Picture Play Privacy Policy
Last updated: 20 th March 2026
1. Introduction
Picture Play, an app by The School Photography Company, is committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you use the Picture Play mobile application.
2. Information We Collect
Account Information
When you register, we collect your name, username, email address, phone number, and postal address. This information is used solely to manage your account and fulfil your orders.
Authentication Credentials
Your login credentials are stored securely on your device using encrypted secure storage. We support optional biometric authentication (Face ID / fingerprint) which is processed entirely on your device — biometric data is never transmitted to our servers.
Device Information
We collect a unique device identifier upon login to associate your account with your device for security purposes.
3. Lawful Basis for Processing
Under UK GDPR, we rely on the following lawful bases to process your personal data:
| Data | Lawful Basis |
|---|---|
| Account & contact information | Contract — necessary to provide the service you have purchased |
| Device identifier | Legitimate interests — to maintain account security |
| Marketing opt-in | Consent — only where you have explicitly opted in |
4. Device Permissions
The app requests the following permissions:
| Permission | Purpose |
|---|---|
| Camera | Required to scan Picture Play portraits and display AR video content |
| Microphone | Required for AR video playback with audio |
| Media Library / Camera Roll | Required only if you choose to save a video to your device |
Permissions are only used for the stated purposes. Camera data is processed on-device for image recognition and is not stored or transmitted.
5. How We Use Your Information
We use the information we collect to:
- Authenticate you and maintain your account
- Display the correct AR video content associated with your portraits
- Communicate with you about your account if necessary
- Send marketing communications where you have given consent
We do not use your data for advertising, behavioural profiling, or any purpose beyond providing the core service.
6. Data Sharing and Transfers
We do not sell, trade, or share your personal information with third parties, except where required by law.
Your account data is stored on servers located within the UK/EEA. We do not transfer your personal data outside the UK or EEA. No third-party analytics, advertising, or tracking services are integrated into the app.
7. Data Retention
We retain your personal data for as long as your account is active or as necessary to provide the service. When your account is deleted, we will erase your personal data within 30 days unless we are required to retain it by law.
8. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data ("right to be forgotten")
- Right to restrict processing — request that we limit how we use your data
- Right to data portability — request your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at [email protected].
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Authentication tokens and credentials stored on your device use platform-level encrypted secure storage.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.
11. Contact Us
We are the data controller responsible for your personal data. For any privacy-related queries or to exercise your data rights, please contact us at:
The School Photography Company Ltd
Vat No: 294188030
Company Reg. No: 5639678
Company Registration and postal address: Beaumont Close, Banbury, Oxon, OX16 1TG
Telephone number: 01295 250812
Email address: [email protected]
