Privacy Policy

01. Who is responsible

Varnell Lens is responsible for information it handles to manage inquiries, accepted projects and its business operations. Its contact address is 3140 PARISA DR, PADUCAH, KY 42003, United States. Privacy questions and requests may be sent to projects@varnelllens.com.

When a client supplies photographs containing personal information for processing on its instructions, the client may be responsible for deciding why that information is processed. Varnell Lens may act as a service provider or processor for that work. The project agreement and applicable law determine each party’s role; this notice does not replace a required data processing agreement.

02. Information you provide directly

If you contact us by email or another agreed communication method, we may receive your name, email address, business or project name, correspondence, image count, intended use, requested delivery date and editing instructions. For an accepted project, we may also receive billing information, invoice records and the files or references needed to perform the work.

Please provide only information relevant to the project. We do not need passwords, bank login credentials, payment security codes, identity documents or unrelated financial information for ordinary photo processing. Avoid including unnecessary personal or sensitive information in file names, comments or source photographs.

03. The current project form

The project form supplied on this website checks required fields and displays a confirmation in your browser. It does not send the entered project details to Varnell Lens, submit an email, upload photographs, collect payment or create an accepted order. Its fields are not written to local storage or a cookie by the custom form code.

The information remains in the open page until it is cleared, the page is closed or the browser discards it; your browser may separately offer its own autofill features. A confirmation on this local form should not be treated as evidence that we have received a message. To arrange services, contact projects@varnelllens.com. If a transmitting form is introduced, this notice will be updated to describe that change.

04. Technical information from website visits

The storefront hosting platform may process ordinary request information when you load the website, such as IP address, browser and device characteristics, requested page, referring information, timestamps and security-related events. Information may be used to deliver the page, maintain platform security and diagnose service problems.

The site uses Shopify storefront infrastructure. Themes, platform features and installed apps can affect what technical information is processed. Optional analytics or advertising collection, if enabled, is subject to the applicable notices and choices. The custom section code does not add advertising pixels, an analytics SDK or a visitor profiling system.

05. Photographs and file metadata

Submitted project files may contain visible people, names, product identifiers, location details or metadata such as capture time and camera information. We handle the information in those files as part of the agreed image processing, rather than asking for it as an unrelated profile of the person shown.

Clients should have an appropriate legal basis and permissions to supply photographs and request changes. Tell us before transfer if a set contains personal information subject to special handling instructions. We do not offer facial recognition, identification of individuals or biometric profiling as part of the services described on this site.

06. Why information is used

Information received directly from you may be used to answer an inquiry, assess source quality, prepare a quote, define a specification, communicate about a project, perform and review the editing, deliver the final files, issue invoices and address service concerns. We may also use relevant records to protect systems, investigate misuse, resolve disputes and meet legal obligations.

We do not use client source photographs for public promotion without separate permission. They are not made available for unrelated model training through the custom website code. If a project requires a separate service or processing method with different data implications, that arrangement must be disclosed and agreed before the relevant files are transferred.

07. Legal grounds where required

Where a privacy law requires a legal basis, project communications and service delivery may be necessary to take steps at your request before a contract or to perform an accepted contract. Recordkeeping may be necessary for a legal obligation. Security, ordinary business administration and responding to appropriate inquiries may rely on a legitimate interest where that basis is available and balanced against your rights.

Where consent is required for optional tracking or another particular activity, we will rely on the applicable consent rather than assume that use of the website gives unlimited permission. You may withdraw consent through the available controls or contact details. Withdrawal does not affect processing that was lawful before it occurred.

08. Service providers and other disclosures

We may use providers of storefront hosting, email, secure file transfer, storage, editing tools, professional administration and payment processing where needed for an accepted service. A provider should receive only the information reasonably needed for its role and be subject to appropriate contractual or legal requirements. Access to client files should be restricted to people who need it for the work.

Information may also be disclosed if required by a lawful request, to establish or defend a legal claim, to protect rights and security, or as part of a legitimate business transfer subject to appropriate protections. We do not sell project contact details or photographs as a separate commercial product. We do not use the custom sections to share personal information for targeted advertising.

09. Shopify and platform settings

Shopify may process information to operate its storefront services and, depending on the merchant’s enabled settings, for other platform functions. Installed apps, Shopify Network Intelligence and optional marketing tools can affect that processing. Where an optional feature is used, the storefront’s disclosures and customer privacy settings should reflect it.

This policy describes the custom sections and ordinary project arrangements; it does not declare that every possible Shopify feature or app is inactive. The Cookie Policy explains the distinction between the custom code and platform-dependent storage. Privacy choices offered by the storefront apply to the activities covered by those controls.

10. Payments and records

Payment for an accepted project is arranged separately from the project form. If a third-party payment provider is used, it processes the transaction information under the arrangement and its own applicable terms. We may retain an invoice, payment status, transaction reference and relevant business contact details for reconciliation and recordkeeping.

The custom form does not collect or store card details. Do not send complete card numbers or authentication credentials in project briefs or ordinary emails. Questions about an invoice should identify the invoice or project reference rather than disclose unrelated financial information.

11. Retention

We keep information for the period reasonably needed for the purposes described here, taking account of the project agreement, disputes, security needs and legal obligations. Unaccepted inquiries may be removed when they are no longer needed for a reasonable follow-up period. Business correspondence and invoices may need a different retention period from working photographs.

Unless a project agreement specifies otherwise, working image files are scheduled for deletion 90 days after final delivery. A specific deletion request or contractual instruction will be considered in light of the applicable obligations. Backup copies may remain until the relevant backup cycle expires and should not be used for unrelated purposes. This service is not permanent photo storage; retain your own originals and delivered files.

12. Security and transfer methods

We use reasonable technical and organizational measures appropriate to the information and the work. These may include access controls, agreed transfer methods, limiting file access and reviewing the providers used for a project. We do not claim that every communication channel is equally suitable for confidential material.

No transmission or storage method can be guaranteed to be completely secure. If a project has special confidentiality, access, location or deletion requirements, raise them before transferring the files so an appropriate arrangement can be agreed. Avoid sending sensitive material through a channel that has not been approved for that purpose.

13. International processing

We operate from the United States, and service providers or project personnel may process information in other locations depending on the arrangements used. Privacy rules in a processing location may differ from those in your location. Applicable transfer requirements will be addressed where they apply to the information and service.

Where required, appropriate contractual safeguards or another legally recognized mechanism will be used for an international transfer. Contact us before supplying files if your organization requires processing in a specified country or needs a particular transfer agreement. We do not assume that a website visit alone approves unrestricted use of client files.

14. Your choices and privacy rights

Depending on your location, the type of information and whether the relevant law applies, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, or opt out of certain advertising, sale or profiling activities. These rights may be subject to lawful exceptions, including obligations to keep financial records or protect other people’s information.

Send a request to projects@varnelllens.com describing the information and right involved. We may ask for proportionate information to verify the request and your authority. Do not send an identity document unless we have explained why a particular verification method is necessary. An authorized representative may act where permitted, subject to reasonable proof of authority.

We will respond within the period required by the applicable law and explain a lawful refusal or extension where relevant. Where the Kentucky Consumer Data Protection Act applies, authenticated rights requests are generally addressed within 45 days; a permitted extension may add 45 days with notice. Where that law provides an appeal right, you may appeal a refusal using the same contact address and identifying the decision. The appeal response period is generally 60 days. A denied appeal will include the available method for contacting the Kentucky Attorney General.

15. Photographs processed for a client

If your information appears in a photograph supplied by one of our clients, contact the client responsible for that collection where possible. The client determines the project purpose and may need to decide how a rights request affects its files. We will cooperate with a relevant client and applicable legal requirements within our service-provider role.

If you do not know which client is involved, contact us with enough information to understand the request without distributing the photograph unnecessarily. We will assess what assistance we can provide while protecting the information and rights of other parties.

16. Children, marketing and automated decisions

The services and project request tools are intended for adults arranging photo processing. We do not knowingly collect project inquiries directly from children under 13. If you believe a child has supplied information directly to us, contact us so the circumstances can be reviewed and appropriate action taken.

We do not add you to a marketing list merely because you prepare a request. Any future marketing activity will be subject to its applicable notice and choices. The custom website form does not make decisions with legal or similarly significant effects about you and does not carry out biometric profiling.

17. Changes and questions

This policy may be updated when the website, processing arrangements or applicable obligations change. The revised date will appear at the top of the page. Where the law requires additional notice or consent for a material change, we will provide it.

You may raise a privacy concern through the contact details below. Where applicable, you may also contact the supervisory authority or other regulator responsible for data protection in your jurisdiction. This policy does not restrict a right to make a lawful complaint.