Privacy Policy

1. Introduction

1.1. When you share your personal or business information with Photo Nottingham, you trust us with your information. We are committed to protecting and respecting your privacy and we take that trust very seriously.

1.2. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you access our website, make an enquiry, purchase a product or service (including a gift voucher), enter a competition or prize draw, or book a photoshoot with us. It also explains the choices you have about how we use your information and how you can exercise your rights.

1.3. Please read this Privacy Policy together with our Terms & Conditions and our Cookie Policy (set out in section 10 below).

2. Who we are

2.1. We are Photo Nottingham Limited ("Photo Nottingham", "we", "us", "our"), a company registered in England and Wales under company number 05612147, whose registered office is at 65 Mansfield Road, Nottingham, NG1 3FN. Our studio is at The Old School, Main Street, Awsworth, Nottingham, NG16 2QT.

2.2. We are the data controller responsible for your personal data. For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), our Information Commissioner's Office (ICO) registration number is ZA786535.

2.3. If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details in section 14.

3. Changes to this policy

3.1. We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. When we do, we will revise the "Last updated" date at the top of this page, and the updated version takes effect once posted on our website.

3.2. We encourage you to review this page periodically. Where changes are significant, we will take reasonable steps to bring them to your attention.

4. The information we collect

We may collect and process the following categories of personal data about you:

4.1. Information you give us. When you make an enquiry or booking (by telephone, through social media, in person, or via email or SMS), purchase a product or gift voucher, or otherwise communicate with us, we may collect your name, postal address, email address, telephone number, age, gender, occupation, and details of your preferences or interests, including whether you wish to receive further information from us.

4.2. Booking and payment information. When you make a booking or purchase, we may collect information needed to process your payment, such as credit/debit card or bank details. Card payments are processed by our third-party payment providers; we do not store full payment card numbers.

4.3. Competitions, surveys and "recommend a friend". If you take part in a competition, prize draw or survey (run by us or with third parties, including on social media), we may collect your full name, age, postal address, email address and telephone number. Some of our marketing may include a "recommend a friend" promotion; where someone provides us with your details, they must have your permission to do so, and we will handle your information as set out in this policy.

4.4. Photographs and images. As a photography studio, we create and process photographic images of you as part of delivering our services. Where these images are of a personal or intimate nature, we apply additional protections — see section 5.

4.5. Technical and usage data. When you access our website and social media channels, our servers and tools may automatically collect derivative data such as your IP address, browser type, operating system, device type, access times, and the pages you viewed before and after visiting our site. This is collected through cookies and similar technologies — see section 10.

5. Special category data and photography

5.1. Some of the information we handle may be more sensitive. Photographs taken during boudoir, lingerie, fine art nude and "nearly nude" sessions are personal and intimate in nature, and we treat them with a heightened level of care and confidentiality.

5.2. Where our processing involves special category data (for example data that could reveal information about your health, or intimate images where you ask us to use or display them), we rely on your explicit consent as our condition for processing under Article 9 of the UK GDPR, unless another lawful condition applies.

5.3. We will not publish, display or share any boudoir, lingerie or nude images for marketing or any other purpose unless you have given us your separate, specific, written consent (a model release). You may decline or withdraw that consent at any time by contacting us, and we will stop further use going forward, although we may be unable to recall materials already in print or circulation.

5.4. You can read more about image rights, licensing and confidentiality in our Terms & Conditions.

6. How we use your information and our lawful bases

6.1. We only use your personal data where the law allows us to. The lawful bases we rely on under the UK GDPR are: consent; performance of a contract with you; compliance with a legal obligation; and our legitimate interests (where these are not overridden by your rights). Where we rely on legitimate interests, we assess that this is appropriate and that it does not unfairly impact your rights, and we provide a simple way to opt out of marketing.

6.2. We use your personal data for purposes including the following:

6.3. If we intend to use your personal data for a new purpose that is not compatible with the purpose for which it was collected, we will tell you and, where required, seek your consent.

7. Marketing communications

7.1. We may contact you with marketing about our products and services by email, SMS, post or social media messaging, where you have consented or where we are otherwise permitted to do so by law.

7.2. You can opt out of marketing at any time — for example by using the unsubscribe link in our emails, replying STOP to a text message where indicated, or contacting us using the details in section 14. We will action your request promptly.

7.3. Opting out of marketing will not stop service-related messages that we need to send you about a booking, viewing, order or purchase.

7.4. We do not sell, rent or trade your personal information to third parties for their own marketing purposes.

8. Who we share your information with

8.1. We share your personal data only where it is necessary, and we require anyone who processes data on our behalf to keep it secure and to use it only for the purposes we specify. We may share your data with:

• Service providers and suppliers who help us run our business and deliver your products and services — for example our customer relationship management (CRM) and booking platform, website hosting provider, email and SMS communication platforms, print and product manufacturing suppliers, and professional advisers.
• Payment providers and banking organisations, to process payments and prevent fraud.
• Advertising and analytics providers, such as Google and Meta (Facebook/Instagram), in connection with our website analytics and advertising — see section 10.
• Public authorities, regulators or law enforcement, where we are required or permitted to do so by law, or to protect our rights, property or safety, or those of others.
• A successor to our business, if we sell, transfer or reorganise our business (or any relevant part of it).

8.2. As a data controller, we take suitable precautions to ensure your data is managed and processed in accordance with this Privacy Policy whenever we share it.

9. Storing and transferring your information internationally

9.1. The personal data we collect is stored within the UK wherever possible. We take all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.

9.2. Some of our service providers (for example certain advertising, analytics or software providers) may process data outside the UK. Where we transfer your personal data outside the UK, we will ensure an appropriate safeguard is in place — such as a UK adequacy decision, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — so that your data continues to be protected to UK standards.

10. Cookies and tracking technologies

10.1. A cookie is a small file placed on your device that allows a website to recognise your browser. Cookies identify the device you are using, not you personally. We use cookies, tracking pixels, tags and similar technologies to operate our website, remember your preferences, understand how our site is used, and support our advertising.

10.2. The types of cookies and tracking technologies we use include:

• Strictly necessary cookies, which are required for the website to function.
• Analytics cookies, such as Google Analytics (managed via Google Tag Manager), which help us understand how visitors use our site so we can improve it. This data does not identify you personally.
• Advertising and marketing cookies and pixels, such as the Meta (Facebook) Pixel, which help us measure and optimise our advertising and show you relevant content on platforms such as Facebook and Instagram.

10.3. You can control or delete cookies through your browser settings, and you can manage non-essential cookies via our website's cookie banner where provided. Please note that clearing cookies, changing browser or device, or upgrading your browser may reset any preferences (including opt-outs) you have set.

10.4. By using our website, you agree to our use of cookies as described here and as managed through our cookie settings.

11. How long we keep your information

11.1. We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, maintain our customer records, and comply with legal, accounting, tax or reporting requirements.

11.2. Photographic images are retained for a limited period to allow you to view, order and re-order, after which they may be securely deleted. Please contact us if you would like details of our current retention period for images, or if you would like your images deleted earlier.

11.3. When we no longer need your personal data, we will securely delete or anonymise it. Where we are required to retain certain information — for example to prevent fraud, resolve disputes, enforce our terms, fulfil an outstanding contractual obligation, or comply with the law — we will keep only what is necessary for that purpose.

11.4. We do not retain your personal data for longer than is necessary. We will hold your personal data for as long as it remains relevant to the purposes set out in this policy — including for the duration of our relationship with you and for so long as you may reasonably wish to view, order or re-order your images — and for any further period during which we are required or entitled to retain it in order to comply with our legal, regulatory, accounting or tax obligations, to resolve disputes, or to establish, exercise or defend legal claims. Once your personal data is no longer relevant or required for any such purpose, we will securely delete or anonymise it.

12. How we protect your information

12.1. We use appropriate technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse or alteration. These include secure storage, restricted access, and the use of reputable service providers.

12.2. CCTV operates at our studio for the safety and security of our clients, staff and property; footage is handled in line with this policy.

12.3. While we take reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

13. Your rights

13.1. Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• The right to be informed about how we use your personal data (which is the purpose of this policy).
• The right of access to a copy of the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure ("the right to be forgotten") in certain circumstances.
• The right to restrict processing in certain circumstances.
• The right to data portability, to receive your data in a structured, commonly used, machine-readable format.
• The right to object to processing based on legitimate interests, and to direct marketing at any time.
• Rights relating to automated decision-making and profiling — we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
• The right to withdraw consent at any time, where we rely on your consent.

13.2. To exercise any of these rights, please contact us using the details in section 14. We will respond within one month, although we may extend this by up to two further months for complex requests, in which case we will let you know.

13.3. You will not usually have to pay a fee. We may need to verify your identity before acting on a request. In some cases we may be entitled to retain certain information where the law requires or permits it.

14. How to contact us

14.1. If you have questions about this Privacy Policy, or wish to exercise your rights, please contact:

The Manager, Photo Nottingham
The Old School, Main Street, Awsworth, Nottingham, NG16 2QT
Email: [email protected]
Telephone: 0115 924 3995

15. Your right to complain to the ICO

15.1. We hope to resolve any concerns you may have, so please contact us first. However, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your personal data:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

16. Children's privacy

16.1. Other than personal data we need to fulfil our services to you as a customer, we do not knowingly collect information from, or market to, children under the age of 13. If you believe we may hold information relating to a child under 13, please contact us and we will take appropriate steps to delete it.

16.2. Please also note the age restrictions that apply to certain sessions, as set out in our Terms & Conditions.

Photo Nottingham Limited is registered in England and Wales, company number 05612147. Registered office: 65 Mansfield Road, Nottingham, NG1 3FN. ICO registration number ZA786535.

This Privacy Policy was last updated on 23 June 2026.