Privacy Policy for alexsmale.co.uk

Last updated: 16 November 2025
Website: alexsmale.co.uk
Owner: Alex Smale (“I”, “me”, “my”)

I respect your privacy and am committed to protecting your personal data. This privacy policy explains how I collect, use, and protect your information when you visit alexsmale.co.uk, make an enquiry, or work with me as a photography client.

By using this website, you agree to the practices described in this policy.

1. Who I Am

I am a photographer based in the UK.

If you have any questions about this policy or your data, you can contact me at:

Email: [your email here]
Postal address (if applicable): [your business address here]

I am the data controller for the personal data collected through this website and in the course of my photography services.

2. What Data I Collect

2.1 Data you provide directly

When you contact me or book my services, you may provide:

Contact details: name, email address, phone number, address
Event / shoot details: date, location, type of event, timings, key participants
Business details: company name, job title (if relevant)
Payment information: transaction details (handled via my payment provider – I do not store full card details)
Preferences & notes: special requests, style preferences, accessibility needs, consent preferences for image use
Account details (if you have an online gallery account): username, password (encrypted)

2.2 Data I collect automatically

When you visit alexsmale.co.uk, I may automatically collect:

Usage data: pages visited, time spent, clicks, navigation paths
Technical data: IP address, browser type and version, device type, operating system, approximate location (city/region level)
Cookies and similar technologies: see Section 7 – Cookies for more info

This information helps me improve the website and understand how people use it.

2.3 Photographic images

As a photographer, I also collect and process:

Photographs and video footage taken during shoots or events
Metadata related to images (date, location, camera settings, etc.)

In some cases, images may constitute personal data, especially if individuals can be identified.

3. How I Use Your Data

I will only use your personal data where I have a lawful basis to do so. The main purposes are:

3.1 To provide my services

Responding to enquiries and messages
Providing quotes and booking confirmations
Planning and managing shoots and events
Delivering photos and products (online galleries, prints, albums, etc.)

Legal basis: performance of a contract or steps taken at your request before entering a contract.

3.2 To manage my business

Invoicing and payment processing
Accounting, tax, and business administration
Record-keeping (e.g. contracts, releases, receipts)

Legal basis: legal obligation and legitimate interests.

3.3 To promote my work (portfolio, website, social media)

I may use selected images for:

My website and online portfolio
Social media (e.g. Instagram, Facebook, Pinterest, TikTok, etc.)
Printed marketing material
Competitions, publications, or awards submissions

Where necessary, I will rely on legitimate interests and/or seek explicit consent, especially for sensitive situations (e.g. children, private events, or where you specifically request discretion). You can object to this use at any time – see Section 9 – Your Rights.

3.4 To communicate with you

Responding to enquiries and client support
Sending important service-related information (e.g. gallery access, deadlines)
Sending marketing emails or updates if you’ve opted in

Legal basis: performance of a contract, legitimate interests, or consent (for marketing).

3.5 To improve this website

Monitoring site performance and troubleshooting issues
Analysing visitor behaviour to improve design, content, and services

Legal basis: legitimate interests.

4. Lawful Bases for Processing

Under the UK GDPR, I rely on one or more of the following lawful bases:

Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering a contract.
Legal obligation: where I must comply with a legal or regulatory obligation (e.g. tax records).
Legitimate interests: where processing is necessary for my legitimate business interests and your rights do not override those interests (e.g. portfolio use, basic analytics, business administration).
Consent: where you have given clear consent (e.g. for certain types of marketing or specific image usage). You can withdraw consent at any time.

5. How I Share Your Data

I do not sell your personal data.

I may share your data with trusted third parties who help me run my business, such as:

Website hosting and maintenance providers
Email service providers
Online gallery and file delivery platforms
Payment processors (e.g. Stripe, PayPal, etc.)
Printing labs and album suppliers (for physical products)
Accountants or legal advisors (for compliance and business purposes)

These third parties are only allowed to use your data to provide the services I request and must protect it in line with data protection laws.

If I am ever legally required to share data (for example, with law enforcement or tax authorities), I will do so in accordance with the law.

6. International Transfers

Some of my service providers may be located outside the UK or the European Economic Area (EEA). Where this happens, I will ensure that appropriate safeguards are in place, such as:

Using providers in countries deemed to have adequate data protection laws; or
Using standard contractual clauses or similar mechanisms approved by relevant authorities.

7. Cookies and Tracking Technologies

Like most websites, alexsmale.co.uk may use cookies and similar technologies to:

Make the site work properly
Remember your preferences (e.g. cookie choices)
Analyse how the site is used (e.g. via analytics tools)

7.1 Types of cookies

Strictly necessary cookies: required for core site functions. These cannot usually be disabled.
Performance / analytics cookies: help me understand how visitors use the site so I can improve it.
Functional cookies: remember your preferences and settings.
Marketing / third-party cookies (if used): track interactions with embedded content or social media (e.g. Instagram feed, video player, Facebook Pixel).

If I use non-essential cookies (for analytics or marketing), I will:

Show a cookie banner when you first visit; and
Allow you to accept or reject non-essential cookies.

You can also control cookies through your browser settings.

8. How Long I Keep Your Data

I keep personal data only for as long as necessary for the purposes it was collected, including to:

Fulfil contracts and deliver services
Respond to questions or complaints
Meet legal, tax, and accounting obligations
Maintain records of work and portfolio images

Typical retention periods:

Enquiry emails and basic contact data: up to 3 years after last contact
Contracts, invoices, and financial records: usually 6–7 years (to meet tax/legal obligations)
Client galleries and images: often stored indefinitely as part of my portfolio and to allow clients to re-order products, unless you specifically request deletion or there is a clear reason to remove them.

If you would like me to remove specific images or personal data, see Section 9 – Your Rights.

9. Your Rights

Under UK data protection law, you have the right to:

Access – request a copy of the personal data I hold about you.
Rectification – ask me to correct inaccurate or incomplete data.
Erasure – ask me to delete your personal data where it is no longer needed, or where you withdraw consent (subject to legal or contractual obligations).
Restriction – ask me to restrict how your data is used in certain circumstances.
Data portability – request your data in a structured, commonly used format so you can reuse it elsewhere (where applicable).
Object – object to processing based on legitimate interests, including use of your images for portfolio/marketing and certain types of profiling or analytics.
Withdraw consent – if I rely on consent (e.g. marketing), you can withdraw it at any time.

To exercise any of these rights, please contact me at [your email here]. I may need to verify your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how I handle your data:

ICO website: ico.org.uk

10. Children’s Data

My services are generally aimed at adults, though children may appear in photographs (e.g. family shoots, weddings, school events). Where children are photographed, I will obtain consent from a parent or legal guardian where required and take extra care in how those images are used and shared.

If you believe I have collected personal data about a child without appropriate consent, please contact me so I can address it.

11. Security

I take reasonable and appropriate steps to protect your personal data, including:

Using secure passwords and, where possible, two-factor authentication
Keeping software and systems updated
Using reputable third-party providers with appropriate security measures
Limiting access to personal data only to people who need it

However, no method of transmission over the internet or electronic storage is completely secure, so I cannot guarantee absolute security.

12. Third-Party Links

My website may contain links to other sites (for example, social media platforms, suppliers, or partners). I am not responsible for the privacy practices of those websites. I recommend you read their privacy policies before providing personal data to them.

13. Changes to This Policy

I may update this privacy policy from time to time to reflect changes in law or my business practices. The updated version will always be posted on alexsmale.co.uk with the “Last updated” date at the top.

14. How to Contact Me

If you have any questions about this privacy policy or your personal data, please contact:

Name: Alex Smale
Email: [your email here]
Website: alexsmale.co.uk