Privacy Policy

15 October 2026 · Version 1.2

BRIGHT EDITS is a trading name of ACTIONS BRIGHT LTD, a company registered in England and Wales, number 16861246. Registered office: 20 Wenlock Road, London, England, N1 7GU, United Kingdom.

Who is responsible

ACTIONS BRIGHT LTD is the controller for enquiries, checkout, billing and service administration. For business clients’ photographs processed solely on their instructions, we may act as processor for that editing activity; contact us to agree appropriate processing terms before sending client images. Privacy enquiries may be sent to support@brightedits.com or to the registered office.

Information we handle

We may handle your name, contact and billing details, order and payment status, editing brief, uploaded photographs and their embedded metadata, correspondence, IP address and essential security logs. The payment provider handles card details; our store does not intentionally store full card numbers. Do not send sensitive documents or unnecessary personal information.

Purposes and lawful bases

We use order details and photographs as necessary to perform the editing contract or take steps at your request before a contract. We keep legally required financial records to comply with legal obligations. We use limited security and fraud-prevention information for legitimate interests in protecting customers and the service, balancing those interests against individual rights. Optional public portfolio use requires a separate permission. We do not infer biometric identity from photographs or use customer photos for model training.

People in photographs

Only submit photographs you are entitled to share for this purpose, including any necessary permission from depicted people or a responsible guardian. Client permission is not a blanket legal basis for all third-party data: we consider the processing context and do not accept unnecessary sensitive material. If someone submits your image and you have concerns, contact us and provide enough information to locate it securely.

Service providers and access

Access is limited to personnel and contracted editors who need it to carry out the brief, plus necessary hosting, email, checkout and file-transfer providers under appropriate terms. We do not sell customer photographs or publish them by default. Uploaded source photographs are stored on our Hostinger hosting account in encrypted form. Authorised editing staff may download them solely to perform your order. Delivery links, where used for finished files, are managed by the assigned delivery provider.

International transfers

Where providers or assigned editors process data outside the UK or EEA, we assess the destination and use an applicable adequacy decision or appropriate contractual safeguards, such as relevant standard contractual clauses and the UK addendum or IDTA, as required. Contact us for information about safeguards for your order. Do not submit a client project with specific location or confidentiality requirements until they are agreed.

Retention

Working originals and edited photo files are normally removed from active systems 30 days after final delivery or cancellation. Limited records needed for a dispute may be kept until resolution. Backup copies, where present, age out according to the host’s backup schedule; they are not retained for ongoing editing use. Order, invoice and tax records are normally kept for six years after the relevant accounting period, or longer where legally required. Enquiries are normally removed after 12 months unless needed for an order, dispute or legal duty. Incomplete uploads and unpaid abandoned uploads are scheduled for deletion after 24 hours. Paid source files are retained while editing is active, then scheduled for deletion 30 days after completion or cancellation. Deletion depends on scheduled site tasks running; backups age out under the hosting backup schedule.

Your choices and rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. We may verify identity proportionately and will explain any lawful refusal or required retention. You can complain to the UK Information Commissioner’s Office at ico.org.uk or your competent local authority. No solely automated decision with legal or similarly significant effects is intended.

Security and minimisation

Upload only the photographs needed for your order. Source files are encrypted at rest and staff downloads require an authorised session. We use access controls and appropriate technical measures, but no internet service guarantees absolute security. If an issue affects your data, we follow applicable notification requirements.