Privacy Policy

Back to Legal Policies


This privacy policy (“Privacy Policy”) applies to personal data that we collect from you as a customer (“you” or “your”).
It provides information on what data we collect, why we collect the data, how it is used and the lawful basis on which your personal data is processed, and what your rights are under the applicable data protection and privacy laws, including the General Data Protection Regulation (“GDPR”).

1. Who are we?

We are RKAB Works, 11 Balmuir Avenue, Bathgate, West Lothian, Scotland EH48 4BW. We are the data controller responsible for your personal data.

2. What do we collect?

We collect and process the following information provided by you in the course of your initial enquiry and the formation, operation and conclusion of our contract for photography services:

In providing our services we create photographs which may identify you, your family members and other participants and that may be considered personal data. Our photographs may be produced in print and digital format. You are responsible for ensuring that all participants in a photography session have been provided with a copy of this privacy policy.

Personal data will be processed in order to perform our contract with you, fulfil legal obligations and for legitimate interests, as described below.

3. How we use your personal information

We use your personal information in the following ways:

We may use your personal data for other reasons compatible with the purposes of the data processing outlined in this Privacy Policy. There may be other occasions where personal data is processed for unrelated purposes which will be explained at that time upon notice to you. If required, we will ask for your consent to any such further processing.

As used in this Privacy Policy, “legitimate interests” means our interests in conducting and managing our business and fulfilling our obligations under our contract with you. This Privacy Notice describes when we process personal data for those legitimate interests, what these interests are and your rights. When we process your personal data for our legitimate interests, we make sure to consider and balance any potential impact on you, and your rights under data protection laws. Our legitimate interests do not automatically override your interests. We will not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or those activities are otherwise required or permitted to by law. You have the right to object at any time to processing of your personal data that is based on our legitimate interests, on grounds relating to your particular situation (for more information on your rights, please see “Your Data Protection Rights” section below).

You acknowledge and agree that where provision of personal data is necessary to ensure compliance with legal obligations or to perform our contract with you, failure to provide relevant personal data for the abovementioned purposes may prevent us providing our goods and services to you.

4. Disclosure of your information

We share your personal data with third parties in the following situations:

5. Payment information

Any credit/debit card payments and other payments you make will be processed by our third party payment providers and the payment data you submit will be securely stored and encrypted by our payment service providers using up to date industry standards. Please note that we do not ourselves directly process or store the debit/credit card data that you submit.

We store and use this card or payment information for the purpose of processing any future payments that you make for additional goods and services. We will store this data in accordance with our legal obligations under applicable law and only for so long as legally permitted.

You may choose to opt out of us holding your card or payment data although this means that you will need to re-supply us with card/payment details for the purpose of making any future purchases.

6. Data transfers

Your personal data will be transferred to and stored in countries other than the country in which the information was originally collected, including the United States and other destinations outside the European Economic Area (“EEA”) to our service providers for the purposes described above.

Please note that the countries concerned may not provide the same legal standards for protection of your personal data that you have in the United Kingdom or EEA. Where we transfer your personal data to countries outside of the EEA we will take all steps to ensure that your personal data continue to be protected. We will implement appropriate safeguards for the transfer of personal data to our service providers in accordance with the applicable law, such as relying on our service providers’ Privacy Shield certification or implementing standard contractual clauses for data transfers. If you would like to receive more information on the safeguards that we implement, including copies of relevant data transfer contracts, please contact us as indicated below.

7. Data retention

Personal data will not be held for longer than necessary with regard to the purposes of the data processing outlined in this Privacy Policy, subject to any retention periods provided by applicable laws and regulations. We apply criteria to determine the appropriate periods for retaining personal data depending on its purpose, nature, and sensitivity and any retention periods provided by applicable laws and regulations. For example, we retain your personal data for up to 30 years after your photography session and we retain digital files of your photographs for 10 years. When you consent to receive marketing communications, we will keep your data until you unsubscribe. Upon expiry of the applicable retention period we will securely destroy your personal data in accordance with applicable laws and regulations.

8. Your data protection rights

Certain applicable data protection laws give you specific rights in relation to your personal data. In particular, you have the following rights in relation to your personal data:

If you wish to exercise any of these rights please contact us as described in the “Contact” section below. We may also need to ask you for further information to verify your identity before we can respond to any request.

9. Contact

Questions, comments or requests regarding this Privacy Policy should be addressed to Richard Barron RKAB Works, 11 Balmuir Avenue, Bathgate, West Lothian, Scotland EH48 4BW.