Privacy Notice

Last updated: 24 June 2026

This privacy notice explains how I use and protect your personal information.

Contact details

Email: kirsty@kirstythompson.com

What information I collect, use, and why

I collect and use the following information to provide photography services:

●      names and contact details;

●      addresses or session locations where applicable;

●      payment and transaction details, such as payment status, invoice details and bank transfer references where applicable;

●      photographs taken as part of the photography service;

●      names and caption information where this is needed for commissioned event photography.

Photographs are used to provide the photography service, including editing and delivering final images to the client.

Images from my photography services are not used publicly on my own website, social media, portfolio, advertising or other marketing unless separate permission has been requested and given.

Where I photograph an event for a magazine, publisher or other business client, I may also collect the names of people photographed so that images can be accurately captioned and supplied to the client for editorial, publication or business purposes. This may involve writing names in a notebook at the event and adding names to the relevant digital image captions or file information before the images are supplied.

I may also collect and use the following information to manage client records, bookings and business administration:

●      names and contact details;

●      addresses or session locations where applicable;

●      payment and transaction details, such as invoice details, payment status and bank transfer references where applicable;

●      purchase history or booking history.

I may also display selected examples of previous published photography work on my website, including PDF copies or extracts of magazine pages containing my photographs. These are used to show examples of my previous professional work.

I have written permission from the relevant publisher to reproduce these examples on my website. Some examples may include people who appeared in the original published material. Where I do not hold separate permission from the individuals shown, I only use selected examples where I consider the use to be fair, limited and appropriate, and I rely on my legitimate interests in showing examples of my previous professional work.

Lawful bases and data protection rights

Under UK data protection law, I must have a lawful basis for collecting and using your personal information.

You have rights under data protection law, although these rights may depend on the lawful basis being used and may be subject to exemptions.

Your rights may include:

●      the right to ask for copies of your personal information;

●      the right to ask me to correct personal information you think is inaccurate or incomplete;

●      the right to ask me to delete your personal information in certain circumstances;

●      the right to ask me to restrict how I use your personal information in certain circumstances;

●      the right to object to the use of your personal information in certain circumstances;

●      the right to ask that personal information you gave me is transferred to another organisation, or to you, in certain circumstances;

●      the right to withdraw consent at any time where I rely on consent as the lawful basis.

If you make a data protection rights request, I must respond without undue delay and in any event within one month. To make a request, please contact me using the contact details above.

My lawful bases for collecting and using your personal information

The lawful bases I rely on are:

Contract

I use personal information where this is necessary to respond to enquiries, arrange photography sessions, provide photography services, edit and deliver images, communicate with clients, and manage bookings.

Legal obligation

I use and keep certain personal information where required to comply with legal, tax, accounting and business record-keeping obligations. This may include invoices, payment records and related business records.

Legitimate interests

I use personal information where necessary for the legitimate interests of running and protecting my photography business, provided those interests are not overridden by your rights and freedoms.

My legitimate interests include responding to enquiries, managing client relationships, keeping appropriate business records, dealing with queries or complaints, maintaining secure systems, and keeping reasonable records of bookings, communications and image delivery.

My legitimate interests may also include accurately recording and supplying caption information for commissioned event photography, where this is necessary and proportionate for the purpose of providing the photography service to a magazine, publisher or other business client.

My legitimate interests may also include displaying selected examples of previous published photography work, where this is fair, limited and appropriate, to show examples of my professional experience.

Consent

I will rely on consent where I ask for optional permission to use your personal information for a specific purpose. For example, I will not use images from my photography services publicly on my own website, social media, portfolio or marketing unless separate permission has been requested and given.

You can withdraw consent at any time where I rely on consent as the lawful basis.

For more information about the lawful bases I rely on, or my use of legitimate interests, you can contact me using the contact details above.

Where I get personal information from

I may get personal information:

●      directly from you, for example when you contact me, make an enquiry, arrange a booking or attend a photography session;

●      directly from people photographed, for example where names are collected for event photography captions;

●      from a magazine, publisher or business client where information is provided as part of a commissioned photography job;

●      from the relevant publisher where previous published portfolio work is displayed on my website with publisher permission;

●      automatically through my website, where cookies or Squarespace Analytics are used.

Cookies and website analytics

My website is hosted on Squarespace and uses Squarespace Analytics to help me understand how visitors use my website. This may include information such as website visits, pages viewed, traffic sources, approximate location, device or browser information, and how visitors interact with the website.

Squarespace may use essential cookies that are needed for the website to work properly. The website may also use non-essential analytics or performance cookies to support Squarespace Analytics.

A cookie banner is used on the website so visitors can manage their cookie preferences. The website is intended to restrict non-essential cookies unless they are accepted through the cookie banner.

I do not currently use Google Analytics, Meta/Facebook Pixel or other third-party advertising tracking tools.

How long I keep information

I only keep personal information for as long as I need it for the purposes described in this privacy notice.

Enquiries that do not lead to a booking are normally kept for up to 12 months.

Client booking records, client correspondence, contracts, invoices and related business records may be kept for legal, tax, accounting and business record purposes. Self-employed business records are kept in line with HMRC requirements.

Client download links or Dropbox folders are normally available until the client has acknowledged receipt of the final images, or for a reasonable period after delivery. They are then deleted or access is removed when no longer needed.

Final edited images may be stored securely for up to 24 months, but permanent storage of client images is not guaranteed.

RAW or unedited files are not supplied and are not guaranteed to be retained after final delivery.

Camera memory cards are used as temporary storage only. Images are transferred to a secure computer as soon as reasonably practical and memory cards are cleared or formatted after images have been safely transferred and backed up.

Caption notes, whether handwritten or digital, are kept only for as long as needed to caption, check and deliver the relevant images, then deleted or securely destroyed when no longer needed.

Where separate permission has been given for images to be used publicly, a record of that permission may be kept for as long as the images are being used.

Previous published portfolio examples may remain on my website while they are relevant to showing my professional work, unless there is a reason to remove them or a person shown raises a concern and I decide that removal is appropriate.

I review stored information periodically and delete information that is no longer needed.

Who I share personal information with

I do not sell your personal information.

I may share personal information with trusted service providers who help me run my photography business. These may include:

●      email service providers;

●      Dropbox or other secure file-sharing services;

●      Adobe/Creative Cloud, where cloud services, syncing or storage are used;

●      Squarespace, as my website hosting provider and website analytics provider;

●      IT or security service providers, where required.

My email provider processes client names, email addresses, messages and booking details so I can respond to enquiries, arrange photography sessions and communicate with clients.

Dropbox is used to share final edited images with clients by providing download links or folders.

Adobe/Creative Cloud may process client images where cloud-based services, syncing or storage are used. Where possible, images are edited locally in Adobe Photoshop.

Squarespace hosts my website and provides website analytics. Squarespace may process information about website visitors, such as cookies, device/browser information, traffic sources, page views and website interactions, to help operate the website and provide analytics information.

I may also share personal information with my accountant, professional advisers, insurer, HMRC, the ICO, or other organisations where I am legally required to do so.

Images from my photography services are not used publicly on my own website, social media, portfolio, advertising or other marketing unless separate permission has been requested and given.

Where I am commissioned to photograph an event for a magazine, publisher or other business client, I may share selected photographs and relevant caption information, such as names of people photographed, with that client for editorial, publication or business purposes.

How to complain

If you have any concerns about how I use your personal information, please contact me first using the contact details at the top of this privacy notice so I can look into the matter and try to resolve it.

I will acknowledge and review data protection complaints and aim to respond within one month.

If you appear in a previous published portfolio example on my website and have concerns about its use, please contact me using the details above so I can review it.

If you remain unhappy with how I have used your personal information after raising a complaint with me, you can also complain to the Information Commissioner’s Office.

The ICO’s address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint