Data subject rights
Under UK GDPR and EU GDPR you have the following rights with respect to your PhotoNest data:
- Access. Request a copy of everything we hold about you and your library.
- Portability. Receive your export as a ZIP containing JSON metadata + original photos, in a structured, commonly used format.
- Rectification. Correct any inaccurate personal data we hold about you.
- Erasure. Request deletion of your account and personal data. We complete deletion within 30 days; some audit logs are retained for 13 months for tax and regulatory record purposes.
- Restriction. Ask us to pause processing while we investigate a complaint or correction request.
- Objection. Withdraw consent for marketing communications at any time.
- Complaint. Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or the data protection authority in your country of residence.
How to exercise these rights
Email privacy@photonest.co.uk with your registered email address and the right you wish to exercise. Self-service buttons for “Export my data” and “Delete account” are rolling out on your account page — when they're available there they're the fastest route; otherwise email is the path. We respond within 30 days as required by law — usually within a week.
Our lawful basis
Processing your photos is necessary for the contract you signed up to (UK GDPR Article 6(1)(b)). Where you have given explicit consent (e.g. for marketing emails) the lawful basis is consent (Article 6(1)(a)) and you can withdraw it any time.
Data Protection Officer
As a small sole-trader business we're not required to appoint a DPO. Phillip is the data controller — reach him at privacy@photonest.co.uk.