Privacy Policy – Sercombe Photography

Introduction

Sercombe Photography ("we", "us" or "our") is committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains how we collect, use, store and share personal information when you enquire about our photography services, make a booking, purchase photographs or otherwise interact with our business.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

Who We Are

Business name: Sercombe Photography

Email: grace@sercombephotography.co.uk

Sercombe Photography provides professional photography services, including the creation, management and delivery of photographic images, prints and digital downloads.

For any questions about how we handle your personal information, please contact us using the email address above.

What Personal Data We Collect

Depending on the services you request, we may collect and process the following categories of personal information:

Names and contact details
Postal and delivery addresses
Photographs and video recordings containing identifiable individuals
Records of meetings, discussions and decisions
Booking and order information
Information contained within correspondence relating to our services
Information required to arrange the delivery of prints or digital photographs

We aim to collect only the information reasonably necessary to provide our services and manage our relationship with customers.

Why We Collect and Use Personal Data

We collect and use personal information for the following purposes:

To respond to enquiries about our photography services
To arrange and manage photography bookings
To communicate with clients before, during and after photography sessions
To provide photography services and deliver completed images
To process orders for photographic prints and digital downloads
To manage customer accounts and maintain appropriate business records
To maintain records of client discussions, instructions and decisions
To respond to customer questions, concerns or requests
To manage payments and associated financial administration
To fulfil our contractual obligations to customers

We will only use personal information for the purposes for which it was collected or for another compatible purpose permitted by law.

Lawful Bases for Processing

Under UK data protection law, we must have an appropriate lawful basis whenever we process personal information.

Depending on the circumstances, we rely upon the following lawful bases:

Consent – Where you have given us permission to process your personal information for a specific purpose, such as certain uses or publications of photographs.

Contract – Where processing is necessary to enter into or fulfil a contract with you. This includes arranging photography sessions, maintaining booking information, communicating about services and delivering photographs or prints.

Where we rely upon consent, you may withdraw that consent at any time. Withdrawal will not affect processing undertaken lawfully before consent was withdrawn.

Other lawful bases, such as legal obligation, may apply to particular processing activities where required by applicable legislation.

Photography and Image Usage

As a photography business, photographs are central to the services we provide.

Photographs containing identifiable individuals may constitute personal data under UK GDPR.

We collect, create and process photographic images primarily to fulfil our contractual commitments to clients.

Photographs may be processed for purposes including:

Capturing images during photography sessions
Editing and preparing photographs
Organising and managing photographic galleries
Making photographs available for viewing, selection and purchase
Delivering digital images and photographic prints
Maintaining appropriate records of completed photography work

Where photographs are used for purposes beyond the original photography service, such as advertising, social media or promotional portfolios, we will ensure that an appropriate lawful basis exists and obtain consent where required.

We recognise that photographs may contain identifiable individuals other than the person who originally booked our services. We will take appropriate care when handling and publishing these images.

Where We Obtain Personal Information

We obtain personal information directly from individuals.

This may include information provided when:

Contacting us about photography services
Making a photography booking
Discussing photography requirements
Purchasing prints or digital downloads
Communicating with us about an existing booking or order

We do not routinely obtain personal information from third-party data brokers or unrelated organisations.

Sub-Processors and Third-Party Systems

We use third-party technology providers to support our photography services and business operations.

These include:

Pic-Time – Used to manage photographic galleries and facilitate orders for photographic prints and digital downloads.

PayPal – Used to facilitate payments for photographic prints and digital downloads.

Wedola – Customer relationship management (CRM) software used to maintain client contact information and
support the management of customer relationships.

Google (Gmail) – Used for email communications with clients and other business contacts.

These providers may process personal information in connection with the services they provide.

Depending on the service, providers may act as data processors on our behalf or as independent data controllers for certain activities, such as payment processing.

We take reasonable steps to ensure that service providers handling personal information have appropriate data protection and security arrangements in place.

Sharing Personal Data

We do not sell personal information to third parties.

We may share personal information where reasonably necessary to deliver our services, including with:

Pic-Time for photographic gallery management and print or download orders
PayPal for payment processing
Wedola for customer relationship management
Google for email communications
Other service providers where necessary to fulfil an agreed order or service
Relevant authorities where disclosure is required by law

We will only share the personal information necessary for the relevant purpose.

International Data Transfers

Although we do not routinely disclose personal information directly to organisations overseas, some of the technology providers we use may store, access or process personal information outside the United Kingdom.

This may include providers such as Pic-Time, PayPal, Wedola and Google, depending on their infrastructure, service configurations and sub-processors.

Where personal information is transferred outside the UK, we will ensure that an appropriate legal transfer mechanism is in place in accordance with UK data protection law.

Depending on the destination and circumstances, these safeguards may include:

UK adequacy regulations
The UK International Data Transfer Agreement (IDTA)
The UK Addendum to the EU Standard Contractual Clauses (SCCs)
Other legally recognised international transfer mechanisms

Where appropriate, we will also consider whether additional contractual, technical or organisational safeguards are necessary to protect personal information.

Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including the delivery of photography services and compliance with applicable legal, contractual and financial obligations.

Retention periods will take account of:

The duration of the customer relationship
The nature of the photography services provided
The period required to fulfil orders and deliver photographs
Any contractual arrangements concerning photographic images
Applicable legal and financial record-keeping requirements
The need to manage complaints or resolve disputes
The establishment, exercise or defence of legal claims

Photographs and associated customer information will not be retained indefinitely without an appropriate purpose or lawful basis.

When personal information is no longer required, we will securely delete, destroy or anonymise it, as appropriate.

Data Security

We take the protection of personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

Password-protected systems and accounts
Appropriate access controls
Secure cloud-based services
Encryption and other security protections provided by our technology suppliers
Restricting access to customer information to those who reasonably require it
Appropriate management of client photographs and digital files
Secure handling of booking and payment information
Reviewing the security arrangements of third-party service providers

We aim to ensure that personal information is handled confidentially and securely throughout the photography and order fulfilment process.

Children's Personal Data

We do not knowingly collect personal information directly from children as part of our normal business administration.

However, photographs taken during photography sessions may include children, depending on the nature of the services requested.

Where photographs of children are captured or processed, we will ensure that appropriate arrangements are in place, including obtaining permission from a parent or person with parental responsibility where required.

Photographs of children will not be used for unrelated promotional purposes without an appropriate lawful basis and any necessary permissions.

Your Data Protection Rights

Under UK data protection law, you have certain rights in relation to your personal information.

These include:

Right to be informed – You have the right to understand how and why we use your personal information.
Right of access – You can request a copy of the personal information we hold about you.
Right to rectification – You can ask us to correct inaccurate or incomplete personal information.
Right to erasure – You can request deletion of your personal information in certain circumstances.
Right to restrict processing – You can ask us to restrict how your information is used in certain circumstances.
Right to object – You can object to certain processing activities where applicable.
Right to data portability – You may request your information in a portable format where the relevant legal conditions apply.
Right to withdraw consent – Where we rely upon consent, you may withdraw it at any time.

These rights are not absolute and may depend on the circumstances and the lawful basis for processing.

To exercise any of your rights, please contact us.

We will respond to requests in accordance with applicable data protection legislation, normally within one calendar month.

How to Complain

If you have any concerns about how we collect, use, store or share your personal information, we encourage you to contact us in the first instance.

We will take your concerns seriously and aim to investigate and resolve any issues promptly and fairly.

You can contact us at:
Sercombe Photography

Email: grace@sercombephotography.co.uk

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent authority responsible for upholding information rights and enforcing data protection legislation.

Information Commissioner's Office (ICO)

Website: https://www.ico.org.uk

Telephone: 0303 123 1113

You do not need to contact us before raising a complaint with the ICO, although we welcome the opportunity to resolve any concerns directly.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, technology providers, business operations or legal obligations.

Where appropriate, the latest version will be made available through our website or provided upon request.

The current version of this privacy policy is dated October 2026.