1. Introduction and company information
This Privacy Policy explains how Northlight Portrait Studio Ltd collects, uses, discloses, stores, and protects personal data when you visit our website, contact us, make enquiries, book services, attend our photo studio, purchase products, or otherwise interact with us.
The data controller responsible for your personal data is Northlight Portrait Studio Ltd, a photo-studio business operating in the United Kingdom.
Company name: Northlight Portrait Studio Ltd
Registered / business address: Unit 4, 18 Frederick Place, Brighton, BN1 4EA, UK
Email: [email protected]
Phone: +44 1273 845 962
We aim to handle personal data lawfully, fairly, and transparently in accordance with applicable privacy laws.
2. Data collection and processing
We may collect and process the following categories of personal data:
- Identity data: name, title, and, where relevant, names of family members or participants in a photography session.
- Contact data: email address, telephone number, postal address, and other communication details.
- Booking and transaction data: session details, appointment times, service selections, purchase history, payment status, invoices, and receipt information.
- Image and media data: photographs, videos, audio recordings, and related content captured during photo sessions, including edited and unedited versions where applicable.
- Communication data: correspondence with us by email, telephone, forms, social media, or in person.
- Technical data: IP address, browser type, device identifiers, pages visited, and log information collected through our website or digital systems.
- Preference data: style preferences, session requirements, accessibility needs, and other information you choose to share to help us provide our services.
- Special category data: in limited cases, photographs or information may reveal sensitive details such as health, ethnicity, religion, or other protected characteristics. We only process such data where necessary and permitted by law, and with appropriate safeguards.
We may collect personal data directly from you, from persons booking on your behalf, from payment and booking systems, from our website, or from third-party service providers involved in delivering our services.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and provide information about our services;
- to manage bookings, appointments, studio visits, and related customer service;
- to deliver photography, editing, printing, digital delivery, and related services;
- to communicate with clients about sessions, orders, proofs, and delivery;
- to process payments, issue invoices, and manage accounts;
- to maintain our business records and administer our operations;
- to use images with your consent for portfolio, marketing, social media, website, or promotional purposes;
- to improve our website, services, customer experience, and internal processes;
- to protect our rights, property, staff, and clients, including preventing fraud and misuse;
- to comply with legal, tax, accounting, and regulatory obligations.
4. Legal basis for processing
We only process personal data where we have a valid legal basis to do so. Depending on the circumstances, our legal bases include:
- Contract: where processing is necessary to enter into or perform a contract with you, such as providing photography services, managing bookings, and delivering products.
- Legal obligation: where processing is required to comply with applicable laws, including tax, accounting, consumer, and record-keeping obligations.
- Legitimate interests: where processing is necessary for our legitimate business interests, such as operating and improving our services, maintaining security, managing communications, and defending legal claims, provided these interests do not override your rights and freedoms.
- Consent: where we rely on your consent, such as for certain marketing communications, use of images for promotional purposes, or processing of special category data where required by law.
- Vital interests or public interest: only in exceptional circumstances where legally applicable.
Where we process special category data, we will only do so where an additional lawful condition applies, such as your explicit consent or another condition permitted by law.
5. Data sharing and third parties
We may share personal data with third parties where necessary for the purposes described in this Policy. These may include:
- Service providers: website hosting, email services, cloud storage, customer relationship management, booking platforms, IT support, and analytics providers;
- Payment processors: providers that handle card or online payment transactions;
- Print and fulfilment partners: laboratories, printers, retouchers, framers, couriers, and delivery providers;
- Professional advisers: accountants, lawyers, insurers, and auditors;
- Public authorities: law enforcement, courts, regulators, or other bodies where required by law;
- Marketing and communications platforms: where we use consent-based or legitimate-interest tools to communicate with clients or showcase work.
We require third parties to process personal data securely and only for specified purposes, and where appropriate under written contractual arrangements. We do not sell personal data.
6. Data transfer to third countries
Some of our service providers may store or process personal data outside the United Kingdom or the European Economic Area. Where this occurs, we take appropriate steps to ensure that any transfer is protected by suitable safeguards, which may include:
- adequacy regulations or decisions where available;
- standard contractual clauses or equivalent transfer mechanisms;
- supplementary technical and organisational measures where necessary.
By using our services, you acknowledge that certain personal data may be transferred internationally in accordance with applicable legal requirements and safeguards.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, insurance, and reporting requirements.
Typical retention periods may include:
- Client enquiry data: kept for a reasonable period after the enquiry unless a longer period is required for follow-up or legal reasons;
- Booking and transaction records: retained for the duration of the contractual relationship and thereafter in line with legal and tax obligations;
- Images and session files: retained according to the service agreement, your preferences, storage limitations, and business needs;
- Marketing consent records: retained until you unsubscribe, withdraw consent, or we no longer need the record to demonstrate compliance;
- Website logs and technical data: retained for a limited period for security, diagnostics, and analytics.
When personal data is no longer required, we will delete, anonymise, or securely archive it in accordance with our retention practices.
8. User rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: the right to request confirmation of whether we process your personal data and to receive a copy of that data;
- Rectification: the right to request correction of inaccurate or incomplete personal data;
- Erasure: the right to request deletion of your personal data in certain circumstances;
- Restriction: the right to request that we limit processing in certain situations;
- Data portability: the right to receive certain data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller;
- Objection: the right to object to processing based on legitimate interests, including profiling where applicable, and to object at any time to direct marketing.
To exercise any of these rights, please contact us using the details set out below. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
If you withdraw consent for the use of images for marketing or portfolio purposes, we will stop any future use of those images for that purpose, although previously published materials may not always be fully removable from all channels or third-party platforms.
10. Right to complain
If you are concerned about how we handle your personal data, please contact us first so that we may try to resolve the matter promptly and fairly.
You also have the right to lodge a complaint with the relevant supervisory authority. In the United Kingdom, this is typically the Information Commissioner's Office (ICO).
We encourage you to contact us before making a formal complaint, but you are entitled to contact the supervisory authority directly.
11. Data security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures may include:
- access controls and password protection;
- secure storage and encryption where appropriate;
- role-based access to client files and systems;
- staff confidentiality obligations and training;
- regular backups and system maintenance;
- procedures for responding to suspected security incidents.
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You should also take care when sharing information with us electronically.
12. Contact information
If you have questions about this Privacy Policy, wish to exercise your rights, or want to contact our data controller, please use the details below:
Northlight Portrait Studio Ltd
Unit 4, 18 Frederick Place
Brighton, BN1 4EA
United Kingdom
Email: [email protected]
Phone: +44 1273 845 962
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we process personal data. Any updated version will be posted on our website with a revised effective date where appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how Northlight Portrait Studio Ltd protects your personal data.