1. Who we are

Eye for Boudoir ("we", "us", "our") is a trading name of Sally Burley and Trev Burley, and we are the data controller for the personal information described in this policy.

Address for service (post only, not a studio or visitor address):
Eye for Boudoir
BA 703
Nexus Connect
Esh
Durham
DH7 9QR
Email: studio@eyeforboudoir.co.uk

This policy explains what data we collect, why, how long we keep it, and your rights in relation to it.

2. Information we collect

We may collect the following types of personal information:

• Contact details (name, email address, phone number)
• Booking and payment information
• Photographs and video taken during your session
• Pre-session details you give us so we can plan the day, which may include health information such as injuries, mobility limits or pregnancy, allergies, and the name and number of an emergency contact
• Communications between us
• Your email address, if you join our mailing list
• Website usage data, via cookies, where you have consented

Some of this is special category data under UK GDPR Article 9 — the health information in particular. We ask for it because planning a shoot around an injury beats discovering it mid-pose, we ask for your explicit agreement before you give it to us, and we delete it after your session. It is never used for marketing.

If someone buys a gift voucher for you, we receive your name and email address from them rather than from you. We use them to send you the voucher and to honour it when you book, and we tell you so in the email itself.

3. How we use your information, and our lawful basis

UK GDPR requires us to have a lawful basis for each thing we do with your data, and to tell you what it is. This table is that.

We do not make any decisions about you by automated means, and we do not profile you.

4. Photography and your images

Every photograph taken during your session stays private unless you have agreed in writing that we may use it. Nothing is published quietly, incidentally, or on the strength of a pre-ticked box.

Beyond that, two different arrangements exist and they do not work the same way. Which one applies to you depends on whether you paid for your session.

If you booked and paid for a session

We will never publish, display, or use your images for any promotional purpose without your signed consent. Our lawful basis is your consent, under Article 6(1)(a).

You can withdraw that consent at any time, and you do not need a reason. Tell us and we stop using the images — there is nothing for us to weigh and nothing for you to argue. You have already paid for your session, so your permission was never something we were owed.

If you took part in a volunteer session

A volunteer session is an exchange: it was given free of charge, and the licence to use the images is what we received in return for it. That is set out in the volunteer agreement you signed before the shoot, and it is the first thing that agreement says.

Because the licence is the payment rather than a favour, our lawful basis here is our legitimate interest in showing the work we do, under Article 6(1)(f), not consent. In practical terms that means asking us to stop is a right to object under Article 21 — something we weigh — rather than an automatic switch.

You can ask us to stop at any time, and we will take that seriously rather than point you at a form you signed. In most cases we will simply agree. Where a set of images has become part of how we show our work — the reason the session happened at all — we may need to keep using some of them, and we will tell you which and why rather than go quiet on you. If continuing to publish would put you at risk, we remove everything at once and do not weigh it commercially.

We have written down the reasoning behind that balance, and we will send it to anyone who asks.

What we cannot undo, either way

We cannot recall printed material, sample albums or exhibition prints already produced, and we cannot remove copies that other people have shared. We would rather say so now than discover it together later.

5. Data retention

The table in section 3 gives the period for each thing we hold. In summary:

• Booking records — 7 years, because HMRC requires it of the accounting records they form part of.
• Enquiries that don't lead to a booking — 2 years from our last exchange.
• Health information and emergency contact details — removed automatically once your session date has passed. This happens on a schedule; it does not wait for one of us to remember.
• Session images — kept for as long as we may need to supply them to you or to honour the terms of your session. Images in our portfolio or marketing are kept for as long as that use continues, which may be indefinitely.
• Mailing list — until you unsubscribe, which you can do from any email we send.

6. Data sharing and where your data goes

We do not sell your personal data, and we do not share your session images with anyone for their own purposes. We use the following service providers, who process data on our behalf under contract:

• Stripe — card payments. If you buy a gift voucher, Stripe receives your name and email address to take the payment. We never see your card details.
• Brevo — our mailing list, if you have joined it.
• Our email and hosting providers — which necessarily handle the messages and records passing through them.
• Google (Analytics) and Meta (Facebook Pixel) — only if you accept analytics or advertising cookies. See our Cookie Policy.
• CookieYes — which runs the cookie banner itself and records your choice.

Some of these providers are based outside the UK, or use infrastructure that is. Where personal data is transferred outside the UK, it is protected by the safeguards UK GDPR requires — an adequacy decision, or the International Data Transfer Agreement, depending on the provider. Anything we publish to social media is, by its nature, transferred to and hosted by those platforms.

We may also disclose data where the law requires it.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate
• Delete your data. This is not absolute — where we are required to keep accounting records, or where section 4 applies to images we are still using, we will tell you what we are keeping and why rather than quietly keep it
• Restrict how we use it
• Object to processing we carry out on the basis of legitimate interests, including our use of volunteer images under section 4
• Portability — receive your data in a transferable form
• Withdraw consent at any time, where consent is what we rely on. For images from a paid session, that stops our use of them, with no reason needed and nothing weighed

Direct marketing is different from all of the above. You can tell us to stop sending you marketing at any time, and we must stop. There is no balancing exercise and no exceptions. Unsubscribe from any email, or just email us.

To exercise any of these rights, contact us at studio@eyeforboudoir.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data or your request, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. You can reach them at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first, but you do not have to.

8. Cookies

Our website uses cookies. Please see our Cookie Policy for full details. Analytics and advertising cookies are only loaded after you have given your explicit consent.

9. Third-party links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

10. Age restrictions

Our photography services are for adults aged 21 and over, and we check photo ID before a session begins. We do not knowingly photograph or hold session records for anyone under 21.

11. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

12. Contact

For any privacy-related query, or to exercise any of the rights in section 7, contact us at:

Eye for Boudoir, a trading name of Sally Burley and Trev Burley
Address for service (post only, not a studio or visitor address):
Eye for Boudoir
BA 703
Nexus Connect
Esh
Durham
DH7 9QR
studio@eyeforboudoir.co.uk