacy Notice where our services, suppliers, technology or legal obligations change.

The date at the top of this page shows when it was last updated.

18. Contact us

If you have any questions about this Privacy Notice or how Cracking Capture handles personal information, please contact: