I collect and process personal information so I can run my business, respond to enquiries, deliver photography services, and manage bookings.

1. Information you may provide

Name – to identify you and communicate with you. Lawful basis: Contract; Legitimate interests.
Email address – to respond to enquiries, send booking details, deliver galleries, and (only with consent) send marketing emails. Lawful basis: Contract; Consent; Legitimate interests.
Telephone number – for communication about your session or booking. Lawful basis: Contract; Legitimate interests.
Home address (where relevant, e.g., for in‑home sessions) – to attend your session. Lawful basis: Contract.
Information relating to your photography session (e.g., family details, preferences, event information). Lawful basis: Contract; Legitimate interests.
Children’s names or relevant details – only when needed for family photography. Lawful basis: Contract; Legitimate interests; Consent from parent/guardian.
Photographs and digital images – these are personal data when a person can be identified. Lawful basis: Contract; Consent (for optional uses such as marketing).
Enquiry form information – to respond to your message. Lawful basis: Legitimate interests.
Payment information – processed securely by Stripe or PayPal. I do not store card details. Lawful basis: Contract.

2. Information collected automatically

My website may collect:
Basic technical information (e.g., browser type, device type)
Usage data (e.g., pages visited)
Analytics data (e.g., Google Search Console, Hotjar)
This helps me understand how the website is used and improve it. Lawful basis: Legitimate interests. Full details are available in my Cookie Policy.

1. Photographs

Photographs are personal data when an individual can be identified. I process images to:

• Carry out your photography session
• Edit and deliver your gallery
• Provide downloads
• Manage your booking
• (With your explicit consent) use selected images for my portfolio, website, social media or marketing

I never use client images for marketing without a signed consent/permission form. Parents or legal guardians must provide consent for children.

2. Client Galleries

Client galleries are hosted through Pixieset. Galleries are:

• Password‑protected
• Accessible only to you and anyone you choose to share the link with
• Removed after the retention period listed below
• Manage your booking
• (With your explicit consent) use selected images for my portfolio, website, social media or marketing

3. Image Delivery

Images are delivered digitally through Pixieset. No physical media (USBs, prints) are used unless agreed separately.

4. Image Archiving

I may keep edited images for a longer period for:

• My portfolio (only with consent)
• Re‑delivery if you lose your files
• Business records
• Legal or tax purposes
• I delete rejected RAW files much earlier, as they are not needed once the final gallery is delivered.

4. Children’s Personal Data

I photograph children only when a parent or legal guardian is present. For children:

• I only collect information necessary for the session (e.g., first names).
• Photographs of children are treated with extra care.
• Consent for any optional use (e.g., marketing) must be given by a parent or legal guardian.
• Children’s data is never used for marketing without explicit permission.

5. How I use your Personal Data

I use personal data to:

• Respond to enquiries
• Manage bookings
• Provide photography services
• Deliver galleries
• Communicate about your session
• Process payments
• Maintain business records
• Improve my website
• Send marketing emails (only with consent)
• I do not sell personal data.

6. Third Party Providers

I use trusted third‑party services to run my business. These providers process personal data on my behalf:

• Pixieset – client galleries, booking management, client information
• Stripe – secure payment processing
• PayPal – secure payment processing
• OneDrive – secure cloud storage
• Mailerlite – email marketing (newsletter)
• Facebook & Instagram – communication and marketing
• Google Search Console – website performance analytics
• Hotjar – website behaviour analytics

Each provider has its own privacy policy, and your data may be processed according to their terms.

7. Payment Processing

Payments are securely processed by Stripe or PayPal. I do not store or have access to your full payment card details.

8. Data Storage & Security

Your information may be stored on:

• Pixieset (client galleries and booking information)
• OneDrive (secure cloud storage)
• My password‑protected laptop

I take reasonable steps to keep your data secure, including:

• Password protection
• Secure cloud storage
• Limited access
• Regular updates and security measures
  

9. Marketing & Newsletter

I may send marketing emails or newsletters only if you have opted in. You will not be added to marketing lists automatically.
You can unsubscribe at any time using the link in the email.
My email marketing provider is Mailerlite.

10. Social Media

If you contact me through Facebook or Instagram, your messages and profile information may be visible to me. Any data shared on those platforms is also subject to Facebook’s and Instagram’s own privacy policies.
I may share portfolio images on social media only with your signed consent.

11. Cookies

My website may use cookies to improve functionality and analyse usage. For full details, please see my Cookie Policy.

12. Data Retention

I keep personal data only for as long as necessary.

• General enquiries: 12–24 months
• Rectify inaccurate information
• Contracts & consent forms: 6 years (recommended for legal/tax reasons)
• Invoices & financial records: 6 years (HMRC requirement)
• Photographs (final edited images): 2–5 years or longer if needed for portfolio (with consent)
• RAW files: Deleted within 6–12 months after final gallery delivery
• Online galleries: Typically available for 6 months (customisable)
• Marketing subscriptions: Until you unsubscribe

These periods may be adjusted depending on business needs or legal requirements.

13. Your Rights

Under UK data protection law, you have the right to:

• Access your personal data
• Rectify inaccurate information
• Request erasure (where applicable)
• Restrict processing
• Object to certain types of processing
• Data portability (where applicable)
• Withdraw consent at any time (for consent‑based processing)
• Complain to the ICO if you believe your data has been mishandled: www.ico.org.uk

I will respond to all valid requests within one month.

14. Changes to this policy

This Privacy Policy may be updated occasionally to reflect changes in law or business practices. The “Last Updated” date will always be shown at the top.

15. Contact me

If you have any questions about this Privacy Policy or how your data is handled, you can contact me at:
Karen Simmonds Photography

Email: hello@karensimmonds.co.uk

Website: www.karensimmonds.co.uk