PRIVACY NOTICE
Effective: 26 August 2026
Version: 1.0
Epic Photo Co. Limited ("Epic Photo Co.", "we", "us" or "our") provides photography, photo experiences, activations and event services, and takes enquiries and bookings for those services.
This privacy notice explains what personal data we collect, why we use it, how long we keep it, who we share it with and the choices you have.
For the personal data described in this notice, Epic Photo Co. Limited is the data controller.
You can contact us about privacy or your personal data at photos@epic-photo.co or through our website contact page.
Where we operate a photo experience at another organisation's venue or event, that organisation may separately use information or photographs for its own purposes. Where this happens, it acts as a separate data controller and its use of your data is covered by its own privacy notice. Consent given to Epic Photo Co. does not automatically give another organisation permission to use your photograph.
---
If you have your photograph taken
What we may collect
Depending on the experience, we may collect:
- your photograph or video;
- AI-generated or otherwise processed versions of your photograph;
- your email address, where you ask for a digital copy;
- your first name, where you provide it;
- information about your transaction, such as what was purchased, when and where;
- your privacy and marketing consent choices, including when those choices were made and the wording presented to you; and
- information you provide if you contact us for support, for example because a photograph has not arrived.
We do not normally ask photo-experience customers for their home address, telephone number or date of birth.
Why we use this information
Your photograph, email address and name
To create and deliver the photographs or digital content you requested.
Lawful basis: performance of a contract.
Transaction information
To process and account for purchases and answer questions about them.
Lawful basis: legal obligation and legitimate interests.
Your photograph, for Epic Photo Co. marketing
To promote our services, including on our website and social media.
Lawful basis: consent.
Contact information linked to a marketing-consented photograph
To identify the photograph, maintain evidence of the consent that applies to it, and honour a withdrawal request.
Lawful basis: legitimate interests and compliance with our data protection obligations.
Support enquiries
To locate or resend photographs and resolve problems.
Lawful basis: performance of a contract and legitimate interests.
We do not add photo-experience customers to an email marketing list simply because they provide an email address to receive their photographs.
Unless you have separately chosen to receive marketing from us, the email address entered at a photo experience is used to deliver your photographs and deal with any related enquiry.
---
How long we keep photo-experience data
We deliberately keep ordinary guest photographs for a limited period.
Purchased photographs
Photographs that you purchase or request are normally retained for 120 days, after which they are deleted from our active photo systems.
Your name and email address associated solely with those photographs are deleted with them unless we have another lawful reason to retain that information.
Photographs that are not purchased
Photographs that are captured but not purchased or requested are normally retained for 30 days, after which they are deleted from our active photo systems.
Our suppliers and deletion
Our photo experiences use third-party systems to capture, process, transfer and deliver photographs.
We apply our own 30-day and 120-day retention periods rather than relying on the maximum storage periods offered by those suppliers.
Where a supplier requires deletion to be carried out manually, including Snappic, we periodically remove photographs in accordance with our retention schedule.
After deletion from active systems, limited copies may temporarily remain within a supplier's backup, recovery or deletion systems according to that supplier's technical retention cycle. These copies are not used for normal business purposes and are subsequently overwritten or permanently removed.
### Marketing-consented photographs
If you specifically consent to Epic Photo Co. using your photograph for marketing:
- an unpublished photograph may be retained in our marketing library for up to 24 months from the date it was taken;
- if we have not selected or used it during that period, we will delete the marketing copy unless we have refreshed your consent;
- if the photograph has been published, for example on our website, portfolio or social media, that published content may remain live for longer; and
- you can withdraw your consent at any time.
We retain enough information alongside a marketing photograph to identify the consent that applies to it and, where practical, record where that image has been published. This allows us to honour a withdrawal request.
What happens if you withdraw marketing consent
You can withdraw your consent at any time by emailing photos@epic-photo.co.
We will stop using the photograph for future marketing and remove it from our marketing library.
Where the photograph has already been published on a website or social media account that we control, we will also remove it where reasonably possible.
Withdrawal does not make any use of the photograph before your withdrawal unlawful.
We may not be able to retrieve copies that have already been:
- downloaded or shared by another person;
- reposted by another social media user;
- cached or archived by an independent third party; or
- incorporated into physical material that has already been distributed.
Social media platforms and other third-party services may also process published content under their own privacy policies.
---
Group photographs
A photograph may contain more than one identifiable person.
For Epic Photo Co.'s own marketing, we will not rely on one person's consent as permission on behalf of everybody else in a group photograph.
We will only intentionally use a group photograph for consent-based marketing where the identifiable people whose consent is required have given appropriate permission.
If you appear in a photograph used by Epic Photo Co. and would like us to stop using it, you can contact photos@epic-photo.co, even if you were not the person who originally purchased or received the photograph.
Children
We do not knowingly select an identifiable child for Epic Photo Co. marketing on the basis of the child's participation alone.
Where appropriate consent from a parent or guardian is required for marketing use of an identifiable child's photograph, we will obtain that consent before intentionally using the photograph for that purpose.
---
If you enquire about or book our services
This section applies when you contact Epic Photo Co. as a client, prospective client, supplier or other business contact.
What we may collect
We may hold:
- your name;
- email address;
- telephone number;
- company or organisation;
- billing or event address where relevant;
- details of your enquiry or booking;
- contracts, quotes and invoices;
- correspondence relating to the project; and
- payment and transaction information.
Why we use it
We use this information:
- to respond to an enquiry and discuss a potential booking, as steps taken at your request before entering into a contract;
- to provide services you have booked, for the performance of our contract with you;
- to maintain financial and accounting records, where required by law; and
- to resolve disputes, protect our business and prevent fraud, where this is necessary for our legitimate interests.
We do not automatically add somebody to a marketing list simply because they enquire or make a booking.
How long we keep it
Our normal retention periods are:
- enquiries that do not become bookings: 12 months;
- routine booking and project correspondence: normally 2 years after the relevant event or project;
- contracts, invoices, payment and accounting records: normally 6 years, or longer where we are legally required to retain them; and
- records relating to an unresolved complaint, dispute, insurance matter or legal claim: for as long as reasonably required to deal with that matter.
We periodically review retained information and do not keep it simply because it may potentially be useful in future.
---
Who we use to provide our services
We use a number of specialist service providers. Depending on the service you use, these may include:
Photo experiences
Snappic
Used for photo capture, photo-experience functionality and some image processing.
Dropbox
Used within parts of our photo-processing and transfer workflow.
Supabase
Used for databases and photograph storage within our own photo systems.
DigitalOcean
Used for server infrastructure and photograph processing.
Postmark
Used to send transactional emails containing or linking to photographs.
Netlify
Used to host parts of our photo-experience web applications.
### Website, enquiries and bookings
Squarespace
Used to provide parts of our website.
BoothBook
Used for enquiries, bookings and customer administration for relevant services.
Google Analytics
Used to help us understand how our website is used, where permitted.
Stripe, Square and PayPal
Used for payment processing where applicable.
These suppliers process personal data only where required to provide their services to us and are subject to their own contractual and data protection obligations.
Where we operate a retail photo experience for a venue or event organiser, we may provide that organisation with limited transaction information where necessary to reconcile sales or payments.
We do not sell personal data.
We may disclose personal information where we are legally required to do so, or where reasonably necessary to protect our rights, property, systems or the safety of another person.
---
International data transfers
Some of the technology suppliers we use may process personal data outside the United Kingdom, including in the United States.
Where UK personal data is transferred internationally, we use the safeguards required by UK data protection law. Depending on the recipient and destination, these may include:
- a UK adequacy regulation;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved standard contractual clauses; or
- another transfer mechanism permitted under UK data protection law.
We aim to keep the primary storage and processing of guest photographs within UK-hosted infrastructure where reasonably practicable, although photographs may pass through other service providers as part of the capture, transfer or delivery process.
---
Your data protection rights
Depending on the circumstances, UK data protection law gives you rights including the right to:
- ask what personal data we hold about you;
- receive a copy of that information;
- correct inaccurate information;
- ask us to delete information;
- restrict how information is used;
- object to certain types of processing;
- receive certain information in a portable format; and
- withdraw consent where we rely on consent.
Not every right applies in every situation, but you are always welcome to contact us.
Email photos@epic-photo.co to make a request.
We normally respond to data protection requests within one month.
If your request relates to a photograph, providing information such as the approximate date, event or venue may help us find it more quickly.
If another organisation separately controls its own copy of your photograph, withdrawing consent from Epic Photo Co. does not automatically withdraw consent from that organisation. You will need to contact them separately.
---
Complaints
If you are unhappy with how we have used your personal data, please contact us at photos@epic-photo.co.
You also have the right to complain to the UK data protection regulator:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
You do not have to contact us before making a complaint to the ICO.
---
Cookies and website analytics
Our website uses cookies and similar technologies that are necessary for parts of the website to operate, remember settings and maintain security.
We may also use analytics services such as Google Analytics to understand how people use our website.
Where the law requires your consent before a non-essential cookie or similar technology is used, we will ask for that consent through our website cookie controls.
You can also control cookies through your browser settings.
Our photo-delivery and customer-service systems are designed to minimise unnecessary tracking. We do not use the email address supplied solely for photograph delivery to build an advertising profile.
---
Security
We take reasonable technical and organisational measures to protect personal data.
These include measures such as:
- encryption of data in transit;
- encryption at rest where supported by the relevant system;
- restricting administrative access to people who need it;
- authentication controls;
- access logging within relevant systems; and
- defined retention and deletion processes.
No internet-connected system can be guaranteed to be completely secure, but we regularly consider the information we hold, why we hold it and who needs access to it.
---
Changes to this privacy notice
We may update this privacy notice when our services, technology providers or data-handling practices change.
The effective date and version number at the top of this page will be updated when we make changes.
Where a change would materially affect how we rely on an existing consent, we will consider whether fresh consent is required rather than assuming that an earlier consent covers the new use.
---
Contact us
For questions about this privacy notice or to exercise your data protection rights:
Epic Photo Co. Limited
Email: photos@epic-photo.co
You can also contact us through the contact page at epic-photo.co.