Who We Are

This privacy policy explains how Jarad Lee Photography ("we", "us", "our") collects, uses, and protects your personal data when you use our client portal at client.jaradlee.co.uk, engage us for wedding, portrait, or event photography services, or otherwise get in touch with us.

We are the data controller for the personal data described in this policy.

• Trading name: Jarad Lee Photography
• Business address: Shireoaks
• Contact email: jarad@jaradlee.co.uk

What Data We Collect

We collect the following categories of personal data:

• Account details: your name, email address, phone number, and (where applicable) your partner's name and email address, created when you are booked in as a client.
• Booking and questionnaire information: details you provide about your shoot, such as preferences, locations, dates, and other event-specific information.
• Enquiry and lead data: name, email address, and event details submitted through our public enquiry forms, even if you do not go on to book with us.
• Contracts: signed booking contracts and associated correspondence.
• Financial records: invoices, quotes, and payment records. We use a third party payment gateway provider, Spripe, to securely process any transactions. We never see or store your card or bank information.
• Gallery content: photographs we take and upload for you, and any favourites or selections you make within your gallery.
• Portal activity: login records generated when you use our one-time passcode (OTP) email login, and messages exchanged with us through the portal.

We do not ask you to create or store a password. Access to your account is via a one-time passcode sent to your registered email address each time you log in.

How We Use Your Data

We use your personal data to:

• Set up and manage your client account and provide access to the client portal.
• Plan, deliver, and administer your photography booking, including producing contracts, quotes, and invoices.
• Provide you with access to your galleries, invoices, contracts, and quotes via the authenticated portal or PIN-protected public links.
• Respond to enquiries submitted through our public forms.
• Send you service-related (transactional) emails, such as booking confirmations, invoice notifications, and portal login codes.
• Send you marketing emails where you have been enrolled based on your questionnaire submissions, always with the option to unsubscribe.
• Meet our legal and tax obligations, including keeping financial records for the required period.

Legal Bases for Processing

Under UK GDPR, we rely on the following legal bases:

• Performance of a contract: to manage your booking, deliver photography services, and give you access to your contracts, quotes, invoices, and galleries.
• Legal obligation: to retain signed contracts and financial records in line with HMRC and other statutory requirements.
• Legitimate interests: to respond to enquiries, maintain the security of the client portal, and administer our business records, where this does not override your rights and interests.
• Consent: for marketing emails, which you can withdraw at any time by clicking the unsubscribe link included in every marketing email.

How Long We Keep Your Data

• Signed contracts: retained permanently, on the basis of contract performance and our legal obligations.
• Invoices and payment records: retained for 5 years, in line with HMRC record-keeping requirements.
• Client accounts: if your account is inactive for 2 years, we will send you a warning email before taking any action. You can reactivate your account at any time during the warning period simply by logging in.
• Anonymisation: if an account remains inactive after the warning period, we anonymise it. This means your personal details are deleted, along with profile photos, gallery images, documents, and messages. Financial records that we are legally required to keep are retained in anonymised or minimal form as needed to meet our legal obligations.
• Erasure on request: you can ask us to erase your personal data at any time. We will comply with this request except where we are legally required to retain certain records (for example, financial records within the 5-year HMRC retention period).

Who We Share Your Data With

We work with a small number of trusted service providers to run our business. We do not sell your data, and we do not share it with third parties for their own marketing purposes.

• Brevo (Sendinblue): used to send transactional emails (such as OTP login codes and invoice notifications) and marketing emails (where you have consented). Brevo operates it's data centres within the EU, with the UK recognising the EEA/EU as providing adequate protection for personal data.
• Monzo: payment links may be included in your invoices to allow you to pay us. We do not process or store your card details ourselves, and this payment step happens on Monzo's platform.
• Hosting: our client portal, galleries, and business systems are located and operated within the UK.

We do not transfer your personal data outside the UK/EU.

Cookies

Our client portal uses session cookies only, which are necessary to keep you securely logged in while you use the site. We do not use tracking or analytics cookies, and we do not use cookies for advertising purposes.

Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your personal data, subject to our legal retention obligations described above.
• Restriction of how we process your data in certain circumstances.
• Portability of your data, so you can obtain and reuse it for your own purposes.
• Object to processing based on legitimate interests.
• Withdraw consent for marketing at any time, by clicking the unsubscribe link in any marketing email or contacting us directly.

To exercise any of these rights, please contact us using the details below. We will respond within one month, as required by law.

How to Contact Us

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

• Email: jarad@jaradlee.co.uk

How to Complain

We hope we can resolve any concerns you have about how we handle your personal data. If you remain unhappy, you have the right to lodge a complaint with the UK's supervisory authority for data protection:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will post any updates on this page.