Privacy Policy

Last updated: 13 February 2026

Shacoworkshop ("we", "our", "us") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Shacoworkshop is a professional photography business based in Southampton, Hampshire, UK. For the purposes of data protection law, Shacoworkshop is the data controller. If you have questions about how we handle your data, you can reach us via our contact page.

2. What Data We Collect

We collect and process the following types of personal data:

Contact Form Submissions

When you submit an enquiry through our website contact form (powered by Web3Forms), we collect:

  • Your name
  • Your email address
  • Your phone number (if provided)
  • The content of your message
  • The type of service you are enquiring about

This data is transmitted securely to our email inbox via Web3Forms. We do not store contact form submissions in a database on our website.

Booking and Client Information

When you book a session, we collect additional information necessary to provide our services, including:

  • Your full name and contact details
  • Session date, time, and location
  • Payment information (processed securely via third-party payment providers)
  • Any relevant details you share about the session (e.g., names of family members, event schedule)

Photographs

Photographs taken during sessions contain images of you and, where applicable, your family members, guests, or colleagues. Photographs may also contain embedded metadata (EXIF data) including the date, time, and camera settings. Location data is stripped from all delivered images.

3. How We Use Your Data

We use your personal data for the following purposes:

  • To respond to enquiries: When you contact us, we use your details to reply and provide information about our services.
  • To provide our services: Processing bookings, communicating about sessions, delivering images, and handling payments.
  • To maintain business records: Keeping records of bookings, invoices, and correspondence as required for legal and accounting purposes.
  • Portfolio and marketing: With your consent (as outlined in our Terms of Service), we may use photographs from your session on our website, social media, and marketing materials.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contractual necessity: Processing that is necessary to fulfil our contract with you (e.g., delivering photographs, communicating about your booking).
  • Legitimate interest: Processing that is in our legitimate business interest, such as responding to enquiries and improving our services.
  • Consent: Where you have given explicit consent, such as opting in to marketing communications or agreeing to portfolio use of images.
  • Legal obligation: Where we are required to retain data for legal or regulatory purposes (e.g., financial records).

5. Cookies and Analytics

This website uses Cloudflare Web Analytics, a privacy-first analytics service. Cloudflare Web Analytics does not use cookies, does not track individual users, and does not collect personal data. It provides anonymous, aggregated data about page views and performance metrics only.

We do not use any other cookies, tracking pixels, or third-party analytics tools on this website. There are no advertising trackers, social media pixels, or retargeting scripts.

6. Third-Party Services

We use the following third-party services in the operation of our website and business:

  • Web3Forms: Processes contact form submissions and forwards them to our email. Web3Forms does not store your data permanently. Web3Forms Privacy Policy
  • Cloudflare: Hosts our website and provides analytics. Cloudflare Privacy Policy
  • Google Fonts: Provides web fonts used on this website. Font files are loaded from Google's servers. Google Privacy Policy

We do not sell, rent, or share your personal data with any other third parties for marketing purposes.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Contact form enquiries: Retained in our email system for up to 24 months, then deleted unless a booking is made.
  • Booking and client records: Retained for 6 years after the last transaction, as required for tax and accounting purposes under HMRC guidelines.
  • Photographs: Archived for a minimum of 12 months after delivery, after which they may be deleted from our systems. Photographs used in our portfolio are retained for the duration of their marketing use.

8. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

  • Right of access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can ask us to correct any inaccurate or incomplete data.
  • Right to erasure: You can request that we delete your personal data, subject to legal retention requirements.
  • Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
  • Right to data portability: You can request your data in a structured, machine-readable format.
  • Right to object: You can object to our processing of your data based on legitimate interest.
  • Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time.

To exercise any of these rights, please contact us. We will respond to your request within 30 days.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. This includes encrypted data transmission (HTTPS), secure cloud storage for images, and restricted access to client records.

10. Children's Data

We photograph children as part of family, newborn, and event sessions. In all cases, consent for photographing minors is provided by the parent or legal guardian who books the session. We do not knowingly collect personal data directly from children under the age of 16.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

12. Complaints

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We encourage you to contact us first so we can address any concerns directly.

Contact

If you have questions about this privacy policy or how we handle your data, please get in touch.