Privacy Policy

Privacy Policy

This Privacy Policy explains how Eugene Potter Photography ("we", "us", "our") collects, uses and protects your personal data when you visit this website, make an enquiry or book photography services.

We are committed to handling your information lawfully, fairly and transparently in line with the UK General Data Protection Regulation (UK GDPR) and other applicable data protection laws.

Data controller: Eugene Potter Photography
Business name: Eugene Potter Photography
Address: 118 Bearsdown Road, Plymouth, Devon PL6 5TT, United Kingdom
Email: eugenecpotter@gmail.com
Phone: 07522268999

If you have any questions about this Privacy Policy or how we handle your data, you can contact us using the details above.

Types of data we collect

We only collect information that we need to run the business, respond to enquiries and deliver photography services. This may include:

Contact details: name, email address, phone number and any information you choose to include when you contact us by email, phone or through the website contact form.
Booking and event details: date, time and location of your session or event, names of key participants, and any notes or preferences you share.
Account and purchase information: records of quotes, contracts, invoices, payments, product orders (for example, prints or vouchers) and related communications.
Images and media: photographs and video created as part of your session or event, along with selection and editing notes.
Website usage data: technical data such as IP address, browser type, pages visited, time spent on the website and referral sources, typically collected through analytics tools and cookies.
Marketing preferences: your choices about receiving newsletters, offers or updates from us.
Special category data: as a rule we do not intentionally collect sensitive information. If, in rare cases, such details appear in images or communications (for example, health or religious information related to an event), we handle them with extra care and only where necessary for our services.

Purposes and legal basis for processing

We only use your personal data when the law allows us to. This will usually be because it is necessary to take steps at your request, to perform a contract, because we have a legitimate business interest that does not override your rights, or because we have your consent.

The main purposes for which we process your personal data and the corresponding legal bases are outlined in the table below.

Purpose	Examples	Legal basis
Responding to enquiries	Replying to contact form messages, emails or phone calls.	Legitimate interests (to run and grow the business) and taking steps at your request before entering into a contract.
Managing bookings and delivering services	Providing quotes, confirming bookings, planning and photographing sessions or events, editing and delivering images, managing product orders.	Performance of a contract with you and legitimate interests (to provide and improve services).
Billing and business administration	Issuing invoices, recording payments, managing accounts and tax records.	Legal obligations (for tax and accounting) and legitimate interests (to manage the business).
Marketing communications	Sending emails about news, offers or updates that may interest you.	Consent (where required). You can withdraw consent at any time.
Website analytics and improvement	Understanding how visitors use the website to improve content, usability and security.	Legitimate interests (to analyse and improve our services and website). Where required, we rely on your consent for certain cookies.
Protecting our rights	Preventing misuse of images, enforcing contracts and handling potential legal claims.	Legitimate interests (to protect our business, clients and intellectual property) and, where relevant, establishment, exercise or defence of legal claims.

Data sharing and third parties

We do not sell your personal data. We only share it with trusted third parties where this is necessary for running the business, providing services or meeting legal obligations.

Depending on how you interact with us, your data may be shared with:

Website hosting and IT providers: who enable this website, email accounts and data storage to function securely.
Email and communication tools: services used to send and receive emails or manage contact form submissions.
Client management, gallery or proofing platforms: used to deliver images, collect selections and manage orders.
Payment processors: when you pay online, your payment details are processed directly by secure third-party providers; we do not store full card details.
Print labs and product suppliers: to fulfil orders for prints, albums or other products, we may share delivery details and relevant order information.
Professional advisers: such as accountants or legal advisers, where needed for tax, accounting or legal purposes.
Law enforcement or regulators: where we are legally required to do so, for example in response to a court order.

All third parties are required to keep your data secure and to use it only for the specific purposes we have agreed with them.

How long we keep your data

We keep your personal data only for as long as necessary for the purposes for which it was collected, including for satisfying any legal, accounting or reporting requirements.

The typical retention periods we use are outlined in the table below. In some cases we may keep data for longer if required by law or to establish, exercise or defend legal claims.

Type of data	Typical retention period
Enquiry emails and messages (no booking)	Up to 12 months from last contact.
Client records, contracts, invoices and payment details	6 years from the end of the tax year, or longer if required by law.
Photographs and related project files	Normally kept for as long as reasonably necessary to provide ongoing access and reorders, unless you request deletion (subject to our contractual and legal obligations).
Marketing contact details and preferences	Until you unsubscribe or we no longer send marketing communications.
Website analytics data	As short as reasonably practical, typically between 14 months and 26 months depending on the tool used.

How we protect your data

We take reasonable technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration or destruction.

These measures may include:

Using reputable hosting, email and storage providers with appropriate security in place.
Using strong passwords and access controls on devices and accounts.
Keeping software and devices updated with security patches.
Limiting access to personal data to those who need it for their role.
Backing up important data securely.

While we work hard to protect your information, no method of transmission or storage is completely secure. If we become aware of a data breach that is likely to result in a high risk to your rights and freedoms, we will inform you and any relevant authorities where we are legally required to do so.

Your data protection rights

Under data protection law, you have a number of rights in relation to your personal data. These rights are not absolute and may be subject to certain conditions and exemptions, but we will always respond to any request in line with our legal obligations.

Your rights include:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete information.
Right to erasure: to request that we delete your personal data in certain circumstances (also known as the “right to be forgotten”).
Right to restrict processing: to ask us to suspend the use of your data in specific situations.
Right to object: to object to our processing of your data where we rely on legitimate interests, and to object at any time to direct marketing.
Right to data portability: to request that we transfer your personal data to you or to another organisation, where technically feasible.
Rights related to consent: where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details provided at the top of this Privacy Policy. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you are unhappy with how we use your data, but we would appreciate the chance to address your concerns first.

Changes to this policy and contact

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal requirements. The updated version will be posted on this page and will take effect as soon as it is published.

We encourage you to review this page periodically to stay informed about how we handle your personal data.

Contact details
If you have any questions about this Privacy Policy, your personal data or your rights, please contact:

Eugene Potter Photography
Email: eugenecpotter@gmail.com
Phone: 07522268999
Address: 118 Bearsdown Road, Plymouth, Devon PL6 5TT, United Kingdom

Last updated: 15 April 2026