Privacy policy.

In order to do my job and to allow me to maintain this website, I need to collect and/or store certain pieces of personal data.  I never collect or store more data than I need, and I never sell it to any third party.  I treat the data I collect and store with care, and ensure it is stored securely and only for as long as I require it.  I will tell anyone who asks exactly what data I have stored about them, and I will do so promptly and accurately.  I will remove any data from my systems that you would rather I don’t store as far as practicable, but if doing so might have implications for how I can do the job you’ve contracted me to do (if relevant), I will inform you of any consequences of this, so you can make an informed decision about such a request.  All data is stored and/or processed in a GDPR-compliant manner.

For any queries about my privacy policy or the data I collect or store, just email me at hello@kheffache.com

WEBSITE VISITORS.

The only data involved in your interaction with my website if you simply visit and browse the website, but never actually get in contact through it, are what are known as cookies.  And when a website uses cookies, it must have a Cookie Policy. Here’s mine, and if you fall into this category, you can read it and move on to look at some of my pretty photos.  The rest of my privacy policy only applies if you actually get in touch in some way.

PEOPLE WHO MAKE CONTACT WITH ME

If you make contact with me, that contact, initiated by you, will inevitably provide me with some of your personal data.  It may be as simple as your name and email address. You may give me a phone number. You may tell me a little bit about your wedding, or your family or an event you are planning.  My privacy policy sets out how I use that data, in accordance with GDPR.

How I store and process data from people who make contact with me

  • The data I gather from your contact is used to communicate with you, and to provide you with the information you require. For instance if you enquire about my availability and price for your wedding I will need to know the date of the wedding and the location in order to provide you with a quote. At the enquiry stage, I will never seek additional information beyond your name, email address and a reason for your enquiry – you are free to offer further information as you see fit and I will be careful with that data also. Contact will come from one of 9 places:

    • Website contact form

    • Facebook message

    • Instagram message

    • Twitter direct message

    • Whatsapp message

    • iMessage

    • SMS message

    • Email

    • Phone call

Lawful basis for collecting/storing the data

  • My lawful basis for collecting and storing this data is legitimate interests – i.e. it is in the interest of my business to store the data required to allow me to communicate with you in response to your initial communication. I will only ever contact you back to deal with your enquiry and any follow up. Once we have concluded that discussion, I will never cold call or send you a marketing email about anything that’s not directly to do with your initial enquiry, unless you progress to being a client.

Data retention policy

  • I retain contact details for people who’ve enquired in a number of places based on where the enquiry came from. All prospective clients details are added to a client management system which itself is GDPR-compliant. I log it there to be able to track the performance of by business from year-to-year. The original message may also remain accessible in my Gmail account, or my iCloud/Whatsapp/Facebook/Instagram account, or as a listing in my phone’s call history. All devices that have access to such accounts are password protected and, in the case of my phone, TouchID-protected also. The detail of your enquiry is retained for as long as is necessary to ensure we no longer need to make contact.

Third parties

  • Unless you explicitly sign up for marketing information from me in a GDPR-compliant way, I will NEVER send any prospective clients further marketing material beyond that required to deal with their enquiry. I will not sell or pass on your details to third parties. Only where that data originated from a third party (e.g. Gmail/Facebook/Whatsapp) with a copy of that data reside with the third party in accordance with their privacy policy, which is typically covered under the terms and conditions of that service.


Use of your images

  • Photographs which include people in an identifiable manner are classed as personal data under GDPR. They also, therefore, fall under the remit of this privacy policy. There are four distinct uses of the images beyond the supply of the final product to you.

Online storage of images

  • My client galleries are all stored in pictime. The Pictime account is password protected and a professional-grade service with high end security to protect the images. My galleries are all not searchable and may are unlisted, meaning only those with a direct link (and/or a password) can access them. My lawful basis for storing these images is contractual obligation, and I retain them indefinitely for the client’s benefit. Such a gallery may be shown by me to prospective clients in order to sustain my business, under the lawful basis of legitimate interests.

Blog and social media use of images

  • With the explicit consent of the client (verbal and/or written) as the lawful basis, and in the case of photographs of children, with the consent of the parent/guardian (verbal and/or written secured directly or via the client), I may publish a selection of images from a shoot on my blog, or in my social media feeds. Consent may be conditional on the client previewing the images first if desired, and is not required by the contract (i.e. it will be freely given). Consent can be withdrawn at any stage. Failing a withdrawal of consent, images posted to my blog and/or social media feeds will remain there indefinitely to provide a visual history of my business to prospective clients.

Website portfolio

  • It is necessary for me to show my best images to prospective clients, as well as a consistent and regularly updated sample of my work. My “shop window” for doing this is my website. From time to time, therefore, I will add portfolio images to my website to promote my business. My lawful basis for doing so is legitimate interests, and in choosing which images I post, I will take into consideration the consent (or lack of consent) for blog and social media use, as well as the content of the image itself, in order to fairly balance the rights of those contained in the image against the interests of my business. For commercial clients, or where a confidentiality clause has been agreed with the client, I will adhere to such a clause. Where I wish to post an image from a client who has not explicitly consented to blog and social media use of images, and while relying on legitimate interests as the lawful basis for sharing portfolio images on my website, I will inform the client of my intended use of the image in advance and reasonably consider requests to not proceed with the use. It’s important to distinguish this use case from the blog/social media use case which is under the lawful basis of consent from the client. It is in the interest of my business to be able to show current work of a high standard on my website from a range of recent client shoots. However it is not required that I show all images, or indeed images from all shoots.

Awards programmes

  • In the interest of continual professional development, I frequently enter my best images into awards programmes – including the IPPVA Awards, Fearless Awards and This Is Reportage Awards. My lawful basis for doing so is legitimate interests, and in choosing which images I enter, I will take into consideration the consent (or lack of consent) for blog and social media use, as well as the content of the image itself, in order to fairly balance the rights of those contained in the image against the interests of my business. For commercial clients, or where a confidentiality clause has been agreed with the client, I will adhere to such a clause. Where I wish to enter an image from a client who has not explicitly consented to blog and social media use of images into an awards programme, and while relying on legitimate interests as the lawful basis for doing so, I will inform the client of my intended use of the image in advance and reasonably consider requests to not proceed with the use.

If you previously consented to my use of your images for blog/social media use and wish to withdraw that consent, you can do so by sending me an email with your name and the subject Consent withdrawal to hello@kheffache.com. In both cases I’ll reply to you promptly.

This policy was last updated on 16th January 2022. To receive a PDF copy of this policy email hello@kheffache.com with the subject Privacy Policy PDF request.