Privacy notice

Who is responsible for your information

UKSPA (the UK School Photography Association) is a community for people working in school photography in the United Kingdom. It is at its founding stage and is not yet a legal organisation: it has not been incorporated, and a Community Interest Company is only a proposed structure.

To be confirmed: who acts as the "controller" of your information, meaning the person or organisation legally responsible for it. Until that is settled, this test version of the site is run by UKSPA's founding group and hosted, temporarily, on a Cloudflare account belonging to the developer who built it.

Contact: info@ukschoolphotographersassociation.co.uk or the contact page. To be confirmed: who monitors this mailbox. Messages sent through the contact page are stored in the site's administration area, where UKSPA administrators read them.

What we collect

• Your account: first and last name, email address, and a password. The password is stored only in a scrambled (hashed) form that nobody can read. We also record when you registered, confirmed your email and submitted the questionnaire.
• Your news-email choice: whether you asked for occasional UKSPA news, and when.
• Questionnaire answers (all optional): the name of your business or organisation if you give one, your role, how long you have worked in school photography, roughly how many schools you work with, your main region, and anything you write about your challenges and what would help. Please do not include information about pupils or schools.
• Login sessions: for each device you log in on, the internet (IP) address and browser type, used to keep your account secure.
• Messages: anything you send through the contact form, and account deletion requests.
• If you are an administrator: the two-step verification set-up for your account, and a record of administrative actions you take (see below).

We count how many times each resource is opened, but we do not record who opened it. We do not collect payment details, and the site does not hold pupil images or pupil information.

Why we use it

• To provide your account and, once you have confirmed your email and submitted the questionnaire, access to the Resource Centre and event details.
• To decide what UKSPA should work on, by looking at questionnaire answers as combined totals.
• To keep the site secure, prevent abuse and deal with problems.
• To send service emails such as confirming your email address or resetting your password.
• To send UKSPA news, only if you asked for it. Creating an account does not sign you up, and you can turn it off on your account page at any time without affecting your account.

To be confirmed: the lawful basis for each of these under UK data protection law (for example, providing a service you asked for, legitimate interests, or consent for news emails).

Who sees your questionnaire answers

Your answers are stored separately from your account details, linked to your account so that you can update them. Only UKSPA administrators can see individual answers. They are never shown to other members or given to suppliers. When we report what we have learned, we use combined multiple-choice totals only: no names, nothing anyone typed, and no figure for a group smaller than 5 people.

Services that process information for us

We do not sell your information or pass it to suppliers or advertisers. The site uses these services:

• Cloudflare runs the website (Cloudflare Workers), stores the database (Cloudflare D1) and uploaded files (Cloudflare R2), and provides the check that protects our forms from automated abuse (Cloudflare Turnstile), which looks at information about your browser and device. The database and files are held in Cloudflare's Western Europe region; Cloudflare, a US company, may process some information in other countries. Cloudflare also keeps short-term technical logs (see below).
• Email: service emails are intended to be sent through Cloudflare's email service. To be confirmed: this is not switched on yet, and the sending domain has not been chosen.
• YouTube or Vimeo: if a webinar recording is on one of these, it plays inside the page only when a member opens it. The video service then receives your IP address and browser details under its own privacy policy. YouTube recordings use YouTube's reduced-cookie ("no-cookie") player.

The site's fonts and images are served from the site itself. There are no analytics, advertising or tracking services.

We would also share information if the law required us to.

How long we keep it

• Your account, profile and questionnaire answers: while your account is open. When an account is deleted, its questionnaire answers are deleted with it; we do not keep them in any form.
• Accounts whose email address is never confirmed: deleted automatically after 30 days.
• Login sessions (IP address and browser): deleted the day after the session ends. Sessions end when you log out or after 14 days without use.
• Security counters used to slow down repeated attempts: deleted after one day. Some are stored as one-way codes; others hold your IP address for that day.
• Contact messages and deletion requests: up to 24 months, or until the account they relate to is deleted, whichever is sooner.
• Records of administrator actions (which administrator did what, and to which record): 12 months. They hold account identifiers, not names or answers.
• Resource open counts: 24 months. These are not linked to anyone.
• Backups: Cloudflare keeps an automatic recovery history of the database, so deleted information can remain there for up to 30 days before it is gone for good. Administrators can also make a full copy of the database as a backup; any copy is kept securely and deleted when no longer needed. To be confirmed: where such copies are kept, and for how long.
• Cloudflare's technical logs: error messages from the site are kept by Cloudflare for up to 7 days. The site does not keep a log of every request.

Cookies

We use only the cookie needed to keep you logged in, and the anti-abuse check on our forms. We do not use advertising or tracking cookies.

Your rights

You can ask for a copy of your information, have it corrected or deleted, object to or restrict how we use it, and withdraw consent to news emails. You can change your name and email preference, and request deletion, on your account page, or contact us about any of these. Turning off news emails is separate from deleting your account: you can do one without the other. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk.

Last updated: October 2026.