Privacy & Data Policy

The data controller is Molesey Photographic Club. The club administrator manages the Prism system on behalf of the club. If you have questions or requests about your data, contact the club directly via the membership contact on the club website.

The data processor is Templeton-Smith Ltd, a company registered in England and Wales under company number 14618653, which operates Prism and processes the club's data on its instruction. The terms of that arrangement are set out in the Data Processing Agreement.

When you are registered as a member in Prism, the following data is stored:

Prism does not collect location data, payment information, or any data not directly related to club competition administration.

Prism processes member data under legitimate interests - the club has a legitimate interest in maintaining competition records and administering its programme for its members. For members who submit images for publication or external competitions, processing is based on your consent at the point of submission.

Prism does not process any special category data (health, political opinions, biometric data, etc.).

Your data is accessible as follows:

• • Club administrators - full access to manage competitions and membership.
• • All club members (logged in) - can see published competition results, season rankings, and the programme calendar. Names and scores in results are visible to all members.
• • Your Image Bank - private to you and club administrators. Other members cannot see your unpublished images.
• • Club Bank nominations - visible to administrators and the selection committee.
• • Shareable results pages - administrators can generate a public link to a results page. If shared, competition results (names and scores) become visible to anyone with the link.

Your data is never sold, and is never shared with third parties for marketing or any other purpose. Data leaves Prism's systems only through the sharing features described above, or via the infrastructure providers who host it under contract (see Data security below and the Data Processing Agreement for the full list).

You have the following rights regarding your personal data:

• • Right of access - you can request a copy of the data Prism holds about you.
• • Right to rectification - you can ask for inaccurate data to be corrected (e.g. a misspelled name).
• • Right to erasure (“right to be forgotten”) - you can ask for your personal data to be deleted. See the important note below.
• • Right to object - you can object to processing based on legitimate interests.
• • Right to data portability - you can request your data in a common format (e.g. CSV).

To exercise any of these rights, contact the club administrator. Requests will be actioned within one calendar month, which is the period UK GDPR allows. A deletion request can also be made from your own Account page in Prism, which emails the club's administrators straight away and emails you again once it has been carried out.

When you request erasure, Prism will:

• • Delete your login account, any authenticator app set up on it, your name, email address, distinctions and membership number.
• • Delete every image in your personal Image Bank, and every image file from your competition entries.
• • Delete your published portfolio, if you have one, along with its biography and its web address.
• • Keep, with nothing of yours attached - your past entries and their scores, with the titles blanked and no name on them, so season standings and series totals still add up. The photographs themselves are gone; what remains is a scored row with no photograph, no title and no photographer.
• • Anonymise your name on any competition results already submitted to or published by an external body - those remain in the club's historical records attributed to “[Member - removed]”.
• • Keep one audit entry naming who was deleted, when, and which administrator did it. A deletion that left no record of having happened could not be shown to have happened.

This approach balances your right to erasure with the club's obligation to maintain accurate historical competition records for federation compliance.

Prism runs on professional cloud infrastructure with enterprise-grade physical security, redundant power, and 24/7 monitoring. Data is stored in managed, encrypted databases hosted within the United Kingdom. Access requires authentication for all pages. Passwords are hashed and never stored in plain text. Row-level security policies ensure members can only access their own data except where results are published.

Physical security, power redundancy, network protection, and regular automated backups are handled by Prism's infrastructure providers as part of their own security certifications. Full details of these providers are listed in the Data Processing Agreement.

For any privacy queries, requests to access or delete your data, or concerns about how your data is being used, please contact the club administrator via the Molesey Photographic Club website or at a club meeting.

If you are not satisfied with how a request has been handled, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.