1. Introduction

Sandhurst Digital Studios Ltd ("Sandhurst Digital Studios", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share your personal information when you enquire about or purchase our products and services, including bespoke photo albums, digital portfolios and related products and services, and when you apply for or enquire about finance to fund a purchase.

For the purposes of UK data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Sandhurst Digital Studios Ltd is a data controller in respect of the personal information that we determine how and why to process.

Where you apply for finance through a third-party lender or finance provider, that organisation will normally also act as a separate data controller for the information it receives. You should therefore read the finance provider's own privacy notice before submitting an application.

2. Information We May Collect

Depending on your dealings with us, we may collect and process the following categories of information:

Identity and contact information: your name, title, date of birth where required, postal address, previous addresses where necessary, telephone number and email address.

Order and transaction information: order number, products and services purchased, album specifications, photographs or digital images supplied to us, payment information, deposits, outstanding balances, refunds and transaction history.

Finance application information: where you choose to apply for finance, this may include your date of birth, residential status, address history, employment or occupational information, income and expenditure information, bank or payment information, the amount you wish to finance and information necessary to process your finance application.

Identity and verification information: information or documents required to confirm your identity, prevent fraud or comply with legal or regulatory obligations.

Communications: records of telephone calls where recorded, emails, messages, enquiries, complaints and other correspondence with us.

Technical information: where you use our website or online services, we may collect information such as your IP address, browser/device information, cookies and information about how you use our website.

We will only collect information that is reasonably necessary for the relevant purpose.

3. How We Use Your Personal Information

We may use your personal information to respond to enquiries and provide quotations; set up and administer your customer account; process and fulfil orders; design, manufacture and deliver albums, digital portfolios and other products; take and administer payments; provide customer service and after-sales support; administer cancellations, refunds and complaints; establish, exercise or defend legal claims; prevent and detect fraud or other unlawful activity; maintain appropriate business, accounting and regulatory records; comply with our legal and regulatory obligations; provide information about finance options; introduce you to a finance provider where requested; submit information required for a finance quotation or application; communicate regarding the progress or outcome of a finance application; and send marketing communications where we have an appropriate lawful basis to do so.

4. Finance Applications

Where we make finance available to customers, Sandhurst Digital Studios Ltd may act as a credit broker and not as a lender.

If you choose to apply for finance, we may collect the information required to process your application and pass relevant information to the lender or finance provider with whom we work.

The finance provider may use your information to verify your identity; assess your eligibility for finance; assess affordability and creditworthiness; prevent and detect fraud and financial crime; conduct credit reference or other searches; decide whether to offer finance and on what terms; administer a finance agreement; and meet its legal and regulatory obligations.

The finance provider may obtain additional information about you from credit reference agencies, fraud-prevention agencies and other permitted sources. Submitting an enquiry about finance does not guarantee that finance will be available or approved.

Before a finance application is submitted, you should be provided with or given access to the relevant finance provider's privacy notice explaining how that provider will process your information.

5. Credit Reference and Fraud-Prevention Agencies

Where applicable to the finance product you select, a lender or finance provider may share information concerning your application with credit reference agencies ("CRAs") and/or fraud-prevention agencies.

A CRA search may leave a record on your credit file. The nature and effect of any search will depend on the finance provider and the type of search undertaken. Information supplied to CRAs may be used by other organisations when assessing applications for credit or other products and for identity verification, fraud prevention, tracing and debt recovery.

The relevant lender or finance provider's privacy notice should identify the agencies it uses and provide further information about this processing.

6. Automated Decision-Making

A finance provider may use automated systems when assessing a finance application, including credit scoring. Where automated decision-making applies, the finance provider's privacy notice should explain how this works, the significance and possible consequences of the processing, and any rights you may have to request human intervention or challenge a decision.

Sandhurst Digital Studios Ltd will not state that automated decision-making takes place unless this has been confirmed by the relevant finance provider.

7. Our Lawful Bases for Processing

Depending on the circumstances, we may process personal information on the following lawful bases: contract, where processing is necessary to take steps at your request before entering into a contract or to perform our contract with you; legal obligation, where processing is necessary to comply with applicable law; legitimate interests, where processing is necessary for our legitimate business interests or those of another organisation and those interests are not overridden by your rights; and consent, where the law requires your consent.

Where processing is based on consent, you may withdraw your consent at any time. The precise lawful basis for finance-related processing will depend on Sandhurst Digital Studios Ltd's role and arrangements with its finance provider.

8. Who We Share Personal Information With

Where necessary and lawful, we may share information with our employees and authorised representatives; album manufacturers, printers and fulfilment providers; delivery and courier companies; IT, website, cloud-storage and communications providers; payment processors; accountants, auditors, professional advisers and insurers; finance providers and lenders where you request finance; credit intermediaries where applicable; fraud-prevention or identity-verification providers where applicable; regulators, courts, law-enforcement authorities and other public bodies where legally required; and prospective purchasers or professional advisers in connection with a legitimate sale or restructuring of our business.

We do not sell your personal information and will not provide it to unrelated third parties for their own marketing purposes unless we have a lawful basis to do so.

9. Photographs and Digital Images

As part of providing our photographic products and services, we may receive, store and process photographs and digital images supplied by you or created in connection with your order. We use these materials primarily to fulfil your order and provide the products and services you have requested.

Where external printing, album-production, cloud-storage or fulfilment providers are required to complete your order, relevant images may be securely transferred to those providers. We will not use customer photographs for unrelated advertising or promotional purposes unless we have an appropriate legal basis and, where required, permission to do so.

10. International Transfers

Some of our technology or service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will take appropriate steps required by applicable data protection legislation to ensure that it receives an appropriate level of protection.

11. How Long We Keep Your Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, tax, contractual and regulatory requirements. Different categories of information may therefore have different retention periods.

Finance-related records will be retained for the period required by applicable regulatory requirements and our arrangements with the relevant finance provider. When information is no longer required, we will delete it securely or anonymise it where appropriate.

12. Security

We take appropriate organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access. Access is restricted to employees, contractors and service providers who require it for legitimate business purposes and who are subject to appropriate confidentiality and security requirements.

No method of electronic transmission or storage is completely secure, but we take reasonable measures appropriate to the nature and sensitivity of the information we process.

13. Your Data Protection Rights

Subject to applicable law and any relevant exemptions, you may have the right to request access to personal information we hold about you; request correction of inaccurate or incomplete information; request deletion; request restriction of processing; object to certain processing; receive certain information in a portable format; withdraw consent where we rely upon consent; and exercise rights relating to certain forms of automated decision-making.

You will not normally have to pay a fee to exercise your rights, although the law permits fees or refusal in certain circumstances. We may need to verify your identity before responding to a request.

Where your request concerns information controlled by a finance provider, credit reference agency or other independent organisation, you may need to exercise your rights directly with that organisation.

14. Marketing

We may contact you about our products and services where permitted by law. Where consent is required, we will obtain it before sending marketing communications. You can ask us to stop sending direct marketing at any time by contacting us or using an unsubscribe facility provided in an electronic marketing communication.

Stopping marketing communications will not prevent us from contacting you about an existing order, finance application, complaint or other service-related matter.

15. Cookies

If our website uses cookies or similar technologies, we will provide information explaining what cookies we use and their purposes. Where consent is legally required for non-essential cookies, those cookies will not be used until the appropriate consent has been obtained.

16. Complaints

If you have concerns about how we use your personal information, please contact us first so that we have an opportunity to investigate. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator. Making a complaint to us does not affect your right to complain to the ICO.

17. Contact Us

For questions about this Privacy Policy, to exercise your data protection rights, or to raise a privacy concern, please contact:

Sandhurst Digital Studios Ltd
Company Registration Number: 11664348
Registered/Business Address: Lower floor, Kirkman house, 12-14 Whitfield street, London, W1T 2RF

Finance is provided through Buyline ltd, B12 Elmbridge Court, Cheltenham Road East, Gloucester, GL3 1JZ
Company Registration No: 11223350. Authorised and regulated by the Financial Conduct Authority FRN: 805162

18. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our business, finance arrangements, service providers or legal and regulatory requirements. The latest version will be made available to customers and, where applicable, published on our website.