Privacy Policy

Nick Ford Photography

Last updated: 09.08.26

1. Introduction

This policy explains how Nick Ford Photography (“we”, “us”, “our”) collects, uses, stores and protects personal data. It applies to our clients, to people who appear in photographs we take, to visitors to our website at www.nickfordphotography.co.uk, and to anyone who contacts us.

We are committed to handling your personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR).

2. Who we are

Nick Ford Photography is a sole trader business owned and operated by Nick Ford. We are the data controller for the personal data described in this policy, which means we decide how and why it is used.


Trading name	Nick Ford Photography
Address	19 Oxford Street, Brighton, East Sussex, BN1 4LA
Email	studio@nickfordphotography.co.uk
Telephone	01273 683867 / 07834 912247

We are not required to appoint a Data Protection Officer. Data protection queries should be sent to Nick Ford at the address or email above.

3. The personal data we collect

3.1 Enquiries and bookings

When you contact us by phone, email, our website contact form, social media, or in person at the studio, we may collect:

your name, email address, telephone number and postal address
the type of shoot you are enquiring about, preferred dates and location
details of the venue, event or occasion
your budget, quotation and package details
correspondence between us

3.2 Clients

If you go on to book with us, we additionally collect:

billing address and payment details (card payments are processed by our payment provider — we do not store full card numbers)
contract, invoice and payment records
shoot schedules, running orders and shot lists
names and, where relevant, contact details of other people involved in the shoot (for example, wedding party members, family members, colleagues, venue coordinators or suppliers)
delivery and print order details

3.3 Photographs and video

Photographs of identifiable people are personal data. We collect and hold:

images and video footage taken at your shoot, event or wedding
the associated technical metadata (date, time, camera settings and, where enabled, approximate location)
image selections, edit requests and gallery download activity

3.4 People who appear in our photographs but are not our client

At weddings, corporate events and public events we photograph guests, delegates, colleagues and members of the public. In these cases we usually receive your details, or simply your image, from the person or organisation who commissioned us. We rely on our client to tell attendees that photography is taking place.

3.5 Special category data

Some shoots involve data that receives extra protection under the UK GDPR. This can include:

health, accessibility or dietary information you tell us about so we can plan a shoot safely and comfortably (for example mobility needs, pregnancy, a medical condition, or an allergy at a catered event)
information revealing religious or philosophical beliefs — for example where a wedding, naming ceremony or celebration is religious in character, or where an image shows religious dress or observance
information revealing racial or ethnic origin, which may be apparent from a photograph
information about a person’s sex life or sexual orientation, which may be apparent from images of a same-sex wedding or civil partnership

Where we process special category data we rely on your explicit consent (Article 9(2)(a) UK GDPR), except where the data has manifestly been made public by you, or where we need it to establish, exercise or defend a legal claim.

Note on facial recognition: we do not use facial recognition or any other biometric identification technology on our images.

3.6 Children

We regularly photograph babies, children and young people for family, school, event and wedding work. Where a subject is under 18:

we take instructions only from a parent or person with parental responsibility
consent for the shoot, and any separate consent to use images in our marketing, must be given by that parent or guardian
we do not use images of children in our marketing or portfolio without specific, written parental consent, which can be withdrawn at any time
images of children are treated with additional care in storage and are not shared beyond the client and our essential suppliers

3.7 Website visitors

When you visit our website we collect limited technical data — IP address (usually truncated), browser and device type, pages viewed, referring website, and the date and time of your visit. See section 10 for cookies.

3.8 Suppliers, contractors and applicants

We hold contact and payment details for second shooters, assistants, print labs, framers, venues and other suppliers, and the information contained in any job or work-experience application sent to us.

4. Where we get your data from

Most personal data comes directly from you. We may also receive it from:

the person or organisation who booked us (for example a bride and groom giving us family members’ names, or an employer supplying a staff list for headshots)
venues, wedding planners and event organisers
our client portal and booking form provider
publicly available sources such as a company website, where we are quoting for commercial work
reviews and messages you send us via Google, Facebook or Instagram

5. Why we use your data and our lawful basis

Purpose	Data used	Lawful basis
Responding to enquiries and providing quotations	Contact details, enquiry details	Legitimate interests (responding to a request); steps prior to entering a contract
Managing bookings, contracts and shoots	Client and shoot details	Contract
Taking, editing and delivering photographs	Images, gallery activity	Contract (for our client); Legitimate interests (for other people photographed at a commissioned event)
Taking payment and chasing unpaid invoices	Billing and payment records	Contract; Legitimate interests (recovering sums owed)
Keeping accounting and tax records	Invoices, payment records	Legal obligation
Planning a shoot around health, accessibility or religious requirements	Special category data	Explicit consent
Using images in our portfolio, website, social media, competitions, exhibitions and advertising	Images	Consent (given in your booking form or model release)
Sending marketing emails and newsletters	Name, email address	Consent, or the PECR “soft opt-in” for existing customers
Website analytics and improving the site	Technical and usage data	Legitimate interests, with an opt-out (see section 10)
Advertising and audience measurement on Meta platforms	Technical and usage data	Consent
Handling complaints, insurance claims and legal disputes	Any relevant data	Legitimate interests; establishing or defending legal claims
Keeping our premises, equipment and data secure	Any relevant data	Legitimate interests

Where we rely on legitimate interests, we have considered whether our interests are overridden by your rights. You can ask us for details of that assessment, and you have the right to object (see section 11).

6. Using your photographs in our marketing

We will not use images of you in our portfolio, on our website, on social media, in advertising, in competitions or in exhibitions unless you have given us consent to do so. Consent is requested separately in our booking form or model release and is never a condition of booking your shoot.

If you give consent and later change your mind, tell us and we will:

stop using the images in any new marketing
remove them from our own website, social media accounts and portfolio within a reasonable period
ask third parties (for example a magazine, blog, venue or competition organiser) to remove them, although we cannot guarantee removal from material already printed, distributed or cached elsewhere

For commercial and corporate work, images are normally used in accordance with the licence agreed with the commissioning organisation. If you are an employee who has been photographed for your employer, please raise any concerns about the use of your image with your employer in the first instance, and with us if we still hold copies.

If you appeared in a photograph at an event and you do not want us to hold or use your image, contact us with enough detail to identify the image and we will act on your request.

7. Who we share your data with

We do not sell your personal data. We share it with the following categories of recipient:

Service providers acting on our instructions (processors):

Pixieset — online client galleries, image delivery, proofing and print ordering
Light Blue Software — our booking, contract, invoicing and customer management system, including our website booking form
our website host and email provider, and the WordPress plugins used to run the site
Mailchimp or equivalent — email marketing platform [CONFIRM PROVIDER]
cloud storage and backup providers used to store and archive images
professional print labs, album manufacturers and framers who fulfil your print and product orders
payment providers who process card and online payments
our accountant and bookkeeping software provider
IT support and equipment repair providers, who may incidentally access stored data

Others:

second photographers, assistants and retouchers engaged for your shoot, who are contractually bound to confidentiality and data protection obligations
venues, event organisers and other suppliers, where necessary to run the shoot
Google and Meta (Facebook and Instagram) in connection with website analytics and advertising — see section 10
our insurers and professional advisers, where needed for a claim or dispute
HMRC, regulators, the police and other authorities, where we are legally required to disclose

All processors act only on our documented instructions under a written contract that meets Article 28 UK GDPR.

8. International transfers

Some of our providers store data outside the UK. Where this happens we make sure appropriate safeguards are in place, which will be one of the following:

a UK adequacy decision covering the destination country (for example Pixieset, based in Canada, and providers in the EEA)
the International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, for transfers to countries such as the United States
your explicit consent, in the limited cases where no other safeguard applies

You can ask us for a copy of the safeguards we rely on for any specific provider.

9. How long we keep your data

Data	Retention period
Unsuccessful enquiries	12 months from last contact
Client contract, booking and correspondence records	6 years from the end of the contract
Invoices, payments and accounting records	6 years after the end of the relevant tax year (HMRC requirement)
Final edited images from your shoot	Indefinitely as part of our archive.
Unedited RAW files and rejected frames	12 months
Online galleries hosted on Pixieset	12 months from delivery, extendable on request.
Images we use in our portfolio with your consent	Until you withdraw consent, or we stop using them
Marketing list subscribers	Until you unsubscribe.
Website analytics data	14 months

Where we no longer need your data we delete it securely or anonymise it. We may keep a minimal suppression record (your name and email) so we do not contact you again after you have asked us to stop.

10. Cookies, analytics and advertising

Our website uses cookies and similar technologies.

Strictly necessary cookies keep the site working and secure. These do not require your consent.
Analytics cookies (Google Analytics) help us understand how the site is used. Following changes made by the Data (Use and Access) Act 2025, first-party analytics used purely for statistical purposes may be set without prior consent, but you have the right to opt out and we provide a clear and easy way to do so via our cookie banner or [cookie settings link].
Advertising and social media cookies, including the Meta (Facebook) pixel and cookies set by embedded social content, are only set if you consent to them. You can change or withdraw your consent at any time through our cookie settings.

You can also block or delete cookies through your browser settings, though parts of the site may not work properly as a result.

Google and Meta act as separate or joint controllers for some of this processing. Their own privacy policies explain what they do with the data:

Google: https://policies.google.com/privacy
Meta: https://www.facebook.com/privacy/policy

11. Your rights

Under the UK GDPR you have the right to:

be informed about how we use your data — this policy
access the personal data we hold about you, including copies of photographs of you
have inaccurate data corrected
have your data erased (“right to be forgotten”) in certain circumstances
restrict how we use your data while a concern is being resolved
data portability — receive data you gave us in a machine-readable format, where processing is based on consent or contract and is automated
object to processing based on legitimate interests, including profiling
object at any time to your data being used for direct marketing — we will always comply
withdraw consent at any time, without affecting the lawfulness of what we did before you withdrew it
not be subject to solely automated decision-making with legal or similarly significant effects — we do not do this

To exercise any right, contact us at studio@nickfordphotography.co.uk. We will respond within one month. That period can be extended by up to two further months for complex requests, and we will tell you if that applies. Requests are free unless they are manifestly unfounded or excessive.

We may ask for proof of identity before releasing personal data. Where a request concerns a photograph that includes other people, we may need to redact or withhold parts of it to protect their privacy.

12. How we keep your data secure

We take appropriate technical and organisational measures to protect your data, including:

password protection and, where available, multi-factor authentication on our devices, cameras’ storage workflow and online accounts
encryption of laptops and portable drives
restricting access so that only Nick Ford and team members who need the data can see it
password-protected or private client galleries
regular, separately stored backups
written confidentiality and data protection terms with second shooters, retouchers and suppliers
secure deletion of data and secure disposal of old storage media

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and, where the risk is high, tell you directly.

13. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Email studio@nickfordphotography.co.uk marking your message “Data protection complaint”.

Under the Data (Use and Access) Act 2025 we will:

acknowledge your complaint within 30 days of receiving it
investigate it and respond without undue delay

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: https://ico.org.uk/make-a-complaint/

You also have the right to seek a remedy through the courts.

14. Changes to this policy

We review this policy regularly and will publish any updated version on this page with a revised “last updated” date. Where changes are significant, we will notify current clients and marketing subscribers directly.