Chibishots Photography
Privacy Notice
What we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it. Anything described here is genuinely collected.
Who we are
Chibishots Photography is a sole trading business and the data controller for everything on this page. Our legal name and postal address will be published here before the studio takes bookings; until then, mail@chibishots.co.uk reaches the person responsible. We are not yet registered with the Information Commissioner's Office, and this notice will be updated when the studio starts trading.
What we collect, and why
| What | Why | Why we're allowed to | Kept for |
|---|---|---|---|
| Enquiries and bookings | To arrange and deliver your session, invoice you and keep a booking record: your name, email address, the session, the date and time slot, and any notes. | Performing our contract with you | Six years |
| Client galleries | To send your gallery link and invoices: your name and email address. A gallery is reached with a personal PIN, so treat it as a password. | Performing our contract with you | Photographs, two years from delivery |
| Moodboards | Images, links and notes added by you or your photographer, reachable only with its own link. | Performing our contract with you | The session, then two years |
| Signed documents | Evidence that you agreed to specific wording at a specific time: your name, signature, date and time, and the details of your connection. | Performing our contract with you, and keeping a record of it | Six years from signature |
| Payments | Handled by our payment provider. We receive the amount, reference and status — never your card number. | Our duty to keep business and tax records | Six years, as a business record |
| Links sent by email | The token inside a gallery or document link. The document itself is kept as above. | Performing our contract with you | Ninety days |
| Server logs | Your IP address in server logs, so we can keep the site secure and running. | Our legitimate interest in keeping the site secure | Fourteen days |
If you would rather we did not hold your details, or you decide not to go ahead, tell us and we will delete whatever we are not legally required to keep. We cannot deliver a session, a gallery or an invoice without them, though, and we cannot honour a withdrawal from publication while a signed licence covers the image.
Signed records outlive photographs on purpose: six years is how long a contract claim can typically be brought, so deleting a signed licence early would leave us unable to evidence the permission to use the images. Photographs can be released sooner than two years, or kept longer, if you ask.
Who else sees it
Our email provider delivers our email, our payment provider takes payments, and our web host stores the site. Each receives only what it needs, and some of them are based outside the UK. Where an image is licensed to a client, a gallery host, a print laboratory or a publication, that party receives the image and the agreed credit line, and nothing else. We do not sell your data, and we do not pass it to anyone for their own purposes.
There is no advertising or analytics here: no tracking pixels, no cross-site tracking, no behavioural profiling, and no cookies for advertising. A little browser storage remembers interface preferences, such as which moodboard section you last had open.
Security
All pages are served over HTTPS, and administrative access is restricted. Client galleries and documents are never publicly listed — they are reachable only through the link and PIN issued to you. No internet-based system is entirely secure: if a breach is likely to risk your rights and freedoms, we will notify the Information Commissioner and notify you where the law requires it.
Your rights
You can ask us for a copy of the data we hold about you, to correct it, to erase it, or to object to how we use it. You can also ask us to restrict how we use it, or to transfer the data you gave us to another organisation.
We acknowledge requests within seven days and respond in full within one month, or explain if we need longer. We will ask you to verify your identity before disclosing anything, so that we do not release your information to someone else — please do not send passwords, PINs or card details.
Erasing a signed record would remove our ability to evidence the licence you granted. Where that is the case we retain the signed record while your request is resolved and release the associated images without delay. To withdraw an image from publication, tell us and we will discuss it.
Nothing here is decided by an algorithm — no profiling, no scoring, and a person reads every request. We also do not rely on your consent, so there is nothing to withdraw. If you want something to stop, ask and we will stop it.
If you are unhappy with how we handled your request, complain to the Information Commissioner’s Office at ico.org.uk.
Make a request
The form below records your request, issues you a reference and starts the one-month clock. You will receive an acknowledgement by email. If you would prefer to write, email mail@chibishots.co.uk with the subject line “Data request” and we will treat it the same way.
Changes to this notice
We review this periodically and update it when our practices or the law change. The date below is the most recent revision, and where a change materially affects how your data is used we will contact you directly.