This notice explains how the UK School Photography Association (UKSPA) uses personal information when you use this website, create an account, answer our questionnaire or add your business details. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
UKSPA is a community for people working in school photography in the United Kingdom. It is at its founding stage and is run by its founding group as an unincorporated association; a Community Interest Company is the proposed future structure. UKSPA is the "controller" of your information, which means we decide how it is used and are responsible for looking after it.
Contact us about anything in this notice, or to use any of your rights, at info@ukspa.org or through the contact page.
We count how many times each resource is opened, but we do not record who opened it. We do not collect payment details. The site does not hold pupil images or information about pupils or schools, and we ask you not to include any in what you write.
UK data protection law requires a "lawful basis" for each use of personal information. Ours are:
| What we do | Lawful basis |
|---|---|
| Create and run your account, give you access to the Resource Centre and event details, and send service emails (confirming your email address, resetting your password, updates about your directory listing) | Contract: providing the service you asked for |
| Look at questionnaire answers to decide what UKSPA should work on | Legitimate interests: understanding what our community needs. Every question is optional |
| Keep the site secure: protecting forms from automated abuse, limiting repeated login attempts, keeping login records and a record of staff actions | Legitimate interests: protecting members and their information |
| Check business details before they are listed in a directory | Legitimate interests: keeping the directories accurate and suitable |
| List your business in a UKSPA directory | Consent: only if you tick the box and submit it. You can withdraw at any time |
| Send you UKSPA news | Consent: only if you ask for it. Creating an account does not sign you up |
| Respond to requests to use your rights, and keep the records needed to show we did | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your interests and rights, and you can object (see "Your rights").
UKSPA is preparing two directories: one the public can search to find school photographers, and one that only members can see, listing businesses that supply school photographers. Your business is listed only if you submit it and agree to it being listed, and UKSPA staff have checked and approved it. A photography business's listing will be visible to anyone; a supplier's listing will be visible to logged-in members. Only the business details you entered are shown. Your login email address is never shown. You can change or withdraw your listing at any time from your business page; changes are checked again before they appear.
When we report what we have learned from the questionnaire, we use combined multiple-choice totals only: no names, nothing anyone typed, and no figure for a group smaller than 5 people.
We do not sell your information or give it to suppliers or advertisers. These service providers process it on our behalf, under contracts that require them to protect it:
The site's fonts and images are served from the site itself. There are no analytics, advertising or tracking services. We would share information with others only if the law required us to.
The database and uploaded files are stored in Cloudflare's Western Europe region. Cloudflare is a US company and may process some information in other countries, for example to deliver email or protect the site. Where information leaves the UK, it is protected by the safeguards UK law requires, such as UK adequacy regulations or the UK International Data Transfer Addendum to standard contractual clauses.
Information is sent over encrypted (HTTPS) connections. Passwords are stored only in hashed form. Staff accounts must use two-step verification, each staff role can reach only what it needs, and staff actions are recorded. The site limits repeated login attempts and protects its forms from automated abuse. Uploaded files are stored under random names and served only to the people allowed to see them.
Under UK data protection law you have the right to:
Many of these you can do yourself: change your name and email preference, update your questionnaire answers, change or withdraw your business listing, or request deletion from your account page and your business page. For anything else, contact info@ukspa.org. There is no charge, and we will reply within one month (we may extend this by up to two more months for complex requests, and will tell you if so). We may need to confirm your identity first.
We do not make decisions about you by purely automated means.
If you are unhappy with how we have handled your information, please tell us so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
UKSPA is for adults working in or with school photography. The site is not intended for anyone under 18.
We use one cookie to keep you logged in, which is strictly necessary for the site to work and is removed when you log out or your session ends. Cloudflare Turnstile, which protects our forms, may set its own strictly necessary cookie. We do not use advertising, analytics or tracking cookies, so we do not ask you to accept any.
If we change how we use your information, we will update this notice and the date below. If a change is significant, we will tell members by email.
Last updated: 21 October 2026.