1. Introduction

This Privacy Policy explains how “Peanut Butter & Telly” (“we”, “us”, “our”) collects, uses, stores, and protects personal data when providing photography/videography services and when you use our website, photo galleries, or online shop.

We are committed to protecting your privacy and complying with the UK GDPR and EU GDPR.

For any questions, use our Contact Form.

2. Data Collection

We collect personal data only when necessary to deliver our services:

• - Order information - name, email address, billing details, product selections, and shipping information.

• - Performer media - photos and videos captured during performances.

• - Performer names - supplied by dance/theatre schools for creating titles & end credits

• - Communication data - emails or messages sent to us.

• - User‑generated content — likes, comments, and downloads within photos galleries.

Data Collected by Zenfolio (Our Hosting Provider)

Zenfolio automatically collects certain technical data when you visit our website or galleries, including:

• - IP addressbrowser type

• - device information

• - pages visited

• - cookie preferences

• - access logs

3. How We Use Your Data

We use your personal data to:

• - produce, edit, and deliver photos and videos

• - fulfil physical and digital orders

• - prepare shipping labels

• - contact you about your order or delivery

• - secure access to galleries and downloads

• - improve our website and services

• - comply with legal and tax obligations

We do not sell your data.

4. Legal Basis for Processing

We process personal data under the following lawful bases:

Contract - processing orders, delivering products, and communicating about products and purchases.

Consent - marketing email opt‑ins; cookie preferences.

Legitimate interests - securely hosting galleries and improving services.

Legal obligation - maintaining financial records and complying with GDPR.

5. Hosting, Galleries & Website Functionality

Our website, photo galleries, and online shop are hosted by Zenfolio, a US‑based company acting as our data processor.

Zenfolio may process visitor data, including:

• - IP addresses

• - cookies

• - order information

• - gallery access details

• - email addresses used for CRM tools

Zenfolio uses Standard Contractual Clauses (SCCs) for international transfers to the United States.

Zenfolio provides a cookie banner that allows visitors to manage cookie preferences, including opt‑in for non‑essential cookies.

6. Order Processing & Data Storage (Google Drive)

Order information may be exported from Zenfolio and stored securely in Google Drive, which acts as our data processor.

Google may process data outside the UK/EU under Standard Contractual Clauses.

We use this data to:

• - create products

• - prepare shipping labels

• - track fulfilment

• - maintain accounting records

7. Physical Product Fulfilment (One Vision Imaging & nphoto)

For physical photo orders, we share the minimum necessary customer information (such as name, product details, and shipping address) with our fulfilment partners:

• - One Vision Imaging (UK)

• - nphoto (EU)

These companies act as data processors and use this information solely to produce and ship your order.

8. Payment Processing (Stripe & PayPal)

Payments are processed securely by Stripe or PayPal.

These companies act as independent data controllers for payment information.

We do not store or have access to your full payment card details.

We only receive transaction details necessary to confirm your order (such as name, email, and payment confirmation).

9. Order‑Related Communication

We may contact you directly by email regarding:

• - your order

• - delivery updates

• - product issues

• - customer support

These communications are necessary to fulfil your purchase and are not marketing emails.

10. Marketing Emails

We may use Zenfolio’s CRM tools to send marketing emails to customers who have explicitly opted in.

You will only receive marketing emails if:

• - you have given consent, or

• - you purchased similar products and were offered an opt‑out at the time of purchase

• - You can unsubscribe at any time using the link in any marketing email.

11. Performer Photos & Videos

We capture photos and videos during performances for the purpose of creating media that individuals may purchase.

Access Control

Media is delivered through:

• - password‑protected galleries

• - unique download links

• - secure payment gateways

12. Performer Photos & Videos (Controller/Processor Relationship)

We capture photos and videos during dance and theatre performances under the instruction of the dance/theatre school, or other organisation running the event.

The dance/theatre school acts as the data controller for performer media and is responsible for obtaining any necessary permissions or parental consent.

We do not collect consent forms directly from performers or parents.

We rely on the dance/theatre school’s policies, consent procedures, and lawful basis for allowing photography and videography at their events.

We act as a data processor when capturing and preparing media on behalf of the dance school.

We act as a data controller only for the products we make available for purchase (such as prints, downloads, or physical media), and we process customer order information solely for fulfilment and delivery.

Access to media is provided through secure galleries and download systems hosted by Zenfolio and Google.

13. International Data Transfers

Some processors (such as Zenfolio and Google) may transfer data outside the UK/EU.

We ensure appropriate safeguards such as:

• - Standard Contractual Clauses (SCCs)

• - Adequacy decisions

• - Additional security measures

14. Your GDPR Rights

You have the right to:

• - access your personal data

• -request corrections

• - request deletion (“right to be forgotten”)

• - restrict processing

• - object to processing

• - request data portability

• - withdraw consent at any time

15. Cookies

Our website uses Zenfolio’s cookie management system, which allows visitors to choose which cookies are permitted.

Cookies may be used to:

• - improve website functionality

• - analyse usage

• - secure gallery access

• - remember preferences

16. Retention Periods

• - Order information: 6 years (legal requirement)

• - Media files: retained until galleries expire or deletion is requested

• - Technical data: short‑term retention for analytics

• - Email communication: retained as necessary for customer support and legal compliance

17. Data Processing Addendum (DPA) Summary

We work with several third‑party service providers (“processors”) who handle personal data on our behalf. Under the UK GDPR and EU GDPR, each processor must operate under a valid Data Processing Addendum (DPA) or equivalent contractual safeguards. This section summarises how we ensure compliance.

Our Responsibilities as Data Controller

We act as the data controller for all personal data collected through our website, galleries, online shop, and order‑fulfilment workflows.

We ensure that:

• - each processor only handles data necessary for their service

• - each processor acts solely on our instructions

• - each processor provides adequate security measures

• - international transfers are protected by legally recognised safeguards

• - DPAs or equivalent agreements are in place where required

Zenfolio (Website, Galleries, CRM)

Zenfolio acts as our hosting and gallery provider and processes customer data (including order information, gallery access, and CRM email delivery).

Zenfolio provides a GDPR‑compliant DPA and uses Standard Contractual Clauses (SCCs) for transfers to the United States. (View Zenfolio's Privacy Policy and Data Processing Agreement).

Google (Cloud Storage)

Order information exported to Google Drive is processed under Google’s GDPR‑compliant terms. (Google Privacy Policy).

Google uses SCCs and other recognised safeguards for international transfers.

One Vision Imaging & nphoto (Physical Product Fulfilment)

These companies act as processors when producing and shipping physical photo products.

They receive only the minimum personal data required (such as name, product details, and shipping address).

Each operates under GDPR‑compliant data‑processing terms. (OVI, nPhoto).

Stripe & PayPal (Payment Processing)

Stripe and PayPal act as independent data controllers for payment information.

They process payment data under their own privacy policies and do not act as processors on our behalf.

We do not store or access full payment card details.

Email Communication & CRM Marketing

Marketing emails are delivered through Zenfolio’s CRM tools under Zenfolio’s DPA and only to customers who have provided explicit consent.

Sub‑processors

Some processors may use additional sub‑processors (for example, Zenfolio’s infrastructure partners or Google’s cloud services). These sub‑processors operate under the same contractual safeguards and GDPR requirements.

International Transfers

• - Standard Contractual Clauses (SCCs)

• - Adequacy decisions

• - Additional technical and organisational measures

Review & Updates

We periodically review our processor relationships and DPAs to ensure ongoing compliance.If we add or change processors, this section will be updated accordingly.

18. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page.

19. Contact Us

[Contact Form]