Privacy Policy


This privacy notice tells you what to expect me to do with your personal information.

Contact details


I am the data controller for the personal information I collect and use.


You can contact me by:

Telephone: 07440013161

Email: hello@katielangfordphotography.com

What information I collect, use, and why


I collect or use the following information to provide services and goods, including delivery:

  • Names and contact details
  • Addresses 
  • Information about children, such as names and ages
  • Payment details, such as information relating to bank transfers
  • Photographs or video recordings
  • Session/questionnaire information


For complimentary model or portfolio sessions, I also use the information provided in the application to assess suitability and arrange the session. Where a session takes place, the resulting photographs may be used for my professional portfolio and marketing.


I collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Address
  • Payment details such as information relating to bank transfers
  • Purchase or service history
  • Customer or client accounts and records
  • Financial transaction information
  • Correspondence

Lawful bases and data protection rights


Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.


Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:



If you make a request, I must respond to you without undue delay and in any event within one month.


To make a data protection rights request, please contact me using the contact details at the top of this privacy notice.

My lawful bases for the collection and use of your data


My lawful bases for collecting or using personal information to provide services and goods are:


  • Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests – I’m collecting or using your information because it benefits you, my business or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are: To manage and administer my photography business, including maintaining client records, managing enquiries and bookings, communicating with clients and providing my photography services efficiently. This helps me to provide a professional and consistent service while only using personal information that is relevant and necessary for these purposes. For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.


My lawful basis for collecting or using photographs for portfolio and marketing purposes is:


  • Consent – I may use photographs from your session on my website, social media and other marketing materials where you have given permission for me to do so. You can withdraw your consent at any time by contacting me.


My lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:


  • Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests – I’m collecting or using your information because it benefits you, my business or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are: To respond to enquiries, resolve complaints and manage any claims relating to my photography services. This allows me to provide appropriate support to clients and protect my business interests while only using personal information that is relevant to the matter being addressed. For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

Where I get personal information from


  • Directly from you
  • Publicly available sources

How long I keep information


I keep personal information only for as long as it is necessary for the purpose for which it was collected, or where I have a legal or legitimate business reason to retain it.


Information relating to enquiries that do not result in a booking is generally retained for up to 12 months after my last contact with you.


Client booking, contract and financial records are retained for as long as necessary to meet my legal and business obligations.


Online galleries are generally retained for a minimum of two years following delivery and may be removed after this time.


Photographs may be retained for longer where necessary for professional record keeping, backup purposes or, where permission has been given, for my portfolio and marketing.


I periodically review the personal information I hold and securely delete information that I no longer need.

Who I share information with


Data processors:

Pixieset

This data processor does the following activities for me: Client management, contact forms, booking, invoicing and online photo galleries

Squarespace

This data processor does the following activities for me: Website hosting and website forms

Microsoft / Outlook

This data processor does the following activities for me: Email and business communications

Canva

This data processor does the following activities for me: Design and creation of marketing materials


Others I may share personal information with:

  • Professional or legal advisors, where necessary
  • Relevant regulatory authorities, where required
  • Organisations I’m legally obliged to share personal information with
  • Photographs may be shared publicly on my website, social media or other marketing and information media where permission has been given

Sharing information outside the UK


Where necessary, my data processors may share personal information outside of the UK. When doing so, they must comply with the UK GDPR and ensure that appropriate safeguards or transfer mechanisms are in place.


Organisation name: Pixieset

Category of recipient: Client management, booking, invoicing and online photography gallery provider

Country the personal information is sent to: Canada and other countries where Pixieset or its subprocessors may process personal information.

How the transfer complies with UK data protection law:  Pixieset states in its Data Processing Agreement that where personal data is transferred outside the EEA, transfers will be carried out using mechanisms recognised under applicable data protection legislation as providing an adequate level of protection.


Organisation name: Squarespace

Category of recipient: Website hosting provider

Country the personal information is sent to: United States and other countries where Squarespace or its subprocessors operate

How the transfer complies with UK data protection law: Squarespace, Inc. is certified under the UK Extension to the EU-US Data Privacy Framework, which provides a lawful basis for transfers of personal information from the UK to the United States. Where applicable, Squarespace also uses the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.


Organisation name: Microsoft/ Outlook

Category of recipient: Email and business communications provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Microsoft Corporation is certified under the UK Extension to the EU-US Data Privacy Framework, which provides a lawful basis for transfers of personal information from the UK to the United States.


Organisation name: Canva

Category of recipient: Design and creation of marketing materials using client photographs

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Canva uses the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum for transfers of personal information from the UK.

Cookies


Cookies are small files placed on your device when you visit a website. My website uses cookies to provide essential functionality and to help the website operate effectively.

Strictly necessary cookies are required for the website to function and help with things such as security and remembering your cookie preferences. These cookies do not require your consent.

My website does not currently use optional analytics, advertising or personalisation cookies.

When you first visit my website, a cookie banner allows you to accept or reject optional cookies and manage your preferences. You can also manage or delete cookies through your browser settings.

How to complain


If you have any concerns about my use of your personal information, you can make a data protection complaint to me:


Email: hello@katielangfordphotography.com

Telephone: 07440013161


If you remain unhappy with how I’ve used your data after raising a complaint with me, you can also complain to the ICO. 


The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF


Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint