Privacy Notice

How Photograph My Product Ltd collects, uses, and protects your personal data.

1. Who We Are

Photograph My Product Ltd (company number 11588835) is the data controller responsible for your personal data collected through this website.

Registered address: Unit E1, Northminster Business Park, Upper Poppleton, York, YO26 6QU.

If you have questions about how we handle your data, contact us at info@photographmyproduct.co.uk or call 0330 043 0113.

2. What Data We Collect

We collect different categories of personal data depending on how you interact with us:

Enquiry form

  • Name, email address, phone number, and company name
  • Product category and approximate product count
  • Any notes or project details you provide
  • Marketing consent preference

Project brief form

  • Usage channels, image types, product list details
  • Styling preferences, logistics, and timing requirements

Client portal account

  • Email address, name, and a securely hashed password
  • Organisation and role information

Automatically collected data

  • Device type, browser, and operating system
  • Referral source, landing page, and UTM campaign parameters
  • Session identifiers for analytics (stored in your browser session storage)
  • Page views and interaction events (e.g. enquiry funnel steps, file downloads)

3. How We Use Your Data

We process your personal data for the following purposes:

  • Responding to your enquiry and providing a tailored estimate
  • Fulfilling photography services you commission from us
  • Managing your client portal account and project workflow
  • Sending transactional emails such as estimates, invoices, briefs, and delivery notifications
  • Sending marketing communications where you have opted in
  • Analysing website usage to improve our services and user experience
  • Preventing fraud and ensuring the security of our systems

4. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

Contract

  • Processing necessary to fulfil services you have commissioned or to take steps at your request before entering a contract (e.g. providing an estimate).

Legitimate interest

  • Analysing website usage to improve our services, provided this does not override your rights. We maintain records of our legitimate interest assessments.

Consent

  • Marketing emails are only sent where you have given explicit opt-in consent. You can withdraw consent at any time by clicking the unsubscribe link in any email or contacting us directly.

Legal obligation

  • Where we are required to retain data for tax, accounting, or regulatory purposes.

5. Who We Share Your Data With

We do not sell or rent your personal data. We may share data with the following categories of trusted third-party service providers who process data on our behalf under appropriate contractual controls:

  • Email delivery — Resend (transactional emails such as estimates and briefs)
  • Image hosting — Cloudinary (storing and delivering project imagery)
  • Database hosting — Neon (PostgreSQL cloud database)
  • Analytics — Google Analytics (anonymised website usage data)
  • Payment processing — Stripe (when payment features are active)
  • Shipping — DPD and other carriers (return of merchandise)

We may also disclose your data if required by law, regulation, or legal process.

6. Cookies

Cookies are small text files placed on your device when you visit our website. We use cookies for the following purposes:

Essential cookies

  • Authentication session cookies that keep you signed in to the client portal.
  • These are strictly necessary for the website to function and cannot be switched off.

Analytics cookies

  • Google Analytics cookies that help us understand how visitors use our website, including pages visited and time spent.
  • Internal analytics session identifiers stored in your browser's session storage (cleared when you close your browser).

Third-party cookies

  • Some embedded content (e.g. YouTube videos) may set their own cookies. We do not control these third-party cookies. Refer to the relevant provider's cookie policy for details.

You can control cookies through your browser settings. Blocking essential cookies may affect your ability to use parts of our website.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Enquiry data — retained for up to 24 months after your last interaction, or longer if you become a client.
  • Client project data — retained for the duration of our business relationship and for up to 6 years afterwards to meet legal and accounting obligations.
  • Account data — retained until you request deletion or your account is inactive for an extended period.
  • Analytics data — aggregated and anonymised data may be retained indefinitely; identifiable analytics data is retained for up to 26 months.
  • Marketing consent records — retained for as long as the consent is active and for a reasonable period afterwards for compliance purposes.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — ask us to correct inaccurate or incomplete data.
  • Right to erasure — request deletion of your data where there is no compelling reason for its continued processing.
  • Right to restrict processing — ask us to temporarily stop processing your data in certain circumstances.
  • Right to data portability — receive your data in a structured, commonly used, machine-readable format.
  • Right to object — object to processing based on legitimate interest or for direct marketing purposes.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at info@photographmyproduct.co.uk. We will respond within one month. There is no fee for making a request unless the request is manifestly unfounded or excessive.

9. International Transfers

Some of the third-party services we use may process data outside the United Kingdom. Where this happens, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office, or the service provider being located in a country with an adequacy decision.

10. Security

We take the security of your data seriously and implement appropriate technical and organisational measures to protect it, including:

  • Encrypted connections (HTTPS) across the entire website.
  • Passwords stored using secure one-way hashing — we never store plaintext passwords.
  • Access to personal data restricted to authorised personnel who need it for their role.
  • Regular review of our data processing activities and security practices.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Children's Privacy

Our services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

13. Changes to This Privacy Notice

We may update this privacy notice from time to time to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised effective date. We encourage you to review this page periodically.

14. Contact Us and Complaints

If you have questions, concerns, or wish to exercise your rights, contact us:

  • Photograph My Product Ltd, Unit E1, Northminster Business Park, Upper Poppleton, York, YO26 6QU
  • Phone: 0330 043 0113
  • Email: info@photographmyproduct.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Helpline: 0303 123 1113