Privacy Policy

Effective date: 16 February 2025

At By Sophie Photography your privacy matters. This policy explains what personal information we collect, why we collect it, and what you can do about it, in line with the UK General Data Protection Regulation.

1. Who is responsible for your data

By Sophie Photography is the data controller for the information described here.

TO CONFIRM: a postal address for the controller. UK GDPR requires the controller’s identity and contact details, and an email address alone is thin for a notice of this kind.

Questions about anything on this page: hello@bysophiephotography.co.uk.

2. What we collect

Information you give us:

• Your name, email address and, if you provide one, a telephone number, when you use a contact or enquiry form
• What your enquiry is about, and anything you write in the message
• Your name, email address and billing details when you buy photographs — card details are handled entirely by our payment provider and never reach us
• Your name, email, telephone number and your dog’s details when you book a shoot

Information collected automatically:

• Basic technical information your browser sends, such as the pages you visit and roughly where in the world you are
• Cookies and similar technologies — see section 5

3. What we use it for

• Answering enquiries and arranging shoots
• Taking payment, delivering your photographs and supporting you afterwards
• Keeping records we are required to keep, such as for tax
• Improving the website and the service

We only send marketing where you have asked us to. Every marketing email carries an unsubscribe link, and unsubscribing takes effect immediately.

4. Why we are allowed to

• Contract — arranging a shoot, taking payment and delivering photographs.
• Consent — marketing email, and any non-essential cookie. You can withdraw it at any time.
• Legitimate interests — answering an enquiry you sent us, keeping the website secure and working, and understanding how it is used.
• Legal obligation — keeping financial records for as long as the law requires.

5. Cookies and similar technologies

Two things are kept on your device without asking, because the site does not work otherwise. One small cookie remembers the choice you make in the cookie banner. Your basket is held in your own browser rather than sent to us, so the photographs you have picked survive moving from page to page. Neither identifies you, and neither leaves your device.

Everything else waits until you say yes. Accept analytics and the site loads a self-hosted tool that counts visits and pages; it sets no cookies of its own and does not identify anybody. Accept advertising and an advertising provider may set cookies to measure whether an advert brought you here. Decline either and it is never requested at all — not fetched and then told to behave, but not fetched in the first place.

You can change your mind whenever you like, using the Cookie settings link at the foot of any page. Withdrawing consent stops anything further being set; anything already stored can be cleared through your browser.

6. Who else sees it

We do not sell your personal data and we never will. We do use a small number of service providers to run the site, each of which only processes what it needs to and is bound to protect it:

• Our payment provider, which takes payments and holds the card details we never see
• Our email provider, which sends order confirmations, booking confirmations and download links
• Our hosting and storage providers, where the website and the photographs live
• Our analytics provider, which counts visits and pages — self-hosted, and loaded only if you accept analytics

We may also disclose information where the law requires it. Some of these providers operate outside the UK; where they do, the transfer is covered by the safeguards UK data protection law requires.

7. How long we keep it

We keep personal information only as long as we need it, and then delete it securely.

TO CONFIRM: the actual periods, which this build already knows: how long order records and the contacts attached to them are kept, that unsold original files are deleted two years after a shoot, that purchased originals are kept indefinitely, and that database backups roll on a ninety-day cycle. Stating real numbers is both more useful and more defensible than "as long as necessary".

8. Your rights

Under UK data protection law you have the right to:

• Ask what personal data we hold about you, and get a copy
• Have anything inaccurate corrected
• Ask us to delete it
• Ask us to restrict how we use it, or object to our using it
• Receive it in a portable form
• Withdraw consent at any time, where consent is what we relied on

To exercise any of these, email hello@bysophiephotography.co.uk. We will respond within one month.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, though we would always rather you came to us first so we can put it right.

9. Photographs of you and your pets

Photographs from a private shoot are yours. We will not use an image from your session for promotion — on the website, in the portfolio or on social media — without asking you first.

Photographs taken at a public event are a different matter: they are offered for sale in a gallery so that the people in them can buy them. Those galleries are unlisted and kept out of search results. If you appear in one and would rather not, email hello@bysophiephotography.co.uk and the photograph will be removed.

10. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed, and any substantial change will be made clear on this page.

11. Contact

Email hello@bysophiephotography.co.uk with anything at all about your data.