This notice explains what personal data Splento collects, why we collect it, who we share it with, where we store it, how long we keep it, and what rights you have. It covers everyone whose data we handle, not only visitors to this website.
If you only want the short version: we store client images on servers we control in Germany, we do not sell your personal data, and we do not use your content to train AI models.
Who we are
SPLENTO LTD is registered in England and Wales under company number 09595739. Our registered office is New Boundary House, London Road, Sunningdale, Berkshire, United Kingdom, SL5 0DJ.
For anything in this notice, including requests about your data, contact us at support@splento.com and put "Data protection" in the subject line.
Who this notice covers
We handle personal data about four groups of people:
- Visitors:
- Anyone who browses our website.
- Clients and their staff:
- The people who contact us, place orders, and manage projects on behalf of a business. Our services are sold to businesses rather than consumers, as set out in clause 2.1 of our Terms and Conditions.
- Photographers and applicants:
- People who apply to join our photographer network, and the photographers who work with us.
- People we photograph:
- Guests, staff, customers and others who appear in images we capture or process at a client’s request. If that is you, the section below on responsibility explains who to contact.
When we are responsible for your data
Data protection law distinguishes between the organisation that decides why data is processed, called the controller, and the organisation that processes it on the controller’s instructions, called the processor. Which one we are depends on the situation.
We are the controller for data about site visitors, people who contact us, client staff we deal with, and people who apply to work with us. This notice is our notice to you, and you can exercise your rights with us directly.
We are usually the processor when we photograph or process images of people at a client’s request. The client decides why the photographs are taken and what happens to them, so the client is the controller and their own privacy notice governs. If you appeared in a shoot and want your data removed, the client who commissioned it is the right first contact. Write to us anyway if you cannot identify them and we will pass the request on.
What we collect and why
We only collect what we need for the purpose it is collected for. What that means in each case is set out below.
If you visit our website
Our servers keep standard access logs. These record your IP address, the pages you request, the date and time, and basic information about your browser and device. An IP address counts as personal data, so we treat these logs accordingly.
We use them to keep the site running, diagnose faults, and protect against abuse and attack. Our lawful basis is our legitimate interest in operating a secure and reliable website.
If you accept analytics cookies, Google Analytics records which pages you visit, how you arrived, the type of browser and device you use, and your approximate location, which Google works out from your IP address. It links these by a random ID kept in a cookie. We use it to understand how the site is used and to improve it. Our lawful basis is your consent, which you can withdraw at any time.
Before you choose, Google Analytics sets no cookies but still sends Google messages about the pages you view. Unless you then accept, they carry no ID that lasts from one visit to the next. Our Cookie Policy lists what they contain. Our lawful basis is our legitimate interest in measuring, in aggregate, how the site is used. You can object by rejecting analytics cookies, which stops the messages.
When you make a cookie choice, we keep a record of it: a random ID stored in your browser, the version of the choices you were shown, your choice, where and on which page you made it, and when. Our lawful basis is our legal obligation to be able to show that consent was given.
If you contact us or place an order
We collect your name, email address, phone number, and whatever you tell us in your message or brief, including the business you are writing on behalf of if you mention it. If you place an order we also hold the order details, the delivered work, and billing records.
We use this to answer you, quote for work, deliver the services you ordered, take payment, provide support, and keep proper business records. Our lawful bases are the performance of our contract with you, our legitimate interest in responding to enquiries and running the business, and our legal obligations for tax and accounting.
If you apply to work with us
Our application form collects your name, email address, phone number, country and city, a link to your portfolio, your social handle if you give one, the camera and lens equipment you work with, the rate bracket you expect, the languages you speak, and the kinds of work you specialise in.
We use it to assess your application, match you to suitable assignments, and contact you about work. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in maintaining a network of photographers we can call on.
If we photograph you at a client’s event
We capture and process images that may show you, and any information the client gives us that is needed to complete the work. We do this on the client’s instructions, as their processor. The client is responsible for the permissions, notices and consents required, as set out in clause 3.3 of our Terms and Conditions.
What we do not collect
We do not ask for special category data such as health, religion, or biometric identifiers, and we do not build profiles of individuals. We do not make automated decisions that produce legal effects for you or similarly significantly affect you. Our automated systems process images and content, not decisions about people.
Cookies and similar technologies
This website uses Google Analytics to see how the site is used, and sets its cookies only if you agree. The first time you visit, a banner asks. Rejecting is as easy as accepting, and analytics cookies stay off until you accept. We use no advertising cookies.
Before you choose, Google Analytics sets no cookies, but it still sends Google messages about the pages you view and some of what you do on them, such as scrolling. They include the page address, the page you came from, your browser and device, and your IP address, from which Google works out your approximate location. Unless you accept, they carry no ID that lasts from one visit to the next. If you reject, they stop.
We also keep a few strictly necessary items in your browser’s storage, such as your cookie choice and whether you closed a notice. They are exempt from the requirement to ask your permission, because the site needs them to work the way you left it.
You can change your mind at any time with the Cookie settings button at the bottom of every page. If you reject analytics cookies or withdraw consent, we delete the Google Analytics cookies straight away. Our Cookie Policy lists every cookie and storage item, what it does, who sets it and how long it lasts, and exactly what Google receives before you choose.
Separately, our typefaces come from Google Fonts, which means your IP address reaches Google when a page loads, whatever you choose about cookies.
Who we share your data with
We do not sell your personal data, and we do not share it for anyone else’s marketing. We do use suppliers who process data on our behalf, under contracts that require them to protect it and to use it only for what we ask. The categories, and the main suppliers in each, are:
- Hosting and storage:
- Hetzner Online GmbH, which hosts our websites and stores client images on servers in Germany, DigitalOcean, which hosts a service in London, and Cloudflare, which delivers this website and protects it from attack.
- AI processing:
- OpenAI and Google, where a product uses AI to generate, enhance, analyse or organise content. See the section on AI below for what they are not allowed to do with it.
- Payments:
- Stripe and PayPal, including Braintree, process card payments on their own secure pages. We never see or store your full card details.
- Email and business tools:
- The providers we use to send email, manage enquiries, and run our internal systems.
- Analytics:
- Google receives data about visits to this website through Google Analytics, as described in our Cookie Policy. We tell Google that every visitor refuses advertising cookies, the use of their data for advertising, and personalised ads, whatever they choose about analytics.
- Professional advisers:
- Our accountants, auditors and lawyers, where they need the information to advise us.
We will also disclose personal data where the law requires it, where we need to establish or defend a legal claim, or where it is necessary to prevent fraud, abuse, or a threat to someone’s safety.
Where your data is stored
Our websites and the client images we store are held on servers in Germany, with one service hosted in London. Germany is in the European Economic Area, which the UK recognises as providing an adequate level of data protection, so no additional safeguard is needed for that transfer.
Some of our suppliers are based in the United States, including Google, Cloudflare, Stripe, PayPal and OpenAI. Where personal data reaches them, we rely on the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with the technical protections those agreements require.
How long we keep it
We keep client data, deliverables, galleries and account records for as long as we need them to provide the services and to meet our legal, tax and accounting obligations. Tax records are kept for at least six years because the law requires it.
Unless a written agreement with a client sets a different period, we keep the rest until you ask us to delete it. When you do, we will delete or anonymise it within a reasonable period, except where we are required by law to keep it. Deleting your data may mean we can no longer re-supply past work or support previous orders. This matches clause 7.9 of our Terms and Conditions.
Website access logs are kept only as long as they are useful for security and diagnosing faults.
Google Analytics keeps the data linked to its cookies and IDs for 14 months, then deletes it. The aggregate reports built from it, which do not identify anyone, are kept. Records of your cookie choices are deleted after 24 months.
AI and your data
Some of our services use artificial intelligence to create, enhance, analyse or organise content. Two commitments apply, and they are set out in clauses 7.3 and 7.4 of our Terms and Conditions.
We do not use your content, your personal data, your uploads, your briefs or your finished work to train or improve AI models.
We do not permit the AI providers we use to train their models on your content either. We work with them under business terms that prohibit it, rather than the consumer versions of their products, which do not.
AI output can contain mistakes. You should review anything we deliver before you publish it, particularly where it involves people, claims about a product, or a regulated industry.
How we protect your data
We apply technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. These include access controls, authentication, encryption in transit, restricted team access, checks on the suppliers we use, and internal security procedures.
No online service can promise absolute security. Please keep your account details safe, be careful who you forward private gallery links to, and tell us straight away if you think someone has gained access they should not have.
If a security incident affects your personal data, we will assess it promptly and tell you, the Information Commissioner’s Office, or both, where the law requires it.
Your rights
You have the following rights over your personal data:
- Access:
- Ask for a copy of the personal data we hold about you.
- Rectification:
- Ask us to correct data that is wrong or incomplete.
- Erasure:
- Ask us to delete your data, where we have no continuing reason to keep it.
- Restriction:
- Ask us to pause what we do with your data while a question about it is resolved.
- Objection:
- Object to processing we carry out on the basis of legitimate interests, and object at any time to direct marketing. To object to the Google Analytics messages sent before you make a cookie choice, reject analytics cookies.
- Portability:
- Ask for the data you gave us in a machine-readable format, or ask us to send it to someone else.
- Withdrawing consent:
- Where we rely on your consent, withdraw it at any time. That does not affect anything we did before you withdrew it. For analytics cookies, use the Cookie settings button at the bottom of any page.
To use any of these, email support@splento.com. We will respond within one month. If a request is complicated we may take up to two further months, and we will tell you if that happens. We do not charge for this.
If we photographed you at an event, please read the section on responsibility above first. The client who commissioned the shoot is usually the right place to send the request.
Complaints
If you are unhappy with how we have handled your data, please tell us first at support@splento.com so we have the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk. If you are in the European Economic Area, you can complain to your own national supervisory authority instead.
Links to other websites
Our website links to sites we do not control. This notice does not cover them, and we are not responsible for how they handle your data. Please read their own privacy notices.
Changes to this notice
We update this notice when what we do with personal data changes. The version published here always shows its effective date. Where a change materially affects you, we will take reasonable steps to tell you.