At Paul's Photos we are committed to protecting your personal data. This privacy notice explains how we look after your personal data when you visit our website or hire our photography services in the UK, in accordance with the UK GDPR and Data Protection Act 2018.

Information we collect

We collect, store, and use the following categories of personal information:

• Identity data: First name, last name, and title.

• Contact data: Email address, telephone number, and billing/delivery address.

• Image data: Photographs, digital images captured during your session.

How we use your information

We only use your personal data when the UK law allows us to. Most commonly, we use your data under the following legal bases:

• Contract performance: To deliver the photography services you have booked.

• Legitimate interests: To manage our business relationships and maintain internal administrative records.

• Consent: To publish your images in our public portfolio or social media, which we will always ask for via a separate signed release.

Data storage and security

We take data security seriously to prevent your personal data from being accidentally lost or accessed without authorization:

• UK retention: We retain financial and contract data for 6 years following the end of the tax year to comply with HMRC regulations.

• Digital galleries: Your image data is stored on secure, password-protected hard-drives.