Privacy Policy

Last updated: 28 October 2026

1. Introduction

This Privacy Policy explains how personal data is collected, used, and protected when you visit this website or make an enquiry. It is provided in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, including by the Data (Use and Access) Act 2025.

2. Who I Am

This website is owned and operated by Chloe Lloyd, trading as Chloe Lloyd Photography, a sole trader based in the United Kingdom. For the purposes of data protection law, I am the data controller responsible for your personal data. If you have any questions about this policy or how your data is handled, you can contact me at chloelloydphotos@outlook.com .

3. Information I Collect

I may collect and store the following personal information: your name; your email address; your phone number (if provided); details included in enquiry forms or emails; and contractual and billing information for clients, including billing addresses and payment records. I may also collect your marketing preferences, including whether you have signed up to or unsubscribed from my mailing list.

I may also collect technical information such as your IP address, browser type, device type and the pages you visit, through cookies and similar technologies (see section 12).

Where I photograph or film people as part of a commission, I process images, footage and related details such as names and captions.

I do not knowingly collect special category personal data (such as information about health, ethnicity, religion or sexuality) unless it is explicitly required and agreed in advance.

4. How I Collect Your Information

Personal data is collected when you submit an enquiry through the website, contact me by email, enter into a contract for services, or communicate with me during a project.

5. How Your Information Is Used

Your information is used only where necessary and for legitimate business purposes, including responding to enquiries, discussing and managing projects, issuing contracts and invoices, delivering services, and maintaining business records. I will not sell your personal data, and I will not share it with third parties for their own marketing purposes.

I may also use your name and email address to send you marketing emails, such as news about my work, updates, offers and details of my services. I will only do this where you have given your consent, for example by ticking a box or signing up to a mailing list, or where you are an existing or recent client and I am promoting similar services to those you have already bought from me. In that case, I will give you a clear chance to opt out when I first collect your details and in every message I send.

You can unsubscribe at any time by using the link in any marketing email or by contacting me at chloelloydphotos@outlook.com, and I will stop sending you marketing promptly. Unsubscribing from marketing does not affect service messages, such as project updates and invoices.

6. Legal Basis for Processing

I process personal data under the following legal bases.

Contract, and steps taken at your request before entering a contract: to respond to your enquiry, prepare quotes and proposals, deliver agreed services and issue invoices.

Legal obligation: to keep accounting and tax records.

Legitimate interests: to run and manage my business responsibly, to keep business records, to secure my systems, and to showcase my work where this is permitted under the relevant contract, and to send marketing emails to existing or recent clients about similar services, subject to your right to opt out at any time. My legitimate interests do not override your rights and freedoms.

Consent: where I specifically ask for it, including for marketing emails to people who are not existing or recent clients, for non essential cookies, and for any other purpose that requires it. You may withdraw your consent at any time.

7. How Your Data Is Stored and Transferred

Your data is stored securely using password protected devices and trusted third party services such as email providers, accounting software, website hosting and file delivery platforms. Reasonable steps are taken to protect personal data from loss, misuse, or unauthorised access.

Some of these providers may store or process data outside the United Kingdom. Where this happens, I ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK Extension to the EU US Data Privacy Framework, or the International Data Transfer Agreement or Addendum.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, I will notify the Information Commissioner’s Office within 72 hours and will inform you where required by law.

8. How Long Your Data Is Kept

Personal data is retained only for as long as necessary.

Enquiry data that does not lead to a contract is kept for up to 12 months in case of follow up.

Client and accounting data is retained for six years from the end of the relevant tax year.

Project files and correspondence are retained for 24 months after project completion, unless I am required to keep them for longer. Images and footage that I am permitted to use in my portfolio may be kept for as long as that use continues under the relevant contract.

Marketing preferences and mailing list records are kept until you unsubscribe or ask me to stop. After that, I keep only the minimum information needed to make sure I do not contact you again.

Data that is no longer required is securely deleted.

9. Sharing Your Information

Your personal data is not sold or shared unnecessarily. It may be shared only where required to deliver services or meet legal obligations, such as with accountants, legal or tax authorities (including HMRC), and trusted service providers (for example file delivery, hosting, email or invoicing platforms). These providers act on my instructions as data processors and are required to protect your data under appropriate terms. I may also disclose personal data where I am required to do so by law or to establish, exercise or defend legal claims.

10. Your Rights

Under UK GDPR, you have the right to request access to your personal data, request correction of inaccurate data, request deletion of your data (where applicable), object to or restrict processing, and request data portability. You also have the right to withdraw consent at any time where processing is based on consent. I do not carry out any solely automated decision making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, please contact me using the details above. I will respond within one month, which may be extended by up to two further months for complex requests, and I will tell you if this applies. I do not normally charge a fee. I may need to verify your identity before acting on a request, and some rights are subject to legal exceptions.

11. Complaints

If you have any concern about how I have handled your personal data, please contact me first using the details above. I will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress, and tell you the outcome. You do not need to use any legal terms for your concern to be treated as a complaint.

You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, telephone 0303 123 1113). The ICO will generally expect you to have raised your concern with me first.

12. Cookies

This website may use cookies to ensure it functions properly and to understand how visitors use the site. Strictly necessary cookies do not require consent. Other cookies, such as analytics or marketing cookies, will only be set with your consent where the law requires it, and you can change your choice at any time. Some cookies may collect personal data, such as your IP address. You can control or disable cookies through your browser settings.

13. Children

This website is not directed at children, and I do not knowingly collect personal data from children through it. Children under 18 are not asked to submit enquiries or sign up to my mailing list.

As a photographer and videographer, I may photograph or film children and young people as part of a commission, for example at events, productions or community projects arranged by an organisation or by a parent or guardian. Children’s personal data merits particular care, and I handle it as follows.

Before photographing or filming a child under 18, I will ensure that the consent of a parent or guardian has been obtained, either directly by me or by the commissioning organisation under a written arrangement with me. Where the child is old enough to understand, I will also respect their wishes and will not photograph or film a child who objects.

I will not publish a child’s full name alongside their image, and I will not publish images that reveal a child’s home address, school or other information that could identify where they can be found, unless this has been specifically agreed in writing with a parent or guardian.

A parent or guardian, or a young person who is old enough to understand their rights, may at any time ask me to stop using, or to delete, an image or footage of the child, using the contact details in section 2. I will act on such requests promptly, although I may not be able to recall material that has already been published or distributed by a third party.

Images and footage of children are never used to train artificial intelligence or machine learning tools.

14. Links to Other Websites

This website may link to third party websites. I am not responsible for their privacy practices, and I encourage you to read their policies.

15. Changes to This Policy

This Privacy Policy may be updated from time to time. The most recent version will always be available on this website, and the date at the top shows when it was last revised.