Photo consent and safeguarding for a class book order

When you place the order you confirm that you hold each family's permission to use their child's photograph. That declaration is stored with the order along with the version of the wording you agreed to, when you agreed to it, and from where.

Then every parent confirms it again, themselves, on their own upload page - they cannot send a photograph without ticking their own box, and that tick is recorded against that child's seat with its own timestamp.

The point of the second one is that the permission does not rest on your word alone. If a family later says they never agreed, there is a record made by the family, not by the setting.

It is used to draw that child's illustrations, and then it is deleted. It is not kept as a library, not attached to a marketing example, and not used to train any model.

It is never shown to another family. A parent's upload page shows their own child's name and the setting's name and nothing else - not the class list, not the other children, not how many families have responded.

Nothing about a child appears on any page a search engine can reach. The upload pages carry a noindex instruction and are addressed by a single-use token rather than by a guessable URL.

The parent sees their own child and the setting's name. That is the whole of it.

You, as the person who placed the order, see your class page: which seats have had a photograph and which have not, so you can chase the families who have not replied. You do not see other settings and nobody outside your order sees yours.

A link opens exactly one child's book and works once. If it is forwarded to somebody else it cannot overwrite a book that has already been made, and you can cancel and re-issue any link from your class page.

Print this page and the parent-facing one at /photo-privacy. Between them they cover the three things a policy check asks for: the lawful basis (explicit consent, captured from the parent), the retention period (deleted once the illustration is drawn), and the recipients (nobody outside the order).

If your setting needs something specific in writing that is not answered here - a named data-protection contact, a retention statement on letterhead, a supplier questionnaire - write to us and ask. We would rather answer a director's questionnaire than have a class quietly not go ahead because the paperwork was awkward.

To withdraw before the book is made: tell us and the seat is cancelled and refunded. Nothing has been drawn yet, so there is nothing to undo.

To have their data removed afterwards: the photograph is already gone, and the remaining record is the child's first name on their own book and the consent timestamps. Ask and we will remove what is left.