Privacy Policy
How we protect and handle your information
Last updated: 3 November 2025
Introduction
Sian Jane Photography ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.
Data Controller:
Sian Cook trading as Sian Jane Photography
Email: hello@sjc-photography.co.uk
Note: As a sole trader photographer, we process limited personal data and are exempt from ICO registration under the Data Protection (Charges and Information) Regulations 2018.
Information We Collect
We may collect the following types of information:
Personal Information: Name, email address, phone number, and any other information you provide when contacting us or booking our services.
Event Information: Wedding date, venue details, and other information relevant to your photography booking.
Usage Data: Information about how you use our website, including IP address, browser type, and pages visited.
Lawful Basis for Processing
We process your personal data under the following lawful bases in accordance with UK GDPR:
Contract Performance (Article 6(1)(b)): Processing booking details, event information, and payment data to fulfil photography services you have contracted with us.
Legitimate Interests (Article 6(1)(f)): Website analytics to improve user experience, fraud prevention, and website security. Our legitimate interest is balanced against your rights; you may object at any time.
Consent (Article 6(1)(a)): Marketing communications (you may withdraw consent at any time) and use of images for promotional purposes (separate explicit consent obtained).
Legal Obligation (Article 6(1)(c)): Retaining financial records for tax purposes as required by HMRC.
How We Use Your Information
We use the information we collect to:
Provide and manage our photography services
Communicate with you about bookings and enquiries
Improve our website and services
Send you marketing communications (with your consent)
Photography and Image Rights
We require your explicit, freely-given consent to use photographs featuring you or your guests for business purposes.
Consent for Image Use: Prior to your event, we will provide a separate Image Consent Form. You may grant or withhold consent for specific uses (portfolio, social media, marketing). Consent is optional and does not affect our provision of photography services.
Withdrawal of Consent: You may withdraw consent at any time by emailing hello@sjc-photography.co.uk. Withdrawal does not affect images used before withdrawal. We will remove images within 30 days of your request.
Third-Party Consent: For guests appearing in photographs, you confirm that you will inform them of our intended use of images, direct them to our Privacy Policy, and obtain their consent where reasonably practicable.
Uses for which we may seek consent:
Portfolio and promotional materials
Social media and website galleries
Marketing and advertising purposes
We maintain records of all consents in accordance with UK GDPR requirements.
Marketing Communications
We may send you marketing communications about our services, special offers, and photography tips.
Obtaining Consent: We will only send marketing emails if you have opted in via our contact form checkbox or explicitly requested updates. Consent is optional and does not affect our provision of services. We will never sell your data to third parties for marketing.
Withdrawing Consent: You may unsubscribe at any time by clicking the "unsubscribe" link in any marketing email or by emailing hello@sjc-photography.co.uk with "Unsubscribe" in the subject line. We will process your request within 2 working days.
Frequency: We typically send marketing emails no more than once per month.
Cookies
This website does not use cookies. However, our third-party analytics provider (Vercel Analytics) may use minimal, anonymised data collection that does not require cookie consent under UK GDPR.
Data Retention
We retain your personal data only for as long as necessary:
Enquiry Data (no booking): 2 years from last contact
Booking and Event Data: 7 years from event date (to comply with tax and contract law requirements)
Payment Information: 7 years (HMRC requirement)
Marketing Data: Until you unsubscribe or 3 years from last engagement, whichever is earlier
Images for Portfolio: Retained indefinitely with your consent; removed within 30 days of consent withdrawal
After these periods, we securely delete or anonymise your data.
Data Protection and Security
We implement appropriate technical and organisational measures to protect your personal information:
Technical Measures:
SSL/TLS encryption for data in transit
Encrypted data storage
Secure password-protected systems
Regular security updates and patches
Organisational Measures:
Access to personal data restricted to authorised personnel only
Regular review of security procedures
Secure disposal of data when no longer required
Limitations: No method of transmission over the internet is 100% secure. While we implement industry-standard security measures, we cannot guarantee absolute security. We encourage you to protect your own devices and credentials.
Data Breach Notification: In the unlikely event of a data breach affecting your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.
Third-Party Services
We use the following third-party services to operate our website and communicate with you:
Vercel (Hosting & Analytics): Our website is hosted on Vercel. We use Vercel Analytics and Speed Insights to monitor website performance and improve user experience. These services collect anonymised usage data.
Data processed: Anonymised usage data, IP addresses
Location: Data may be processed in the USA and EU
Safeguards: Vercel complies with EU-US Data Privacy Framework and uses Standard Contractual Clauses (SCCs)
Privacy Policy: vercel.com/legal/privacy-policy
Brevo (Email Communications): We use Brevo to send transactional emails (such as contact form responses and booking confirmations). Your email address and message content are processed by Brevo to deliver these communications.
Data processed: Email addresses, names, message content
Location: Data processed within the EU (Frankfurt, Germany servers)
Safeguards: GDPR-compliant processor within UK/EEA
Privacy Policy: brevo.com/legal/privacypolicy
International Transfers: Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place through Standard Contractual Clauses approved by the ICO, adequacy decisions, or other lawful transfer mechanisms under UK GDPR Chapter V.
Your Rights
Under UK GDPR, you have the right to:
Access your personal data
Request correction of inaccurate data
Request deletion of your data (in certain circumstances)
Object to processing of your data
Request restriction of processing
Data portability (receive data in a structured format)
Withdraw consent at any time (where processing is based on consent)
Right to Complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk/make-a-complaint
To exercise these rights, please contact us at hello@sjc-photography.co.uk
Children's Privacy
Website Use: This website is not directed at children under 13. We do not knowingly collect personal data from children under 13 via our website.
Photographs Including Children: If photographs include children under 16, we require parental or guardian consent for use of images. Consent must be obtained by the contracting party (parent/guardian).
If you believe we have inadvertently collected a child's data without proper consent, please contact us immediately at hello@sjc-photography.co.uk.
Questions?
If you have any questions about this Privacy Policy, we'd be happy to help.
hello@sjc-photography.co.uk