Privacy policy.

Last Updated: June 2026

This Privacy Policy describes how your personal information is collected, used, and shared when you book a session, complete a questionnaire, or interact with Gareth Hilton (referred to as "I", "me", or "the Photographer").

As a sole trader operating in the UK, I am the "Data Controller" of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. What Personal Data I Collect

When you engage with my photography services, I collect the following information:

  • Identity & Contact Data: Your full name, email address, phone number, and home/delivery address.

  • Shoot & Family Details: Information gathered via Google Forms questionnaires, which may include the names and approximate ages of family members (including children under 18) to plan the session, alongside your style preferences.

  • Visual Data: The photographs taken during your session, which constitute personal visual data.

  • Communication Data: Records of emails via Gmail, Google Meets data (scheduling logs), and notes stored within my client management system (Notion).

2. How and Why I Use Your Data (Lawful Basis)

Under the UK GDPR, I must have a valid legal reason to process your data. I use your data for the following reasons:

Purpose for Processing.

  • To manage bookings, fulfill our shoot, and deliver prints/digital files. 

    • Contractual Necessity: Required to fulfill the contract we have entered into

  • To use images on my business website or social media to promote my business. 

    • Consent / Legitimate Interest: Relies on the terms agreed in our contract (and strict parent/guardian sign-off for minors)

3. How Your Data is Shared and Transferred

I do not sell your data. I only share your information with trusted third-party services necessary to run my business and deliver your images:

 * Google Workspace: I use Google Forms to collect questionnaires, Gmail for communication, Google Meets for virtual meetings, and Google Drive for secure data storage.

* Adobe Creative Cloud: I use Adobe Creative Cloud services to back up digital image files.

* Notion.so: I use a Notion as a Client Management System to track bookings and order history.

* External Professional Printers: Your contact details and delivery address will be shared with printers to ship physical prints directly to you if you request this.

International Data Transfers: Some of these services (such as Google and Adobe) store data on servers located outside the UK (e.g., in the US). I ensure these providers use approved legal safeguards, such as Standard Contractual Clauses (SCCs), to protect your data.

4. Data Retention: How Long I Keep Your Data

 * Contact & Questionnaire Data: Kept in Client Management Systems/Google Drive for up to 5 years from your last shoot for administrative and tax purposes, or until you request deletion.

 * Photographs: Permanently archived securely on Google Drive/Adobe Creative Cloud and Hard Drives so you can request replacement copies in the future, unless you explicitly request their destruction.

 * Website Gallery/Social Media: Permanently available or until you withdraw your consent.

5. Security of Your Data

I take the security of your family's data very seriously. All digital tools I use (Google Workspace, Client Management Systems, and cloud storage services) are password-protected and use Two Factor Authentication where available.

6. Your Legal Rights

Under UK data protection laws, you have rights regarding your personal data, including:

 * The Right to Access: You can request a copy of the personal data I hold about you.

 * The Right to Rectification: You can ask me to correct any inaccurate information.

 * The Right to Erasure ("Right to be Forgotten"): You can ask me to delete your personal data (subject to my legal obligations to keep financial records).

 * The Right to Object: You can object to your data being used for direct marketing.

To exercise any of these rights, please contact me directly at gareth@ghphotographic.com.

If you are unsatisfied with how I handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (www.ico.org.uk).