PRIVACY POLICY

Peter Shortt Photography

Last updated: August 2026

1. DATA CONTROLLER INFORMATION

Peter Shortt Photography is the data controller responsible for your personal information under UK data protection laws (UK GDPR and the Data Protection Act 2018).

● Trading Name: Peter Shortt Photography

● Data Controller: Peter Shortt

● Trading Address: Unit 1A, Sugnall Business Centre, Sugnall, Staffordshire, ST21 6NF

● Email Address: peter@petershorttphotos.com

● Telephone: +44 7460 162362

● Website: www.petershorttphotos.com

● ICO Registration Number: ZC219422

2. Information We Collect

We only collect personal information that is reasonably necessary to provide photography services, fulfill orders, and communicate with you:

● Contact Data: Name, email address, telephone number, postal address.

● Booking Details: Event details, location, date, time, and specific client requirements.

● Transaction Data: Order history, payment status, invoicing details (we do not store payment card numbers directly).

● Digital & Media Data: Photographs, digital image files, gallery access credentials, and specific privacy or restriction requests.

● Technical Data: IP address, browser type, and standard website usage analytics collected through our website.

3. Lawful Bases for Processing Data

Under UK GDPR, we process personal data using the following legal bases:

● Contractual Obligation: Processing necessary to deliver booked photography services, process orders, manage client accounts, or take pre-contractual steps at your request.

● Legitimate Interests: Processing required to operate, showcase, and promote our photography business, manage records, and defend legal rights—provided your fundamental rights do not override these interests.

● Legal Obligation: Processing necessary to satisfy UK tax laws (HMRC record-keeping) and regulatory requirements.

● Consent: Specific permission granted by you (e.g., for direct email marketing). Consent can be withdrawn at any time without financial penalty or detriment.

4. Photographs and Image Processing

Photographs taken in public, private, or commercial settings can contain personal data where individuals are identifiable.

● Event Photography: Photographs taken at public, sporting, or community events rely on our legitimate business interests. Event organisers are expected to notify attendees that photography is taking place.

● Portfolios & Promotion: Identifiable photographs are displayed on our website, portfolio, or social media based on legitimate interests or explicit contractual agreement.

● Under 18s : We exercise extra care when photographing under 18s. Where photography involves under18s, appropriate parental/guardian consent or organiser authorization is secured. Any removal request submitted by a parent or guardian will be actioned promptly.

5. Online Client Galleries

We use secure, password-protected online client galleries to display and distribute images.

● Access links and passwords must remain confidential and not be shared beyond authorised viewers.

● While robust technical security measures are in place, no online transmission can guarantee absolute security.

● Access to galleries may be restricted or expired in line with agreed client retention windows.

6. Sharing Your Data (Third Parties)

We do not sell personal data. We share necessary data only with trusted third-party service providers acting as data processors, including:

● Gallery & Hosting Platforms: Online image gallery hosting services are Squarespace and Photodeck

● Print Laboratories: Professional photo print and framing fulfilment partners.

● Payment Processors: Secure merchant payment platforms Stripe and PayPal.

● Business Services: Cloud backup, accounting software, IT/security providers, and professional advisors.

● Legal Authorities: Regulatory or legal bodies where required by law.

7. International Data Transfers

Some third-party platforms (e.g., US-based gallery tools or cloud backups) store data outside the UK. When data is transferred internationally, we ensure appropriate legal safeguards are active, such as the UK Extension to the EU-US Data Privacy Framework, UK International Data Transfer Agreements (IDTA), or UK ICO Adequacy Decisions.

8. Data Retention Periods

We retain personal data only for as long as necessary to fulfill operational and legal obligations:

● Financial & Accounting Records: Retained for 7 years to comply with UK HMRC tax regulations.

● Enquiry Records (Unconverted): Deleted after 12 months.

● Online Client Galleries: Retained online for 12 months post-event (or as specified in your booking agreement).

● Archived Photographs: Stored in secure digital archives for portfolio, historical, and copyright purposes under legitimate interests, unless a valid erasure request is granted.

9. Your Legal Data Rights

Under UK GDPR, you have the following rights regarding your personal information:

● Right of Access: Request a copy of the personal data held about you (Subject Access Request).

● Right to Rectification: Request correction of inaccurate or incomplete data.

● Right to Erasure: Request deletion of personal data where no legal overriding reason exists to keep it.

● Right to Object / Restrict: Object to direct marketing or restrict processing under specific conditions.

● Right to Data Portability: Request transfer of provided personal data to another controller in a structured format.

● Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time free of charge by contacting us. (Withdrawal does not affect processing conducted prior to withdrawal).

10. Cookies and Website Analytics

Our website uses essential functional cookies and non-essential analytical cookies to improve performance and user experience. Non-essential cookies are only enabled with your consent via our website banner. You can modify your preferences via browser settings at any time.

11. Security Measures

We implement appropriate technical and organisational safeguards to prevent unauthorized access, loss, or disclosure of data, including encrypted cloud storage, multi-factor authentication, and restricted physical device access.

12. Complaints and Regulator Contact

If you have questions about this policy or wish to exercise your rights, please contact Peter Shortt Photography directly via the contact details listed in Section 1.

You also have the right to lodge a privacy complaint with the UK data protection authority:

● Regulator: Information Commissioner's Office (ICO)

● Website: www.ico.org.uk

● Helpline: 0303 123 1113