Privacy Notice
This explains what happens to your personal data when you open a gallery, book a session, or buy photographs from HR Images.
Who is responsible for your data
HR Images decides what happens to your data and is responsible for it. In data protection terms, they are the controller.
How to reach them: reply to the message that sent you your gallery, and it will reach them. If you cannot, write to privacy@xposureapp.net and we will pass your request on.
The galleries and booking tools are run on their behalf by Xposure, which stores the data and does nothing else with it. Xposure is the processor. What that means in practice, including where the servers are and who else is involved, is in the Xposure privacy policy.
What is collected
Depending on what you do, some or all of the following:
- When you open a gallery. Your IP address, which photographs you viewed or downloaded, and when. This keeps a private gallery private, keeps automated traffic out, and tells HR Images how their gallery is being used. If you give your name or email in the gallery, HR Images sees your visits, favourites, notes, downloads and purchases under that name. Visits and downloads are kept for 90 days.
- If a gallery asks for your email. Some galleries let guests in with their name and email address, and HR Images sees who opened the gallery. You can tick a box to hear from HR Images. Only guests who tick it are on their mailing list, with the date and the wording they agreed to.
- The photographs themselves. Pictures of you are personal data, and they were taken and uploaded by HR Images under whatever you agreed with them.
- If you write through the contact form. Your name, email address, your message, and the package you asked about if you picked one. HR Images can add their own notes and track the conversation from first message to booking. If you got in touch another way, HR Images can add your enquiry by hand, with your phone number or your Instagram or WhatsApp handle.
- Your client record. HR Images keeps one record per client with your bookings and what came with them. They can add a photo of you and your contact handles, such as Instagram or WhatsApp, as well as your address and their own notes and tags.
- If you book a session. Your name, email address, phone number if you give one, and the details of the booking. You can return to your bookings through a sign in link sent to your email, without a password.
- If you sign a contract. The exact wording you agreed to, your typed signature, and a record of the time, your IP address, and basic device information. That record exists so the signature can be shown to be yours later.
- If you pay. Payments are handled by Stripe, which collects your card details directly. HR Images and Xposure never see your card number. Stripe receives your name and email address so it can process the payment, and where VAT is added to your purchase, your billing country, postal code and any VAT number you enter, so the right VAT is charged.
Why, and for how long
Your data is used to deliver your photographs, to arrange and fulfil what you booked, and to keep the gallery secure. Where you have a contract with HR Images, that contract is the basis for it; where there is no contract, the basis is their legitimate interest in running their photography business and delivering your work. News and offers by email are based on your consent, and only go to guests who ticked the box.
It is kept for as long as HR Images needs it for your commission, and then deleted. Invoices and signed contracts are held for seven years, because accounting law requires that, and technical access logs are kept for up to 12 months. An enquiry that never led to a client record or a booking is deleted 12 months after it last changed. Your data is not sold, and it is not used for advertising.
Your rights
You can ask HR Images for a copy of what they hold about you, ask them to correct it, ask them to delete it, object to how it is used, or ask for it in a portable format. Requests to delete can be limited by the retention rules above, where the law requires a record to be kept.
To leave a mailing list you joined from a gallery, use the unsubscribe link in HR Images's emails, or ask HR Images, who removes you from the list.
Ask HR Images first, using the contact details at the top, since they are the ones who decide. If you cannot reach them, write to privacy@xposureapp.net.
If you are in the EU and you think your data has been mishandled, you can complain to your national data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données, dataprotectionauthority.be.
About this notice
Xposure generates this page for HR Images from the business details in their account, so that anyone receiving a gallery has a notice to read. It describes how the Xposure platform handles data on their behalf. If HR Images publishes a privacy policy of their own, that one applies and their galleries link to it instead of here.