Last updated: 5 October 2026
1. Your data protection rights
If Bon Arte Photography processes your personal data, you may have rights under the UK GDPR and the Data Protection Act 2018.
Depending on the circumstances, these include:
- Right of access – to obtain confirmation as to whether we process your personal data and, where applicable, a copy of that personal data and relevant information about its processing.
- Right to rectification – to ask us to correct inaccurate or incomplete personal data.
- Right to erasure – to ask us to delete personal data where the legal requirements for erasure are met.
- Right to restriction – to ask us to restrict the processing of your personal data in certain circumstances.
- Right to object – to object to certain types of processing, including processing based on legitimate interests in applicable circumstances.
- Right to data portability – to receive certain personal data in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, have it transmitted to another controller.
- Right to withdraw consent – where processing is based on consent, you may withdraw that consent at any time.
These rights are not absolute. Certain legal conditions and exemptions may apply.
For example, we may be required to retain particular information to comply with legal, tax or accounting obligations.
2. How to make a request
You can exercise your data protection rights by contacting:
You do not need to use a particular form or specific legal wording.
For example, you can simply email us stating that you want to see the personal data we hold about you.
To help us deal with your request efficiently, please provide:
- your name;
- the email address or other contact details associated with your interaction with us;
- your order number or other relevant reference, if applicable; and
- a description of the information or right you are asking about.
If you are making an access request, it is helpful to tell us whether you are looking for particular information or a copy of all personal data we hold about you.
3. Identity verification
We may need to verify your identity before providing personal data or making certain changes to your information.
Any verification request will be proportionate to the circumstances.
We will not routinely request excessive identification documents where there is no reasonable need to do so.
If we need further information to verify your identity, the time required to provide that information may affect when the statutory response period begins.
4. How we handle a DSAR
A Data Subject Access Request (DSAR) is a request for access to personal data.
When we receive a DSAR, we will:
- identify the request and confirm what is being requested;
- verify the requester’s identity where reasonably necessary;
- clarify the scope of the request where this is necessary;
- identify the personal data and relevant systems within our control;
- consider whether any legal restrictions or exemptions apply;
- provide the requested information in an appropriate form; and
- keep a record of the request and our response.
We will normally provide the information electronically where the request is made electronically, unless another format is requested or a different format is more appropriate.
5. Time limit
We will normally respond to a valid request without undue delay and within one month of receiving the request.
Where a request is complex or there are multiple requests, the response period may be extended by up to a further two months where permitted by law.
If an extension is necessary, we will tell you within the first month and explain why.
6. Requests that are manifestly unfounded or excessive
We may refuse to comply with a request, or charge a reasonable fee where legally permitted, if the request is manifestly unfounded or excessive.
We will consider the circumstances of the individual request before relying on this provision.
If we refuse a request or decide to charge a fee, we will explain the reason for our decision and inform you of your right to complain to the Information Commissioner’s Office.
7. Information we may not be able to provide
The right of access does not provide an unrestricted right to obtain every document or piece of information associated with you.
Certain information may be withheld where a legal exemption applies, including information that would adversely affect the rights and freedoms of others or information subject to applicable legal restrictions.
Where reasonably possible, we will provide the remainder of the requested information.
8. Third-party information
Some records may contain information relating to other individuals.
Where necessary, we will consider the rights and privacy of those individuals before disclosing information.
We may remove or withhold third-party information where required by law.
9. Complaints about a data protection request
If you are unhappy with how we have handled your request, please contact us first:
We will review your concern.
You also have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office (ICO)
You can contact the ICO if you believe that your data protection rights have not been respected.
10. Contact
Bon Arte Photography
Email: [email protected]
Last updated: 5 October 2026