Privacy Policy

1. Who we are

Camera Shop London, also known as Stuart Cameras, is a camera shop and photo lab at 221 Whitechapel Road, London E1 1DE. We run this website. In this policy “we”, “us” and “our” mean Camera Shop London, and “you” means anyone who uses the website or our services through it.

We are the “controller” of the personal information described here, which means we decide how and why it is used. You can reach us through our contact page, or by writing to us at the shop address.

This policy follows the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the cookie rules in the Privacy and Electronic Communications Regulations (PECR). It covers this website and the orders, appointments and enquiries that come through it.

2. The short version

• We use your information to run your account, take and deliver your orders, make things from your photos and films, and answer you.
• We don’t sell your information, and we don’t send newsletters or marketing emails.
• Your card details go to our payment providers, Dojo or PayPal. They never reach us.
• Google Analytics cookies stay off unless you accept them.
• You can ask to see, correct or delete your information at any time. See Your rights below.

3. The information we collect

We only ask for what we need for what you are doing. This is what we collect, and when.

Your account

• Your name and email address and, if you give it, your phone number.
• Your password. We never keep it as you typed it, only as a scrambled (hashed) value that can’t be turned back into your password. If you sign in with Google instead, Google tells us your name, your email address and your Google account number, and we hold no password for you.
• Delivery addresses you choose to save.
• When you last signed in, and a record of each browser that is signed in, so we can keep you signed in and sign you out when you ask.
• A six digit code we email you to confirm your address or reset your password. It works for 10 minutes, and we keep only a scrambled version of it.

Orders and payments

• Your name, email address and phone number, and the delivery address for anything we post.
• What you ordered, any note you add, how you want to receive it, and the price, delivery and any discount.
• Whether your payment went through, which provider took it (Dojo or PayPal) and a payment reference. For a card payment we are also told the type of card and its last four digits, for example “VISA ending 1096”. We never see or store your full card number, expiry date or security code.
• How the order is going, such as when it was dispatched, its tracking number, and notes our team make about it.
• A private link in your confirmation email, which lets you view that order.

Photos, files and films you give us

Many of our services need things that belong to you:

• photos, designs and documents you upload for personalised gifts, printing and passport photos;
• photos you add to a return or a review;
• films, negatives and video tapes you hand in or post to us, and the scans and files we make from them.

Photos can show people, including children. We use them only to make what you ordered. Uploads are kept in private storage that only you and our team can open, through short-lived secure links. The one exception is a photo you add to a review, which is shown publicly with the review.

Appointments

For a repair drop-off or a sell your camera visit, we collect your name, email address and phone number, the time you choose, what you tell us about the camera (such as what it is and what is wrong with it) and any note you add. We email you a private link to manage the appointment.

Returns

If you ask to return something, we collect your reason, anything you tell us about it, any photos you add and the items concerned. We also note what happens next, such as when the parcel arrives and any refund.

Reviews

If you write a review, we keep your rating, your words, any photos and the order it came from, which lets us mark it as a verified purchase. Reviews are public. They show your first name and the first letter of your last name, for example “Sarah K.”, and the date. You can edit or delete your review from your account at any time.

Contacting us

When you use the contact form, we keep your name and email address, your phone number and order number if you give them, the subject and your message. We also email a copy to the shop. If you message us on WhatsApp, WhatsApp’s own privacy policy applies as well.

To keep spam out, the form has a hidden field and checks how quickly it was filled in. A message that looks automated is thrown away.

Emails we send you

We email you about things you have asked for: confirming your address, resetting your password, your orders (confirmation, ready to collect, dispatched, cancelled, refunds and links to download your scans), returns and appointments. If a member of staff sends you a discount code, that comes by email too. We don’t send newsletters or marketing emails. If that ever changes, we will ask for your consent first. Our emails are sent through an email delivery provider.

How you use our website

If you accept analytics cookies, we use Google Analytics to count visits and to see which pages and products people look at, what they search for, and where they leave the basket and checkout. We don’t send Google your name, email address, phone number, address or payment details. See Cookies and similar technologies below.

Like most websites, our servers and security systems also record technical details of each visit, such as your IP address, the pages you ask for and your browser type. We use them to keep the website working and secure, and to limit repeated sign-in and checkout attempts.

Information from other companies

• Google, if you choose to sign in with Google: your name, email address and Google account number.
• Dojo and PayPal: whether your payment went through and, for a card, its type and last four digits.

4. Why we use your information

The law says we must have a reason, called a lawful basis, for each use. Ours are:

• To carry out our contract with you, or to take steps you ask for before one: creating your account, taking and delivering orders, taking payment, making things from your photos and films, handling appointments, returns and refunds, and emailing you about them.
• To follow the law: keeping accounting and tax records, and dealing with legal claims and requests from authorities.
• Our legitimate interests: answering your enquiries, keeping the website and your account secure, preventing fraud and spam, fixing faults, showing reviews and keeping the records we need to settle a dispute. We only rely on this where it doesn’t outweigh your rights, and you can object (see Your rights).
• Your consent: analytics cookies. You can say no, and you can change your mind at any time with Cookie settings at the bottom of every page.

We need your name, contact details and, for posted items, delivery address to supply an order. Without them we can’t. Everything else is your choice.

5. Who we share your information with

We don’t sell your information. We share it only with people who need it to give you what you asked for, and with companies that handle it for us on our instructions:

• Payment providers: Dojo for cards and PayPal. You enter your payment details on their pages, and their own privacy policies apply to them.
• Royal Mail, to deliver orders we post: your name and delivery address.
• WeTransfer, when we send you digital scans of your films: your email address and the scans.
• Cloudflare, which stores the photos and files you upload and helps deliver and protect our website.
• Our hosting and email providers, which run our servers and database and send our emails.
• Google, for Google Analytics if you accept cookies, and if you choose to sign in with Google.
• Advisers and authorities, such as our accountants and lawyers, and HMRC or the police when the law requires it or to protect our rights.
• A buyer, if our business is ever sold, who would use your information as this policy describes.

Some pages also make your browser contact other companies directly. The map on our website is loaded from OpenStreetMap, and some product pages show a YouTube video. For YouTube we use its privacy-enhanced mode, which stops YouTube storing information about you unless you play the video. These companies see your IP address and browser details when they send you their content, and their own privacy policies apply.

6. Sending information outside the UK

Some of these companies, such as Google and Cloudflare, handle information in other countries, including the United States. When that happens we make sure your information stays protected, for example by relying on a country the UK has approved, the UK to US data bridge for certified US companies, or standard contract terms approved for use in the UK.

7. How long we keep your information

We keep information only for as long as we need it for the reasons above.

• Order and payment records: 6 years, as tax and accounting law requires. These stay on file even if you delete your account.
• Your account: until you ask us to delete it. A browser you have signed in on is signed out 30 days after you last use the website.
• Your basket before you sign in: a browser that hasn’t signed in is remembered for 90 days after your last visit.
• Uploaded photos and files: a file you upload but never put in your basket is deleted after a day, and files in a basket left for 60 days are deleted. Files that are part of an order stay with the order so we can fix problems or make it again. You can ask us to delete them once the order is complete.
• Appointments, returns and contact messages: for as long as we need them to deal with your request, and normally no more than 2 years after we last hear from you, unless they are part of an order.
• Reviews: until you delete them. They are deleted with your account.
• Analytics: Google keeps analytics data for no more than 14 months.
• Backups: we back up our database every night. Nightly copies are kept for about five weeks and monthly copies for about thirteen months, so something you ask us to delete can stay in a backup until it expires. We use backups only to recover from a failure.

8. Cookies and similar technologies

Cookies are small files a website saves on your device. Other tools, such as your browser’s local storage, do the same job, and we treat them the same way.

Essential, always on. These make the shop work, so they don’t need your consent.

• csl_guest keeps your basket, and any orders or appointments you make before you sign in. It lasts up to 90 days from your last visit.
• csl_customer keeps you signed in. It lasts up to 30 days from your last visit, and ends when you sign out.
• csl-analytics-consent remembers whether you accepted or rejected analytics cookies, so we don’t keep asking. It stays in your browser until you clear it.
• Small notes in your browser’s storage that save your place, such as an unfinished T-shirt design or a half-written review. They stay on your device.

Analytics, only if you accept.

• _ga and a second cookie starting _ga_ are set by Google Analytics to tell visits apart. They last up to 2 years.

The first time you visit, our cookie banner asks you to accept or reject analytics cookies. If you reject, or haven’t chosen yet, we set no analytics cookies, and Google Analytics receives only limited anonymous information without them, such as the page you viewed. If you accept, Google Analytics sets its cookies, and if you are also signed in we give Google an internal account number, never your name or email address, so that visits from your different devices can be counted together. You can change your choice at any time with Cookie settings at the bottom of every page.

We don’t use advertising cookies. You can also block or delete cookies in your browser settings, but the basket and sign-in need the essential ones to work. Google explains how it handles analytics data at policies.google.com/privacy.

9. Your rights

Under the UK GDPR you have the right to:

• be told how we use your information, which is what this policy is for;
• access the information we hold about you and get a copy of it;
• correct anything that is wrong or incomplete;
• have it erased, in some cases. We may need to keep order records because the law says so;
• restrict how we use it, in some cases;
• take it with you: get the information you gave us in a common format, or have it sent to another company, where we use it to carry out our contract with you or because you agreed;
• object to us using it for our legitimate interests;
• withdraw your consent at any time where we rely on it, such as for analytics cookies. This doesn’t affect what we did before.

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects.

How to use your rights. You can change your name, phone number and saved addresses yourself in your account, and you can delete your reviews there. For anything else, including a copy of your information or deleting your account, get in touch through our contact page or write to us at the shop address, and tell us the email address on your account and any order number involved. We may ask you to confirm who you are first, so that we never give your information to someone else. It costs nothing, and we reply within one month. If your request is complicated we may need longer, and we will tell you why.

When we delete an account, we remove the sign-in, saved addresses, basket, sign-up and password codes, reviews with their photos, and the notes our team made about you. Your orders and appointments stay, because they are the shop’s records, but they no longer belong to an account. We also keep a short record that the account was deleted, and by whom, so we can show it was done.

10. How we keep your information safe

• Our website uses an encrypted connection (HTTPS).
• Passwords and sign-in codes are stored scrambled, never as typed, and so are the tokens your browser’s sign-in cookies hold.
• Card details never reach our servers.
• Uploaded photos are stored privately and shown only to you and our team.
• Our team can open only the parts of our system that their job needs, and what they change is logged.
• We limit repeated sign-in attempts and filter out spam.

No system is completely secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner’s Office, as the law requires.

11. Children

Our website is for adults. We don’t knowingly collect information from children under 13 through accounts of their own, and if we find we have, we will delete it. Parents and guardians can order passport photos and prints of their children. We use those photos only to make the order.

12. Complaints

If you are unhappy with how we have used your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. Changes to this policy

We update this policy when what we do with your information changes, for example when we add a new service or provider. If a change matters to you, we will tell you. This version is from November 2026.

14. Contact us

Camera Shop London (Stuart Cameras), 221 Whitechapel Road, London E1 1DE. For any question about this policy or your information, use our contact page.