Last updated: 25 October 2026

Who We Are

This privacy policy explains how Jarad Lee Photography ("we", "us", "our") collects, uses, and protects your personal data when you visit our website, use our client portal at client.jaradlee.co.uk, view or buy photographs from one of our online galleries, take part in a school or nursery photography session, engage us for wedding, portrait, or event photography services, or otherwise get in touch with us.

We are the data controller for the personal data described in this policy.

• Trading name: Jarad Lee Photography
• Business address: Shireoaks
• Contact email: jarad@jaradlee.co.uk

What Data We Collect

We collect the following categories of personal data:

• Account details: your name, email address, phone number, address, and (where applicable) your partner's name and email address, created when you are booked in as a client or when you buy from one of our online galleries.
• Booking and questionnaire information: details you provide about your shoot, such as preferences, locations, dates, and other event-specific information.
• Enquiry and lead data: name, email address, and event details submitted through our public enquiry forms, even if you do not go on to book with us.
• Contracts: signed booking contracts and associated correspondence. When you sign a contract online we also record the date and time, the IP address you signed from, and the version of the contract you signed, as evidence that it was agreed.
• Financial records: invoices, quotes, orders, and payment records. We use a third party payment provider, Stripe, to securely process card payments. We never see or store your full card or bank details.
• Gallery content and selections: photographs we take and upload for you, and any favourites or selections you make within your gallery. If a gallery asks for your name and email before you download photographs, we keep those details too.
• Online orders and delivery: when you buy prints or digital downloads from a gallery or a school session, we keep your order, your name and email address and, if you choose home delivery, your delivery address, together with any courier and tracking details.
• School and nursery sessions: for children photographed at a school or nursery session we hold the child's name and class, the parent or carer's name and email address, the consent form responses you give us, the photographs taken, and records of which photographs have been viewed and ordered.
• Email activity: when we send you an email we keep a record of it and of whether it was delivered, opened, or a link in it was clicked. This comes from our email provider and from tracked links in our emails.
• Portal and security records: login records generated when you use our one-time passcode (OTP) email login, including the date, time, IP address and device type, failed sign-in attempts, and messages exchanged with us through the portal.
• Gallery visit information: when you view a gallery we record that a visit took place, using an anonymised form of your IP address and a session identifier, so that we can see whether and when a gallery has been looked at. We do not use this to identify you.
• Website visit information: when you visit our main website we record, on our own systems, which pages are visited, the route taken through the site, and the website or search engine that referred you to us. This is used to understand how the site is used and to improve it.

We do not ask you to create or store a password. Access to your account is via a one-time passcode sent to your registered email address each time you log in.

Photographs of Children

We photograph children at schools and nurseries only where a parent or carer has completed our consent form. Photographs are shown only to the parent or carer who holds the code for that child (and to the parents of other children who appear in the same photograph, once they have entered their own code). Previews are watermarked and low resolution. You can withdraw your consent, or ask us to delete your child's photographs, at any time by contacting us. We keep the consent form responses, even after photographs are deleted, so that we can show that consent was given.

How We Use Your Data

We use your personal data to:

• Set up and manage your client account and provide access to the client portal.
• Plan, deliver, and administer your photography booking, including producing contracts, quotes, and invoices.
• Provide you with access to your galleries, invoices, contracts, and quotes via the authenticated portal or PIN-protected public links.
• Take and process orders for prints and digital downloads, have prints produced, arrange collection or delivery, and send you your digital downloads.
• Run school and nursery photography sessions, including giving each parent access to their child's photographs and taking their orders.
• Respond to enquiries submitted through our public forms.
• Send you service-related (transactional) emails, such as booking confirmations, invoice notifications, order updates, reminders about orders or galleries that are about to close or expire, and portal login codes.
• Send you marketing emails where you have given your consent, always with the option to unsubscribe.
• Check that our emails are being delivered and to see which are useful to our clients.
• Understand how our website is used and improve it.
• Keep our systems secure, detect misuse and unauthorised access, and investigate problems.
• Meet our legal and tax obligations, including keeping financial records for the required period.

We do not carry out automated decision-making or profiling that has a legal or similarly significant effect on you.

Legal Bases for Processing

Under UK GDPR, we rely on the following legal bases:

• Performance of a contract: to manage your booking, deliver photography services, take and fulfil your orders, and give you access to your contracts, quotes, invoices, and galleries.
• Legal obligation: to retain signed contracts and financial records in line with HMRC and other statutory requirements.
• Legitimate interests: to respond to enquiries, maintain the security of the client portal and our systems, check that emails are delivered, remind clients about orders and expiring galleries, understand how our website is used, and administer our business records, where this does not override your rights and interests.
• Consent: for marketing emails, and for photographing children at schools and nurseries (given by a parent or carer on the consent form). You can withdraw consent at any time, for marketing by clicking the unsubscribe link in any marketing email, and for photography by contacting us.

How Long We Keep Your Data

• Signed contracts: retained permanently, on the basis of contract performance and our legal obligations.
• Invoices, orders and payment records: retained for at least 5 years, in line with HMRC record-keeping requirements.
• Client galleries: a gallery can be given an expiry date, after which it is no longer accessible. Where a gallery is set to be deleted on expiry, we email the client a warning shortly before, and then permanently delete the gallery and its photographs.
• School and nursery sessions: each session has a date after which ordering closes and a later date on which the children's names, class details, parent contact details and photographs are permanently deleted from our systems. We keep the consent form responses so that we can evidence consent, and the records of orders and payments for the periods above.
• Client accounts: if your account is inactive for 2 years, we will send you a warning email before taking any action. You can reactivate your account at any time during the warning period simply by logging in.
• Anonymisation: if an account remains inactive after the warning period, we anonymise it. This means your personal details are deleted, along with profile photos, gallery images, documents, and messages. Financial records that we are legally required to keep are retained in anonymised or minimal form as needed to meet our legal obligations.
• Email records: the record of emails we have sent (including delivery and open information) is deleted after 90 days.
• Website visit records: kept only for as long as they are useful for understanding how our website is used.
• Security and technical logs: records of failed or unusual requests to our website are deleted after 30 days, and sign-in and security records are kept for as long as is needed to keep your account secure.
• Backups: we keep regular backups of our systems for a limited period so we can recover from a failure. Data deleted from our live systems is removed from backups as they are replaced.
• Erasure on request: you can ask us to erase your personal data at any time. We will comply with this request except where we are legally required to retain certain records (for example, financial records within the 5-year HMRC retention period).

Who We Share Your Data With

We work with a small number of trusted service providers to run our business. We do not sell your data, and we do not share it with third parties for their own marketing purposes.

• Loxley Colour (our photo lab): when you order prints, we send the photographs you have ordered, and the details needed to produce and deliver the order (for example your name and, where the lab delivers to you directly, your delivery address), to Loxley Colour. They handle this on our instructions, only to make and deliver your prints.
• Brevo (Sendinblue): used to send our emails, including transactional emails (such as OTP login codes, invoice notifications, and order updates) and marketing emails (where you have consented), and to tell us whether they were delivered, opened, or clicked. Brevo operates its data centres within the EU, with the UK recognising the EEA/EU as providing adequate protection for personal data.
• Stripe: processes card payments for invoices and online orders. You enter your card details on Stripe's secure pages, not ours. Stripe acts as an independent controller for the payment data it receives and has its own privacy policy at stripe.com/gb/privacy.
• Delivery couriers: if you choose home delivery and we send your order ourselves, we pass your name and delivery address to the courier (such as Royal Mail or DPD) so that your order can be delivered.
• Address checking: when you enter a delivery postcode, we check that it exists using the free postcodes.io service. Only the postcode is sent, not your name or any other details.
• Fonts and page resources: some pages of our client portal and galleries load fonts and scripts from Google Fonts and from content delivery networks such as Cloudflare and jsDelivr. When your browser fetches these, the provider can see your IP address and browser details.
• Hosting: our client portal, galleries, and business systems are located and operated within the UK.

We may also share information where we are required to by law, or to protect our legal rights.

International Transfers

Our own systems are hosted in the UK and our email provider processes data within the EU. Some of our service providers, including Stripe and Google (for fonts), may process limited data outside the UK, including in the United States. Where this happens, it is protected by the safeguards those providers use, such as the UK International Data Transfer Addendum or other approved transfer mechanisms.

Cookies and Tracking

Our client portal and galleries use only the cookies that are necessary for the service to work: a session cookie to keep you securely logged in, to remember that you have entered a gallery PIN or a school or nursery code, and to protect forms against misuse. These do not track you across other websites. We do not use advertising or analytics cookies in the portal or galleries.

Our main website does not use third-party cookies or tracking services. We record page visits, the route taken through the site, and referrers on our own systems only, and we do not pass this information to anyone else.

Our emails contain a small tracking image and links that tell us whether an email was opened and whether a link was clicked. Most email apps allow you to block remote images if you prefer.

How We Protect Your Data

• All connections to our portal and galleries are encrypted.
• Logins use one-time passcodes sent to your registered email address, and repeated failed attempts are limited.
• Access to client data is limited to the people who need it, and each client can see only their own information.
• Gallery previews are watermarked, and original photographs are not accessible through public links.
• We monitor for unusual sign-in activity.

If a personal data breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your personal data, subject to our legal retention obligations described above.
• Restriction of how we process your data in certain circumstances.
• Portability of your data, so you can obtain and reuse it for your own purposes.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, for marketing by clicking the unsubscribe link in any marketing email or contacting us directly, and for photography of your child by contacting us.

To exercise any of these rights, please contact us using the details below. We will respond within one month, as required by law.

How to Contact Us

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

• Email: jarad@jaradlee.co.uk

How to Complain

We hope we can resolve any concerns you have about how we handle your personal data. If you remain unhappy, you have the right to lodge a complaint with the UK's supervisory authority for data protection:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will post any updates on this page, and show the date it was last updated at the top.