Privacy policy & Notice
Gareth Jones, trading as Gareth Jones Photography, is the data controller for the personal information described in this notice.
We are committed to handling personal information lawfully, fairly and transparently in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.
This notice explains what information we collect, why we use it, who we may share it with, how long we keep it, how we protect it and the rights you have.
If you have any questions about this notice or how we use your personal information, please contact:
Gareth Jones Photography
07730 572130
We do not sell personal information.
We may share personal information only where necessary to provide our photography services, operate the business, comply with the law or protect our legal rights. This may include trusted providers of website hosting, email, client management systems, online galleries, cloud storage, backups, payment processing, accounting, printing, delivery and image editing services.
These providers are permitted to use personal information only where necessary to provide their services and are expected to handle it lawfully and securely.
Some service providers may store or process personal information outside the UK. Where this happens, we take reasonable steps to ensure that an approved transfer mechanism or other appropriate safeguard is in place.
Information we collect
Depending on the service being provided, we may collect:
• names, postal addresses, email addresses and telephone numbers;
• enquiry, booking and photography session details;
• contracts, correspondence and client instructions;
• invoice, payment and transaction information;
• image selections, order details and gallery activity;
• photographs and video in which individuals can be identified;
• information supplied by a business, school, nursery, event organiser or other organisation arranging photography; and
• technical information generated when someone visits our website, such as device, browser and website usage information.
We collect information directly from clients and people making enquiries. For corporate, school, nursery and event photography, information may also be provided by the organisation arranging the photography.
Photography and image information
Photographs and video may be personal information where an individual can be identified.
We use photographs and related information to organise and carry out photography sessions, identify images, edit and process photographs, manage selections and orders, deliver finished images, maintain backups and respond to replacement or reorder requests.
We do not use private client images for unrelated promotional purposes unless this has been agreed with the client or we otherwise have a valid lawful basis.
We take additional care with identifiable images of children and do not use them for our own website, portfolio, social media or advertising without appropriate permission.
Lawful bases for using personal information
We use personal information only where we have an appropriate lawful basis.
The lawful bases most relevant to our work are:
• taking steps at someone’s request before entering into a contract;
• performing a contract;
• complying with a legal obligation;
• pursuing our legitimate business interests, provided those interests do not override an individual’s rights; and
• consent, where consent is appropriate for the particular use.
1. Contract and steps before entering into a contract
When you make an enquiry, request a quotation, make a booking or purchase a photography service, we use the information you provide to:
• respond to your enquiry;
• prepare quotations and booking information;
• arrange and carry out the photography;
• communicate with you about the assignment;
• edit, process and deliver images;
• manage image selections, galleries, orders and reorders;
• take payment and issue invoices; and
• provide support after the photography has been completed.
The lawful basis is taking steps at your request before entering into a contract or performing our contract with you.
The completion of the contract does not necessarily mean that all related information will be deleted immediately. Some information may need to be retained for accounting, legal, backup, reorder or legitimate business purposes.
2. Consent
We rely on consent only where it is appropriate for the particular use.
This may include optional marketing communications or particular uses of identifiable photographs for our portfolio, website, social media or other promotional material.
Where we rely on consent, the person may withdraw that consent at any time by contacting:
Withdrawing consent does not affect processing that was lawful before the consent was withdrawn.
3. Legitimate interests
We may use personal information where it is necessary for our legitimate business interests, provided that those interests are not overridden by the rights and interests of the individual.
This may include:
• administering and improving our photography services;
• maintaining appropriate business records and backups;
• protecting our website, devices, accounts and systems;
• preventing fraud or misuse;
• responding to queries, complaints and requests;
• retaining reasonable records relating to completed photography assignments; and
• establishing, exercising or defending legal claims.
Before relying on legitimate interests, we consider whether the use of personal information is necessary, proportionate and something the individual would reasonably expect. We take particular care where information relates to children.
4. Legal obligations
We may use or retain personal information where necessary to comply with a legal obligation.
This may include maintaining tax and accounting records, responding to lawful requests from courts, regulators, law enforcement or tax authorities, and complying with other legal or regulatory requirements that apply to the business.
5. Website usage and cookies
Our website and its service providers may collect technical information such as IP address, browser or device type, pages viewed, referral source and approximate location.
We use this information to operate and secure the website, understand how it is used and improve its performance.
The website uses essential cookies that are necessary for it to function. It may also use analytics, advertising or embedded-content cookies.
Where consent is required, non-essential cookies are used only after the visitor has made a choice through the website’s cookie banner. Visitors can accept, reject or manage non-essential cookies using the cookie settings available on the website or through their browser settings.
6. Data protection complaints
If you have a concern or complaint about how we have collected, used, stored or shared your personal information, please contact us at:
We will acknowledge a data protection complaint within 30 days of receiving it. We will investigate the complaint without undue delay, keep you informed where appropriate and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how we have handled your personal information.
Information Commissioner’s Office:
Telephone: 0303 123 1113
7. Children’s information
We provide photography services involving children, but bookings and purchases must be made or authorised by a parent, guardian, school, nursery or other responsible organisation.
We may receive a child’s name, class or group information, order information and photographs from a parent, guardian or the organisation arranging the photography.
We use this information only where necessary to organise, create, identify, process, deliver and administer the agreed photography service.
When photography is arranged by a school, nursery or other organisation, we work in accordance with the agreed instructions and privacy arrangements for that assignment.
We take additional care when handling children’s information. Identifiable images of children will not be used in our own portfolio, website, social media or advertising without appropriate permission.
8. Legal disclosures
We may disclose personal information where required or permitted by law.
This may include disclosures to courts, law enforcement bodies, regulators, tax authorities or other public authorities where they have a lawful reason to request the information.
9. How we protect personal information
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures include password-protected devices and accounts, access controls, appropriate backups, software updates and the use of reputable service providers.
Access to client information and images is limited to people and service providers who reasonably need access to provide the photography service or operate the business.
If a personal data breach occurs, we will investigate it, take appropriate steps to contain it and notify the affected client, affected individuals or the Information Commissioner’s Office where legally required.
10. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purposes described in this notice.
Enquiry information that does not lead to a booking is periodically reviewed and deleted when it is no longer needed.
Booking records, contracts, correspondence and client instructions may be retained for as long as needed to provide the service, answer subsequent queries, handle complaints or protect our legal rights.
Invoices, payments and accounting records are kept for at least the period required by tax and accounting law.
Photographs and working image files may be retained in a secure archive where there is a reasonable purpose, including providing replacements or reorders, maintaining backups, handling complaints or legal claims, or continuing an agreed portfolio use.
We periodically review retained information and delete or anonymise it when there is no longer a reasonable business, contractual or legal reason to keep it.
11. Your data protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
• ask for access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict how information is used;
• object to certain uses of personal information;
• ask for certain information to be transferred to you or another organisation; and
• withdraw consent where consent is the lawful basis.
These rights are not absolute and there may be circumstances in which we are legally entitled or required to continue keeping or using information.
To exercise your rights, contact:
We may ask for information to confirm your identity. We will respond without undue delay and normally within one month.
Last updated: 13 July 2026
