Data Processing Agreement

Last updated: May 23, 2018

This Data Processing Agreement ("DPA") sets out how Academy Photos Ltd ("Processor", "us", "we", or "our") processes pupil data on behalf of the School ("Controller") when delivering school photography services.

By booking or engaging Academy Photos, the School agrees to the terms of this DPA.

Purpose of Processing

The School engages Academy Photos to take pupil photographs and provide the following:

  • Proof images for parents/carers to view and purchase.

  • A digital photograph of each pupil for use in the School's MIS (e.g., SIMS, Arbor) and internal administration.

The School remains the data controller for all pupil images provided for administrative/MIS use. Academy Photos acts as a data processor when handling images on the School's behalf.

Types of Data Processed

  • Pupil photographs

  • Pupil names, class details or ID numbers (where supplied)

  • Parent/carer contact details if orders are placed

No special category data is intentionally processed.

How Data Is Used

For the School:

  • Capture and supply individual pupil photographs for MIS records;

  • Provide class photographs where applicable;

  • Store and handle image files securely according to the School's instructions.

For Parents:

  • Provide proof images for viewing through the online ordering system;

  • Process orders and deliver purchased products.

Processing for school administrative purposes and processing for parental sales are kept separate.

Lawful Basis

  • The School relies on Public Task for processing MIS/admin photographs.

  • Academy Photos relies on Legitimate Interests to provide proofs and fulfil parent orders.

Consent is not required unless the School applies its own consent policy.

Processor Obligations (Academy Photos)

Academy Photos agrees to:

  • Process personal data only on documented instructions from the School;

  • Use appropriate security measures (e.g., encryption, restricted access, secure storage);

  • Ensure staff are trained in data protection and confidentiality;

  • Assist the School with data subject requests where relevant;

  • Notify the School without undue delay in the event of a data breach involving pupil images;

  • Not transfer data outside the UK without appropriate safeguards;

  • Not appoint sub-processors without informing the School (current sub-processors: secure hosting and payment processors-details available on request).

School Responsibilities

The School agrees to:

  • Provide accurate pupil information where required;

  • Inform parents that pupil photographs will be taken and used for administrative purposes;

  • Advise Academy Photos of any pupils who must not be photographed;

  • Ensure the School's privacy notice and lawful basis cover MIS and administrative use of pupil images.

Data Retention

  • MIS images: Retained only as long as required to deliver the service, then securely deleted.

  • Parent ordering images: Retained according to Academy Photos' retention policy unless otherwise instructed by the School.

Data Deletion or Return

Upon request, Academy Photos will:

  • Delete or return MIS images;

  • Remove proofs from the ordering system (unless doing so affects an active order or legal obligation).

Termination

This DPA remains in effect while the School uses Academy Photos' services. Either party may terminate with written notice.

Upon termination:

  • School MIS Images
    All digital images supplied for MIS/admin use will be securely deleted or returned, per the School's instructions.

  • Parent Ordering / Commercial Images
    Proof images and photographs used for parental ordering will continue to be stored and processed under Academy Photos' legitimate interests and retention policy, unless a parent exercises their rights or deletion conflicts with fulfilment or legal requirements.

Ending the relationship with the School does not affect parents' access to proofs or completion of outstanding orders.

Acceptance

By booking a photography session or otherwise engaging Academy Photos, the School confirms it has read and agrees to this Data Processing Agreement.