Privacy Policy
Last updated: February 2026
1. Who Controls Your Data
Chris Stones Photography is a photography business based in York.
Data Controller: Christopher Stones
Email: tophergraph.uk@gmail.com
Personal data is processed in accordance with the UK GDPR and the Data Protection Act 2018.
2. What Information Is Collected
The following types of personal data may be collected:
Name
Email address
Phone number
Home or event address
Booking details
Payment information (processed securely via third-party providers)
Photographs and video images containing identifiable individuals
Marketing preferences
Website usage data (via cookies or analytics tools)
3. How Your Data Is Collected
Personal data may be collected when:
An enquiry form is submitted
A session is booked
A contract is signed
A payment is made
Marketing emails are subscribed to
Social media interactions take place
The website is browsed
4. How Your Information Is Used
Personal data is used to:
Respond to enquiries
Provide photography services
Process payments
Deliver galleries and products
Communicate about bookings
Maintain business records
Improve services and website performance
Send marketing emails (where consent has been given)
Display images in portfolios or on social media (where permitted)
5. Legal Basis for Processing
Under UK GDPR, personal data is processed under the following lawful bases:
Contract – To provide booked services.
Legitimate Interests – To operate and promote the business, including portfolio display.
Consent – For marketing communications and certain image uses where required.
Legal Obligation – For tax and accounting purposes.
6. How Your Data Is Stored
Personal data is stored securely using password-protected systems and secure cloud storage.
Payment details are processed securely via third-party providers such as Square and are not stored directly.
Reasonable steps are taken to protect personal information from loss, misuse, or unauthorised access.
7. How Long Data Is Retained
Personal data is retained only as long as necessary:
Enquiry data: Up to 12 months
Client contracts and invoices: 6–7 years (for tax purposes)
Images: [Insert timeframe — e.g., minimum 1 year, longer for archive purposes]
Marketing data: Until consent is withdrawn
8. Sharing of Personal Data
Personal data may be shared with trusted third parties where necessary, including:
Payment processors
Online gallery providers
Cloud storage providers
Accountants
Website and email hosting providers
Personal data is never sold.
9. Your Rights
Under UK GDPR, the following rights apply:
The right to request access to personal data
The right to request correction of inaccurate data
The right to request deletion (where applicable)
The right to restrict or object to processing
The right to withdraw marketing consent
The right to lodge a complaint
Complaints may be made to the Information Commissioner's Office (ICO)
Requests regarding personal data can be made via email at:
tophergraph.uk@gmail.com.
10. Cookies & Analytics
Cookies and analytics tools may be used to improve user experience and monitor website performance.
Cookie preferences can be controlled through browser settings.
11. Children’s Data
Where photography services involve children, consent must be provided by a parent or legal guardian.
12. Updates to This Policy
This Privacy Policy may be updated from time to time. The most recent version will always be available on the website.
13.ICO Registered, Reference no: ZC096527