Photo scanning privacy policy

1. Who we are

Syrett Consultancy Limited, trading as MementoScan, provides photo digitising and printed photo scanning services. For the purposes of UK data protection law, Syrett Consultancy Limited is the controller for the personal information described in this policy.

Questions about privacy can be sent through the contact page.

2. What we collect

We may collect and use:

• your name, email address, phone number, delivery address, billing address, and order details;
• payment confirmation and transaction information processed through Shopify and payment providers;
• messages you send through the contact form, email, or order support channels;
• information needed to arrange pickup, postage, return delivery, or support;
• photographs and image content supplied for scanning, which may include images of identifiable people or other personal information;
• technical and delivery information generated when you access download pages or download completed files, such as IP address, browser or device information, timestamps, download requests, and link status;
• transactional email delivery information, such as whether service emails were submitted, delivered, opened, clicked, bounced, or otherwise reported by our email provider; and
• website, cookie, device, analytics, and fraud-prevention information generated when you use the website.

3. How we use personal information

We use personal information to:

• process orders, payments, refunds, quotes, and customer support requests;
• scan, prepare, store temporarily, and deliver digital photo files;
• return original photographs and arrange pickup or delivery where applicable;
• send service messages about an order or enquiry;
• provide, protect, and troubleshoot digital download links and completed file delivery;
• confirm service email and digital delivery status, respond to order queries, and handle payment, fraud, chargeback, or dispute issues;
• keep business, accounting, tax, fraud-prevention, and legal records;
• maintain website security and understand how the website is used; and
• send marketing only where permitted or where you have asked to receive it.

Lawful basis

We usually process order and service information because it is necessary to perform a contract with you or to take steps before entering into a contract. We may also process information to comply with legal obligations, for legitimate business interests such as fraud prevention and service improvement, or with your consent where consent is required.

4. Customer photographs

Photographs can contain personal data, including images of people, places, events, writing, or other identifying details. We handle customer photographs only to provide the digitising service, quality check the output, deliver files, support the order, comply with law, or with your separate written permission.

We do not sell customer photographs. We do not use customer photographs for marketing without separate written permission.

5. Who information is shared with

We only share personal information where needed to run the service, comply with law, or protect the business. This may include:

• Shopify and payment providers for ecommerce, checkout, fraud prevention, and order management;
• delivery, courier, postal, or pickup providers;
• cloud hosting, storage, email, file-delivery, analytics, and support providers;
• professional advisers, insurers, accountants, and legal advisers; and
• law enforcement, regulators, courts, or public authorities where required.

6. Cookies and website data

The website is hosted on Shopify and may use cookies and similar technologies for checkout, security, analytics, personalisation, fraud prevention, and site functionality. You can manage cookie preferences through the cookie banner where available and through your browser settings.

7. Retention

Digital scan files are not long-term storage. Unless otherwise agreed, completed digital files may be deleted from our systems 8 weeks after delivery.

Order, payment, tax, accounting, customer-service, email delivery, and download access records may be kept for as long as needed for business, legal, accounting, tax, insurance, dispute-resolution, fraud-prevention, and compliance purposes. Where we do not have a fixed retention period, we use the purpose, legal requirements, order status, support needs, and risk to decide how long information is kept.

8. Security

We use reasonable technical and organisational measures to protect personal information and customer photographs. No website, transmission, postal method, or storage system can be guaranteed completely secure, so you should avoid sending anything you do not accept may carry some risk.

9. Your rights

Depending on the circumstances and lawful basis, you may have rights to access, correct, erase, restrict, object to, or receive a copy of your personal information. You may also have the right to withdraw consent where processing is based on consent.

To exercise your rights, contact us through the contact page. We may need to verify your identity before responding.

You can also complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how your personal information has been handled.