gareth welch photography
Privacy Policy
Last updated: 05 / 01 / 2026
1) Who we are
Gareth Welch Photography (“we”, “us”, “our”) is the data controller for the personal data described in this notice.
Contact email: contact@garethwelchphotography.co.uk
This privacy notice explains how we collect, use, store, and share personal data when you enquire about or book photography services, use our website, or access your online gallery. (This notice is provided to meet the UK GDPR transparency requirements.) 
⸻
2) What personal data we collect
Depending on how you interact with us, we may collect:
• Identity & contact details: name, email address, phone number, employer (if relevant to your booking)
• Booking details: session date/time, location, preferences, and communications
• Images & media: photographs (and potentially video) in which you may be identifiable, plus related selection notes
• Payment details: payment status, invoices/receipts and transaction references (payments are processed by Stripe — we do not store full card details)
• Website data: IP address, device/browser information, and cookie/analytics data (where enabled and consented)
⸻
3) How we use your data, and our lawful basis
UK GDPR requires we have a lawful basis for processing personal data. 
We typically use the following bases:
A) Contract (to provide photography services) 
We use your data to:
• respond to enquiries and manage bookings
• provide the photos/galleries you’ve paid for (or that are otherwise agreed)
• take payment and provide invoices/receipts
• provide customer support and handle issues relating to delivery
B) Legitimate interests (to run and protect the business) 
We may use your data to:
• keep business records, manage accounts, and prevent fraud
• maintain service quality (eg, learning what clients prefer)
• store and back up galleries securely
• show our work in a portfolio / marketing where this is reasonable and expected, and/or where you’ve agreed via a model release or written permission
Where we rely on legitimate interests, we consider the impact on your privacy and your reasonable expectations.
C) Consent (where you have a real choice)
We will rely on consent for:
• non-essential cookies/analytics (eg Google Analytics) 
• a future mailing list/newsletter (you can unsubscribe at any time)
⸻
4) Marketing, portfolio use, and model releases
If you participate in a shoot where images may be used for our portfolio/marketing, we will normally confirm this via a model release or other written agreement. If you later object to use of a particular image, contact us and we’ll consider your request (see “Your rights” below).
⸻
5) Who we share your data with (processors)
We only share personal data where needed to deliver services or run the business. This may include:
• Pixieset (website hosting / client galleries / image delivery) 
• Stripe (payment processing) 
• Professional advisers where necessary (eg accountant), and/or HMRC where legally required
We do not sell your personal data.
⸻
6) International transfers
Some of our suppliers may process personal data outside the UK. Where international transfers apply, we rely on appropriate safeguards provided by those suppliers (for example, Stripe’s contractual transfer protections). 
⸻
7) How long we keep your data
We keep personal data only for as long as necessary for the purposes described.
Standard retention: 24 months from the date of your session or last meaningful contact, unless we need to keep certain records for longer (eg for accounting/legal obligations).
After this, we will delete or anonymise it where reasonably possible.
If you want earlier deletion of a gallery or specific images from our systems, contact us and we’ll review your request.
⸻
8) How we protect your data
We use reasonable technical and organisational measures designed to protect personal data, such as access controls, secure passwords, reputable service providers, and backups. No system is 100% secure, but we work to reduce risk appropriately for a small business.
⸻
9) Cookies and Google Analytics
Our website may use cookies and similar technologies. Analytics cookies (including Google Analytics) are not strictly necessary and require consent. 
When enabled, we will:
• show a cookie banner allowing you to accept/reject non-essential cookies
• not set analytics cookies unless you consent
• provide a way to change cookie preferences
⸻
10) Your data protection rights
You have rights under UK GDPR, including:
• access to your personal data
• correction of inaccurate data
• erasure (in some circumstances)
• restriction or objection to processing (especially where we rely on legitimate interests)
• data portability (where applicable)
• withdrawal of consent (where consent is the lawful basis)
To exercise your rights, email: contact@garethwelchphotography.co.uk
You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO).
⸻
11) Updates to this policy
We may update this notice from time to time to reflect changes in services or legal requirements. The “Last updated” date at the top will show when changes were made.