1. Who We Are
Scheherazade Photography (referred to as “we”, “us”, or “our” in this policy) is a photography business operated by a sole trader in the United Kingdom. We are the Data Controller for the personal data we collect and use in connection with our services. This means we are responsible for deciding how and why your personal data is processed.
If you have any questions about this privacy policy or how we handle your personal data, you can contact us at:
2. What Personal Data We Collect and How We Use It
We collect and process personal data for specific purposes related to running our photography business.
a) Information You Provide to Us
When you contact us via our website contact form or directly by email, you may provide:
- Name
- Email address
- Phone number
- Details about your photography requirements (e.g., event type, date, location, specific requests)
How we use this data: We use this information to respond to your enquiry, provide quotes, discuss your photography needs, and arrange our services.
Legal Basis: We process this data on the basis of Legitimate Interests (to respond to and manage business enquiries) and Contractual Necessity (if you proceed to book our services, we need this data to perform the contract). For initial enquiries, our legitimate interest is to determine if we can provide the service you are seeking.
b) Information We Collect Automatically (Cookies and Tracking Technologies)
When you visit our website, we may use cookies and tracking technologies to collect technical data about your visit. This can include your IP address, browser type, device information, pages you viewed, and how you arrived at our site.
We use the following types of technologies:
- Google Analytics: Helps us understand how visitors use our website so we can improve it and analyse its performance.
- Facebook (Meta) Pixel: Helps us understand the effectiveness of our advertising, measure conversions, and show relevant content on Facebook and Instagram.
- Jetpack: A WordPress plugin that provides multiple features, including:
- Jetpack Stats: Tracks visitor numbers and page views, setting cookies such as tk_ai and tk_lr on your browser.
- Site security, backups, and performance modules: These primarily operate on the server side to protect and speed up the website.
- Other optional features like related posts or social sharing may also set cookies depending on which modules we have activated.
Legal Basis: Our use of strictly necessary cookies is based on Legitimate Interests (to ensure the website functions correctly). For all other non-essential cookies, including analytics (Google Analytics and Jetpack Stats), marketing (Facebook Pixel), and social sharing cookies, we rely on your Consent, which you give by actively selecting your preferences on our cookie banner. These scripts are blocked by default until you accept the relevant category.
c) Client Data and Photographs
When you become a client, we will collect and process additional personal data necessary to deliver our services. This may include:
- Billing and address information for invoicing and accounting.
- Project notes and shoot details.
- Photographs that may include you, your family, or event attendees.
How we use this data: This data is used to fulfil our contract with you (delivering the agreed photography service), manage our accounts, and maintain business records as required by law.
Legal Basis: The processing of this data is based on Contractual Necessity (to provide the services) and Legal Obligation (for tax and accounting purposes). Where we process photographs for legal or business record-keeping, this is in our Legitimate Interests.
Using Your Photographs: Our business relies on showcasing our work to market our services. If we wish to use your photographs (which may contain your image) in our portfolio on our website, social media, or in other marketing materials, we will only do so with your explicit Consent. You will have the opportunity to provide this separately, and you have the right to withdraw that consent at any time.
3. Sharing Your Personal Data
We will never sell, rent, or trade your personal data. We may share your data with trusted third parties who help us operate our business and provide our services, including:
- Website hosting providers (to host our website).
- Analytics providers (such as Google Analytics).
- Marketing providers (such as Meta/Facebook for the Facebook Pixel).
- Automattic Inc. (the provider of Jetpack), which processes data on its US-based infrastructure. Automattic self-certifies under the EU-US Data Privacy Framework and includes Standard Contractual Clauses in its Data Processing Agreement as a safeguard for data transfers.
- Accountancy software and accountants (for financial management and legal compliance).
- Printing labs or other suppliers (where relevant to fulfilling your project).
All third-party providers we use are required to process your data securely and only in accordance with our instructions and UK data protection law.
4. How Long We Keep Your Data
We only retain personal data for as long as is necessary for the purposes for which it was collected, or as required by law. Our typical retention periods are:
- Enquiry Data: Retained for up to 12 months if no booking is made.
- Client and Project Files: Retained for at least 1 year after the service is completed, to satisfy legal and accounting requirements. Raw files are deleted upon image delivery.
- Financial Records (Invoices): Retained for 6 years (as required by HMRC).
- Marketing and Analytics Data: Retained until you withdraw your consent or as determined by the third-party tools we use (e.g., Jetpack’s cookie retention periods).
5. Your Data Protection Rights
Under UK data protection law, you have the following rights concerning your personal data. You can exercise these rights by contacting us using the details in Section 1.
You have the right to:
- Access your personal data.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data (the “right to be forgotten”), where legally applicable.
- Restrict or object to our processing of your data.
- Withdraw consent at any time (where we are relying on consent as our legal basis).
- Request data portability (to receive a copy of your data in a structured format).
- Lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority, if you are unhappy with how we have handled your data.
6. Data Security
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect it from accidental loss, unauthorised access, alteration, or disclosure. This includes using secure hosting, SSL encryption on our website, and limiting access to data to authorised personnel only. Third-party providers like Automattic (Jetpack) also implement industry-standard security measures.
7. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
