Privacy Policy

Last updated: 28 September 2026

This policy explains what we do with the information you give us when you subscribe to Happy Days school photos, and what rights you have over it. It describes what the site does today.

This policy covers the school photo subscription on this website only. Happy Days Creative Ltd publishes separate privacy notices for its school photography services and for its main website, and you can find both at happydaysphoto.co.uk/policy. Where you have subscribed here, this notice is the one that applies to you and to the details you gave us on this site.

Who is responsible for your information

Happy Days Creative Ltd decides what is collected here and why, which makes us the data controller. We are registered in England and Wales, company number 13177907, at Unit 17, Grange Way Business Park, Grange Way, Colchester, Essex, CO2 8HF.

For anything at all about your information, including the requests described under “Your rights” below, email support@happydaysphoto.co.uk or call 01206 617181. A person reads both.

What we collect, and why we are allowed to

The law asks us to be specific about this rather than to give one general reason, so each thing is listed with the basis it rests on.

• Your name, email address and home address, to run the subscription you asked for and to send your photographs to the right place. Our basis is that we need it to perform the contract between us.
• A phone number, if we have one for you. We use it for one thing: to reach you about your own subscription when an email to you does not arrive. It is never used for marketing, and having one changes nothing else. Our basis is that we need to be able to contact you to perform the contract between us. It is kept and deleted on exactly the same terms as your email address, set out below, and you can ask us to remove it at any time while keeping everything else.
• Your children’s first names, surnames, year groups, classes and dates of birth, for the same reason and no other. The next section explains each field.
• Your bank details, which we never see and never hold. You enter them on a page hosted by GoCardless, who set up the Direct Debit and tell us only that it worked.
• Whether you asked for updates about photo windows and offers. That box is not ticked for you. If it is ticked it is because you chose to tick it, and consent is the basis. You can withdraw it at any time using the unsubscribe link in any of those emails.
• Your school code, if you give us one when you ask to be told that sign-ups have opened. That is optional, and you can leave it out. We use it for one thing: so the email we send when sign-ups open can take you straight to your own school’s form instead of asking you to find the code again. Our basis is our legitimate interest in sending you something you can act on, and it is kept and deleted with the rest of that entry, on the terms set out below.
• How the sign-up is used, if you accept analytics cookies. Consent is the basis, and nothing is collected until you choose. The cookie section below sets out exactly what is and is not gathered.
• The internet address your device is using, when you look up a school code, send an enquiry, give a school code while joining the updates list, come back to finish a sign-up, or when the page tells us that joining the updates list did not work. It is kept for seven days. Our basis is our legitimate interest in stopping one address making thousands of requests, for example to copy our list of schools or to send spam through the enquiry form.

We do not sell your information, we do not use it for advertising, and we do not make automated decisions about you.

Your rights

You can ask us to do any of the following, and you do not have to give a reason:

• See what we hold about you and your children, and get a copy of it.
• Correct anything wrong. A misspelled name or an old address can also be fixed by calling us, which is usually quicker.
• Have it deleted. If you are still subscribed we will need to cancel the subscription to do this, because the subscription is made of that information, and we will say so before doing anything.
• Ask us to stop using it for a while, if you think something is wrong and want it left alone until it is sorted out.
• Take it elsewhere, in a form another company can read.
• Object to us using it where our basis is our own legitimate interest, which above means only the seven-day record of your internet address.
• Withdraw consent for marketing emails or analytics cookies, at any time, without affecting anything that happened before you withdrew it.

Email support@happydaysphoto.co.uk and we will answer within one month. There is no charge.

If you are not happy with our answer

Tell us first if you can, because most things are quicker to put right directly. But you have the right to complain to the Information Commissioner’s Office, the UK regulator for this, and you do not need our permission or agreement to do it.

They are at ico.org.uk/make-a-complaint, or on 0303 123 1113.

What we ask about your children, and why

When you subscribe we ask for each child’s first name, surname, year group, class and date of birth. We ask for them for one reason: so that the right photographs reach the right family.

• Name, year group and class are how your child is found on photo day and how their photographs are matched back to your subscription.
• Date of birth tells your child apart from another child of the same name at the same school, and confirms we have the right child before anything is printed and sent to you.

We do not hold a list of the pupils at your child’s school. A child’s details exist here only because you entered them yourself when you subscribed.

Your children’s details are used to run your subscription and to produce your photographs. They are not used for advertising, they are not sold, and they are not shared with anyone beyond the companies listed under “Other companies involved in your subscription” below. Happy Days Creative staff working on your order can see them.

If you want your details removed, including your children’s, email support@happydaysphoto.co.uk and we will do it.

How long we keep your information

This section sets out what the site does today, in each of the six situations you can be in.

If you start a sign-up and do not finish it

Filling in the form is not the end of signing up. Your details are saved before you are sent to GoCardless to set up the Direct Debit, so that you can come back and finish without typing everything again. If you never come back, that record is deleted after 30 days. Deleted means your name, your email address, any phone number we hold for you, your home address, and your children’s names, year groups and dates of birth.

Thirty days is longer than a sign-up window, on purpose. A parent who starts on the first day of a window and comes back a fortnight later should still find their details where they left them.

Before anything is deleted we check with GoCardless that you really did not complete the Direct Debit. If they confirm you did, or if we cannot get a clear answer, your record is kept and a person looks at it. Nothing is deleted on a guess.

While we still have that record, somebody from Happy Days may email you once to ask whether you would like a hand finishing. It is a person writing to you about the sign-up you started, not an advert: there is no offer in it, and if you do not reply we do not write again. If you would rather we did not, say so and we will stop.

If you did not finish, but you asked for updates

The last step of the sign-up has a box you can tick to hear about photo windows and offers. It is not ticked for you, so if it is ticked it is because you chose to tick it.

If you ticked it and then did not finish, we keep your first name and your email address and nothing else. Your home address, any phone number, your children’s names, their year groups and their dates of birth are deleted with the rest of the record on the same 30 days. A phone number is never moved onto the updates list and is never used to contact you about anything you did not sign up for. Your first name and email address move onto our updates list, described next, and every email we send from it has an unsubscribe link.

If you did not tick it, nothing is kept. There is no other route by which an unfinished sign-up puts you on a list.

Our updates list

This is the list you join by asking to be told when sign-ups open, or by ticking the box above. An entry is your email address, and your school code if you chose to give one. We keep it for 24 months, counted from the day it was added. That is about six sign-up windows.

If you ask to join again, that is a new entry and the 24 months starts again. Being sent an email does not restart it. If you unsubscribe we stop emailing you straight away, and we keep a note of the date you unsubscribed so that we can prove we stopped, and so nothing puts you back on later.

If you subscribe

While you have a subscription we keep your details and your children’s details for as long as it runs, because that is what the subscription is made of.

If a child is taken off your subscription while it carries on, or a child’s name is corrected, we keep the old details for 12 months after the change and then delete them.

Once a subscription is cancelled, your children’s names, year groups and dates of birth are deleted 12 months later. Your own name, email address, any phone number, home address and the payment record are kept for six years from the end of the financial year in which your subscription ended, in line with the tax rules on payment records, and are then deleted. You do not have to wait for either period. You can ask us to delete your details at any time, by emailing support@happydaysphoto.co.uk, and we will.

Your internet address

Five parts of this site record the internet address your device is using, for 7 days, and then delete it automatically. They are:

• the box where you type your school code when you sign up;
• the enquiry form on the home page;
• the updates list form, but only if you add a school code;
• coming back to finish a sign-up you started;
• an automatic message your browser sends us if joining the updates list fails, so we can fix it.

We do this only to stop one address making thousands of requests, for example to copy our list of schools or to send spam through the enquiry form.

It is not linked to your sign-up, it is not used to work out who you are, and it is not used for advertising or analytics.

If something goes wrong with your sign-up

When part of the site fails, it records a note for our team so we can put it right. If the failure happened during your sign-up, the note can include your subscription reference, your email address, your school code and how many children you were signing up. These notes are kept for 90 days, and then deleted automatically. They are only readable by our team after signing in.

Cookies and similar technologies

This section lists what this site stores on your device.

We only set analytics cookies if you accept them. Nothing in the “analytics” group below is written to your device unless you choose Accept analytics cookies on the banner, and you can change your mind at any time using the button at the end of this section.

Essential — always on

These are needed for the site to work or to keep your sign-up secure, so they do not require consent. They stay on your device and are never sent to a third party.

• hd_cookie_consent (browser storage, 6 months) — remembers whether you accepted or rejected analytics cookies, and when you chose. Without it we would have to ask you on every page.
• hd_subscribe_state (browser storage, until you clear it) — remembers only that sign-ups were open last time you visited, so the page shows the form immediately instead of flickering. If sign-ups were closed we remember nothing and remove it. It holds one word and the moment that answer stops being trusted — nothing about you, and never sent anywhere: the site asks our own server for the current state on every visit regardless.
• hd_checkout_draft (browser storage, until you close the tab) — keeps what you have typed into the sign-up form, so that going to your bank and coming back, or reloading the page, does not make you type your children’s details in again. It stays in that one tab, it is deleted when you close it, and it is deleted straight away once your sign-up is confirmed. It is also discarded after 24 hours, which covers a browser that reopens your tabs for you. It is never sent anywhere. The terms and updates tick boxes are deliberately not kept, so you tick those yourself each time.
• hd_state (cookie, 12 hours, or until the next sign-up window opens or closes) — holds one word, “open” or “closed”, so the sign-up page shows you the right thing the moment it loads instead of showing you a form and then taking it away. It holds nothing about you, it does not identify you or your device, and we only ever read it back on our own pages. Unlike the item above it, this one travels to us with each request, because that is how cookies work.
• hds_admin (cookie, 7 days) — only ever set for Happy Days staff signing in to the admin area. It is never set for parents.

Analytics — only if you accept

• ph_* (cookies and browser storage, up to 1 year) — set by PostHog, which we use to see how many parents reach each step of the sign-up and where they give up, and to make the recording of your visit described below. Our PostHog project is hosted in the European Union.

We have deliberately turned off PostHog’s automatic click tracking, so it cannot capture what you type. It receives which pages you viewed, and nine events. Four are steps you got through: that you started the sign-up, finished your details, finished adding children, and pressed the payment button. One is what our system answered when you pressed that button: whether it accepted the sign-up, sent you on to a confirmation you already had, or turned it down, and in that last case which one of a short fixed list of reasons applied. Two are ways the first step can stop you: that a school code was not recognised, and that we told you there is already a sign-up for your email address. The last two are about the short form you can use to register interest while sign-ups are closed: that you sent it, and that it failed to send.

The school code you typed is not sent, and neither is your email address. We can see how often parents get stuck at that first step; we cannot see who it was or what they entered. The only other details are the number of children, never their names, and a short technical note if the register-interest form fails to send.

We make a recording of your visit, if you accept analytics cookies. It is a replay we can play back and watch: where you scrolled, where you moved and tapped, and which step you stopped on. We use it to find the parts of the sign-up that people get stuck on, so we can fix them. If you reject analytics cookies, no recording is made at all.

Every form field and every word on the page is hidden before anything is stored. A recording shows where somebody moved and where they got stuck, and never what they typed or what was on the screen. Your name, your address, your children’s names and their dates of birth are not in it, because no text is.

When we send an analytics event, the page address is shortened first, so the part of it that carries your subscription reference is not included.

A recording keeps the address of the page it started on, and that address cannot be shortened the same way. Some of our pages carry your reference and your school’s name in the address: the one you come back to after setting up the Direct Debit, and the ones you reach if you stop partway. We do not record those pages at all.

Recordings are kept for 30 days, and then deleted. You can ask us to delete yours sooner, by emailing support@happydaysphoto.co.uk.

Fault reporting — always on

If something on this site breaks while you are using it, a short technical report of the fault is sent to Sentry so we can find it and fix it. This is not part of the analytics choice above. It runs for everyone, because we need to know when part of the site is not working so we can fix it.

A report is only sent when something actually goes wrong. On a page that behaves normally, nothing is sent to Sentry at all, and nothing is stored on your device either way.

The report describes what broke and where in our own code, along with the kind of browser you are using and which page you were on. We have turned off the part that would otherwise record what you click and type, for the same reason we turned it off in PostHog: the sign-up form holds your children’s names and dates of birth. Page addresses are shortened first, so your subscription reference does not reach Sentry either. It never receives your name, your address, your children’s details or your bank details. Our Sentry account is hosted in the European Union.

Other companies involved in your subscription

These do not set anything on your device from this site, but they do process your information once you subscribe:

• GoCardless, which takes your Direct Debit details on its own hosted page and collects the payments. We pass them your name, your email address and your home address when we send you there, so the page arrives already filled in and you do not type it all again. We do not pass them a phone number. You can change any of it on that page before you agree to anything. When you are sent there, GoCardless sets its own cookies under its own privacy policy.
• Vercel, which hosts this website.
• Neon, which runs the database holding your subscription.
• Mailjet, which sends the emails about your subscription.
• PostHog, only if you accept analytics cookies.
• Sentry, which receives a technical report when something on the site breaks.

Each of them only handles what it needs for its own job, and none of them may use your information for anything of their own.

Where your information is

The database is in London, and so is the part of the site that handles what you type. Your details are not sent abroad to be processed.

The company that runs the database is part of a group based in the United States, and its support staff work in several countries, so staff outside the UK can reach the database when they are maintaining it. The same applies to the companies that host the site and send our emails.

You can ask us at any time which companies are involved and what each of them does.

Changing your mind

You can change your cookie choices whenever you like. Rejecting analytics after previously accepting also deletes the analytics cookies already on your device.

Change your cookie choices