Privacy policy

1. Who we are

The data controller is Camera Centre UK, 14-16 Morgan Arcade, Cardiff, CF10 1AF. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZB539989. For anything to do with your personal data, contact us at info@cardiff.film or +44 (0)29 2039 4182.

2. What we collect

• Account details: email address, name, optional phone number, optional display username, and your password (hashed, we never see it in plain text).
• Order details: job numbers, film formats, quantities, and any notes our lab staff record while processing your rolls. Orders are created by our staff, not by you.
• Scans and photos: the digital scans of your film that we upload to your gallery, plus any images you choose to share in the Filmgram community feed.
• Messages: contact form enquiries, support chat messages and reports you send us.
• Subscription details: if you take out our optional Premium storage subscription, we store the subscription status and expiry. Card details are held by our payment provider, not by us.
• Technical data: standard server logs (IP address, timestamps, error traces) used to keep the site running and diagnose problems.

We do not knowingly collect data from anyone under 16. If you believe a child has created an account, please contact us and we'll remove it.

3. How we use it and our legal bases

• Running your account and orders (UK GDPR Art. 6(1)(b) contract): to create your account, attach orders you bring to the lab, deliver your scans, and support you.
• Service emails (contract / legitimate interests): order status, gallery ready alerts, retention reminders, password resets, and Premium subscription notices.
• Community feed (Art. 6(1)(a) consent): if you choose to share a photo or comment, it becomes visible to other signed in customers.
• Site security and abuse prevention (legitimate interests): reviewing reports, rate limiting, and blocking abusive behaviour.
• Legal obligations (Art. 6(1)(c)): keeping records we're required to hold (for example VAT and accounting records).

We do not sell your personal data, and we do not use it for third party advertising or profiling.

4. How long we keep it

• Scans and galleries: retention depends on your plan. See our photo storage & retention policy for full detail.
• Account: while your account is active. You can ask us to delete it at any time.
• Orders, invoices and receipts: up to 7 years, as required for UK tax and accounting.
• Support and contact messages: up to 2 years, then deleted.
• Community posts: until you delete them or your account is closed.

5. Who we share it with

We use a small number of trusted processors to run the service. They only process your data on our instructions:

• Hosting, database and storage: our platform provider hosts the site, database and photo storage on EU/UK region infrastructure where available.
• Transactional email: our managed email provider sends account, order status and gallery ready emails from our verified sender domain.
• Payments: if you subscribe to Premium, our payment provider processes your card. We never store your card number.

Where any transfer of data outside the UK/EEA is necessary, it takes place under UK/EU Standard Contractual Clauses or an equivalent lawful transfer mechanism.

6. Security

We restrict access on a need to know basis. External lab operators can only see the information they need to process rolls, and customer names and emails are masked from that view. All access to your account is protected by your password; we recommend using a strong, unique password.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these, email info@cardiff.film. You can also request account deletion from your portal settings. We aim to respond within 3-5 days.

If you believe we've mishandled your data, you have the right to complain to the UK Information Commissioner's Office (registration number ZB539989) at ico.org.uk. We'd appreciate the chance to put things right first.

8. Cookies and local storage

We use a small number of strictly necessary cookies and browser storage entries to keep you signed in and remember your preferences. We do not use advertising cookies or third-party analytics. Full detail is on our cookies notice.

9. Changes to this policy

If we make material changes we'll update the "last updated" date at the top of this page and, where appropriate, notify you by email.

10. Contact

Camera Centre UK, 14-16 Morgan Arcade, Cardiff, CF10 1AF · info@cardiff.film · +44 (0)29 2039 4182