# Privacy Policy
**Last updated: 12 August 2026**
## 1. About this policy
This privacy policy explains how Kaizen Photography collects, uses, stores and shares personal information when you visit **kaizenphotography.co.uk**, contact us, create an account, make a booking, subscribe to our emails, work with us as a client or supplier, or otherwise interact with our photography business.
It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).
## 2. Who we are
Kaizen Photography is the trading name of Rowan Morgan, a sole trader. For the purposes described in this policy, Rowan Morgan trading as Kaizen Photography is normally the “data controller”. This means that we decide why and how your personal information is used.
Our contact details are:
**Kaizen Photography**
533 Middle Road
Swansea
SA5 8EG
United Kingdom
Telephone: **07720 656516**
You can also contact us using the contact form at **kaizenphotography.co.uk**. Please mark any privacy-related enquiry “Data protection request”.
In some client projects, a client or agency may decide the purposes and means of processing personal information contained in photographs, video or other project material. In those circumstances, that client or agency may be the controller and Kaizen Photography may act as its processor. The client’s privacy information and our agreement with that client will then also apply.
## 3. Personal information we collect
Depending on how you interact with us, we may collect the following information.
### Information you give us
- Your name, job title, business name and the organisation you work for.
- Your email address, telephone number, postal address and other contact details.
- Enquiry details, briefs, estimates, bookings, contracts, licences, model or property releases, approvals and project instructions.
- Information you provide through our contact form, booking tools, member account features, email, telephone, WhatsApp, social media or in person.
- Account details, such as your email address, password or other sign-in information. Passwords are managed through our website platform and are not available to us in readable form.
- Files and attachments you upload or send to us, including reference images, brand materials, product information, shot lists and other project assets.
- Billing details, transaction records, payment status and information needed to issue invoices and maintain tax records. If payment is made through a third-party payment provider, we do not normally receive or store your full payment-card details.
- Your newsletter subscription, marketing preferences and records of consent or opt-out requests.
- Feedback, reviews, testimonials, survey responses and records of complaints.
### Photography, video and audio
Photographs, video footage and audio may be personal information where an individual can be identified. We may process this material as part of a commission, test shoot, behind-the-scenes activity, portfolio, case study or other agreed project.
Where a shoot involves models, employees, customers, members of the public or children, the necessary information and permissions may be collected by us or by the commissioning client, agency, model agency, parent or guardian, depending on the arrangements for the project. If a client supplies us with personal information or identifiable content about another person, the client is responsible for ensuring that it is entitled to do so and that the person has received any privacy information required by law.
### Information collected automatically
When you visit our website, we and our service providers may collect:
- Your IP address and approximate location derived from it.
- Browser, device and operating-system information.
- Pages viewed, links followed, referring pages, date and time of visits and information about how the website performs.
- Cookie identifiers, consent choices and similar technical information.
- Security and diagnostic information used to prevent spam, fraud and misuse.
Please see section 10 for more information about cookies and similar technologies.
### Information from other sources
We may receive personal information from:
- A client, agency, colleague, employer, model agency, supplier or other person involved in a project.
- Publicly available business websites, professional directories, trade-event lists and professional social-media profiles when identifying relevant businesses and professional contacts.
- Website, email, booking, file-delivery, payment, accounting and fraud-prevention providers.
- Public authorities or professional advisers where necessary.
We do not normally seek special-category information, such as information about health, ethnicity, religion, political opinions or sexual orientation. If a project genuinely requires such information, we will only use it where an additional legal condition applies, such as explicit consent, and will take appropriate safeguards. We do not intentionally collect criminal-offence information unless it is necessary and lawful to do so.
## 4. How and why we use personal information
UK data protection law requires us to have a lawful basis for each use of personal information. We may use more than one basis where the circumstances require it.
### Enquiries, estimates and project planning
We use contact details, briefs and correspondence to respond to enquiries, discuss ideas, prepare estimates and take steps requested before entering into a contract.
Our lawful bases are **taking steps before entering into a contract** and our **legitimate interests** in responding to business enquiries and developing our services.
### Providing photography and related services
We use client, booking and project information to arrange shoots, provide creative direction, photograph or film products and people, carry out editing and retouching, obtain approvals, deliver files, manage revisions, return products and provide customer support.
Our lawful bases are **performance of a contract**, **taking steps before entering into a contract** and, where the contract is with an organisation rather than the individual concerned, our **legitimate interests** in delivering the commissioned service.
### Accounts, bookings and website features
We use account, booking and security information to create and administer member accounts, authenticate users, arrange appointments and provide any restricted website features.
Our lawful bases are **performance of a contract**, **taking steps before entering into a contract** and our **legitimate interests** in operating secure and convenient customer services.
### Payments, administration and legal records
We use contact, contract, invoice and transaction information to take payment, manage accounts, maintain business and tax records, deal with insurance, enforce agreements and establish, exercise or defend legal claims.
Our lawful bases are **performance of a contract**, **compliance with legal obligations** and our **legitimate interests** in running and protecting the business.
### Project archives, portfolios and promotion of our work
We may retain project material so that we can provide replacements, deal with queries, maintain a professional archive and, where permitted, display selected work in our website portfolio, social media, awards submissions, printed materials, presentations or case studies.
We will use commissioned work in accordance with the relevant contract, licence, release and any confidentiality obligations. Where material identifies an individual, our lawful basis may be our **legitimate interests** in documenting and promoting our creative work or **consent** where consent is appropriate or required. You may object to use based on legitimate interests, and you may withdraw consent at any time where consent is the basis used. Withdrawal does not make earlier lawful use unlawful.
### Newsletters and marketing
If you subscribe to our newsletter or otherwise ask to receive updates, we use your contact details and preferences to send news, offers, portfolio updates and information about our services. Our lawful basis is normally **consent**. Where the law permits, we may rely on the customer “soft opt-in” for similar services or on our **legitimate interests** when marketing to a corporate business contact, while also complying with PECR.
You can unsubscribe at any time by using the link in a marketing email or by contacting us. We may retain a minimal suppression record to make sure we continue to respect your choice.
### Relevant business-to-business contact
We may use publicly available professional contact information to introduce our commercial photography services to brands, agencies and other organisations where those services appear relevant to the person’s professional role.
Our lawful basis under the UK GDPR is our **legitimate interests** in developing our business. We consider the relevance of the contact, use business-focused information, limit the frequency of contact and provide a clear way to object. We also apply the separate PECR rules: in particular, we do not send unsolicited electronic marketing to individual subscribers, including sole traders and certain partnerships, unless we have consent or another applicable permission.
### Website operation, analytics and security
We use technical information to deliver the website, remember privacy choices, measure traffic and performance, understand which content is useful, diagnose faults, prevent spam and protect our website and accounts.
Strictly necessary processing is based on our **legitimate interests** in providing a secure, functional website. Where cookies or similar technologies require permission, we ask for **consent** before using them. You can change your choice using the cookie controls on the website.
### Legal and regulatory purposes
We may use or disclose information to comply with law, respond to lawful requests, protect people and property, investigate misuse or fraud, and establish, exercise or defend legal claims.
Our lawful bases are **compliance with legal obligations** and our **legitimate interests** in protecting the business and others.
We do not use personal information for solely automated decisions that have legal or similarly significant effects on you.
## 5. When providing information is required
You can choose whether to provide personal information when browsing the website or subscribing to marketing. However, information marked as required on a form, or information reasonably needed for a booking or project, must be provided if you want us to respond, enter into a contract or provide the service. If you do not provide it, we may be unable to proceed.
## 6. Who we share personal information with
We do not sell personal information.
Where necessary for the purposes described above, we may share information with:
- **GoDaddy**, which provides our website platform and may provide hosting, forms, customer records, account, booking, analytics and email-marketing features.
- **Google**, which provides reCAPTCHA to help protect website forms from spam and abuse. Google processes technical information in accordance with its own privacy terms.
- Email, telephone and communications providers, including WhatsApp/Meta if you choose to contact us through WhatsApp or related services.
- Cloud-storage, online proofing, file-transfer, backup and digital-delivery providers used to receive, work on or deliver project assets.
- Payment providers, banks, accountants, bookkeepers and tax authorities.
- Freelance assistants, retouchers, stylists, production partners, printers, couriers, laboratories and other suppliers involved in a project. We only provide the information reasonably required for their role and put appropriate confidentiality or data-protection arrangements in place where required.
- Insurers, solicitors and other professional advisers.
- Analytics, IT-support, security and fraud-prevention providers.
- A prospective buyer, seller or adviser if the business or its assets are reorganised, transferred or sold, subject to appropriate confidentiality safeguards.
- Courts, regulators, law-enforcement bodies, public authorities or other parties where disclosure is required by law or is necessary to protect legal rights.
Some third parties act as processors on our instructions. Others act as separate controllers and are responsible for explaining their own use of personal information.
Our website and communications may contain links to third-party websites or social-media services. Their privacy practices are controlled by them, and we encourage you to read their privacy information.
## 7. International transfers
Some providers used by our business operate or store information outside the United Kingdom. In particular, GoDaddy states that customer data collected through its Websites + Marketing features is stored in the United States. Other communications, cloud, file-delivery or technology providers may also process information internationally.
Where we make a restricted transfer of personal information outside the UK, we take steps intended to ensure that the transfer is lawful. Depending on the destination and provider, these may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework where applicable, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard or exception permitted by law. You can contact us for more information about the safeguards relevant to your information.
## 8. How long we keep personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including contractual, legal, accounting, insurance and reporting requirements. The relevant period depends on the nature of the information and the context.
Our general retention approach is:
- **Unsuccessful enquiries and estimates:** normally up to two years after the last meaningful contact, unless there is a reason to retain them for longer or you ask us to delete them sooner.
- **Client contracts, project administration and material relevant to disputes:** normally up to six years after the end of the client relationship or project, and longer where a claim, complaint or legal obligation requires it.
- **Invoices, payments and tax records:** for the period required by tax and accounting law, normally at least six years.
- **Website/member accounts:** while the account is active and for a reasonable period after closure to complete deletion from operational systems and backups, unless other records must be retained for a separate lawful reason.
- **Still-life photographs and related project files:** still-life images that do not identify an individual are not normally personal information and may be retained indefinitely as part of our professional archive. This can allow us to re-supply work or refer to past projects. However, we do not guarantee permanent archival storage and, once final files have been delivered and any expressly agreed storage period has ended, we reserve the right to delete files belonging to past clients at any time. Any associated personal information, such as client contact details or project correspondence, is retained only in accordance with the applicable periods in this policy.
- **Photographs, video or audio that identify people:** for the delivery and backup period agreed with the client and, where appropriate, for longer while the material forms part of an authorised professional archive, portfolio or case study. Longer retention must remain consistent with the relevant contract, release, confidentiality terms and lawful basis. Archival storage is not guaranteed unless agreed in writing.
- **Portfolio work, case studies, releases and evidence of permissions:** while the work remains in use and for as long as reasonably necessary to demonstrate our right to use it, unless the relevant agreement, withdrawal of consent or a successful objection requires a change.
- **Newsletter and marketing records:** until you unsubscribe, withdraw consent or successfully object. We may keep a minimal suppression record after an opt-out so that we do not contact you again by mistake.
- **Cookie and analytics information:** for the period stated in the website’s cookie controls or by the relevant provider, subject to your consent choices.
When information is no longer needed, we delete it, anonymise it or securely put it beyond use. Information may remain for a limited time in protected backups before being overwritten.
## 9. How we protect personal information
We use reasonable technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. These include access controls, password protection, secure website connections, software and device security, backups, careful selection of service providers and limiting access to people who need the information for their work.
No internet transmission or storage system can be guaranteed completely secure. If we become aware of a personal-data breach, we will assess it and notify affected people and the Information Commissioner’s Office where the law requires us to do so.
## 10. Cookies and similar technologies
Cookies are small data files stored on your device. Similar technologies can include pixels, tags, scripts and local storage.
Our website may use:
- **Strictly necessary cookies**, which enable essential functions such as security, account sign-in, forms and recording your cookie choices. These do not require consent where the legal exemption applies.
- **Analytics and performance cookies**, which help us understand visits, traffic and website performance. We use these only where the required consent has been given.
- **Functional cookies**, which remember settings or enable enhanced features.
- **Third-party technologies**, including Google reCAPTCHA, used to distinguish genuine users from spam and abusive traffic. The provider may receive technical information such as IP address, device and browser data.
When you first visit, the website provides controls to accept or decline non-essential cookies. Declining them should not prevent basic use of the website, although some optional features may work differently. You can also delete or block cookies in your browser. Browser controls may not cover every similar technology, so the website’s consent control should also be used where available.
The cookies and providers in use can change when our website platform is updated. The current cookie banner or settings tool should be treated as the most up-to-date list of non-essential technologies available for your choice.
## 11. Your data-protection rights
Depending on the circumstances, you may have the right to:
- **Access** your personal information and receive a copy of it.
- **Rectify** inaccurate information and complete incomplete information.
- **Erase** your information in certain circumstances.
- **Restrict** how your information is used in certain circumstances.
- **Object** to processing based on legitimate interests, including profiling related to that processing.
- **Object at any time to direct marketing.**
- **Receive or transfer** certain information in a structured, commonly used and machine-readable format where the right to data portability applies.
- **Withdraw consent** at any time where we rely on consent. This does not affect processing that was lawful before withdrawal.
- Ask for safeguards relating to certain international transfers.
- Complain to a data-protection regulator.
These rights are not absolute and may be subject to legal exemptions. To exercise a right, contact us using the details in section 2. Please describe your request clearly. We may ask for information needed to verify your identity and protect your information from unauthorised disclosure. We will respond without undue delay and within the period required by law. We do not normally charge a fee, although the law permits one in limited circumstances.
If we process personal information solely on behalf of one of our clients, we may refer your request to that client as the relevant controller.
## 12. Complaints
Please contact us first if you have a concern about how we use your personal information. We will take your concern seriously and try to resolve it.
You also have the right to complain to the UK supervisory authority:
**Information Commissioner’s Office**
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: **0303 123 1113**
Website: **ico.org.uk/make-a-complaint**
## 13. Children
Our website and services are aimed primarily at businesses and are not directed at children. We do not knowingly invite children to create website accounts, make bookings or subscribe to marketing.
A commercial photography project may involve a child as a model or subject. In that situation, we process information only as required for the project and the appropriate arrangements with the commissioning client, agency, parent or guardian. If you believe a child has provided information to us through the website without appropriate authority, please contact us.
## 14. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The latest version will be published on this page and the “Last updated” date will be revised. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to the attention of affected people where required.