It’s essential that you understand what happens to your information and images. With that in mind, here is my Privacy Policy. 

Data Protection Policy

Emily Johns trading as Lotus Photography

General

This Data Protection Policy explains how Lotus Photography collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable UK data protection law.

For the purposes of data protection law, Emily Johns trading as Lotus Photography is the “Data Controller”.

Key Principles

Lotus Photography processes personal data in accordance with the UK GDPR principles. Personal data shall be:

• Processed lawfully, fairly, and transparently

• Collected for specified, explicit, and legitimate purposes

• Adequate, relevant, and limited to what is necessary

• Accurate and kept up to date

• Kept only for as long as necessary for the purposes for which it is processed

• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage

• Not transferred outside the UK without appropriate safeguards in place

Lawful Basis for Processing

Lotus Photography processes personal data under one or more of the following lawful bases:

• Performance of a contract (e.g. fulfilling photography services)

• Legal obligation (e.g. accounting and tax records)

• Legitimate interests (e.g. business administration, client communication)

• Consent (e.g. marketing use of images and mailing lists)

Your Rights

Under UK GDPR, you have the following rights:

• The right to be informed about how your personal data is used

• The right of access to the personal data held about you

• The right to rectification if data is inaccurate or incomplete

• The right to erasure (“the right to be forgotten”) where applicable

• The right to restrict processing

• The right to data portability

• The right to object to processing

• Rights in relation to automated decision-making and profiling (not used by Lotus Photography)

Requests relating to these rights must be made in writing and will be responded to within one calendar month.

Your Private Information

• All personal data is stored securely using password-protected systems and reputable third-party platforms.

• Lotus Photography uses Studio Ninja for the secure storage and management of client contact details, questionnaires, emails, contracts, and invoices.

• Email communication is managed via Gmail, which applies industry-standard security measures.

• Personal data is not shared with third parties unless required to fulfil the contract (e.g. online galleries, album suppliers), or where prior consent has been obtained.

• Lotus Photography does not store clients’ bank or card details. Payments are processed securely via PayPal or bank transfer.

• Client galleries are hosted by third-party providers (e.g. PicTime), and clients may be required to enter an email address to access galleries. This is used solely to monitor gallery access and security.

• Client email addresses will only be added to the Lotus Photography mailing list where explicit consent has been given.

Marketing Use of Images

• Images will only be used for marketing purposes (including social media, website, portfolio, blog posts, competition entries, or press submissions) where explicit consent has been provided.

• Clients may withdraw marketing consent at any time by contacting Lotus Photography in writing. Withdrawal of consent does not affect lawful processing carried out prior to withdrawal.

Storage and Retention of Images

• Where consent has been provided for marketing use, raw and edited images will be retained for up to six (6) years.

• Where marketing consent has not been provided, raw and edited images will be retained for up to six (6) years.

• Images may be deleted earlier upon written request, unless retention is required for legal, accounting, or contractual purposes.

Data Security

Lotus Photography takes appropriate technical and organisational measures to protect personal data, including secure storage, access controls, encryption where available, and regular review of data handling practices.

Data Breaches

In the event of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, Lotus Photography will report the breach to the Information Commissioner’s Office (ICO) within 72 hours and notify affected individuals where required by law.

Retention of Business Records

Client contracts, invoices, and financial records are retained for up to six (6) years in accordance with HMRC requirements.

Contact & Complaints

If you have any questions about this policy or how your data is handled, please contact:

Emily Johns
Lotus Photography
Email: Emily@LotusPhotographyUK.com

If you believe your data protection rights have been breached, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Policy Updates

This Data Protection Policy may be updated from time to time to reflect changes in legislation or business practices. The most current version will always be available on the Lotus Photography website.