Privacy

[PLACEHOLDER: have this policy checked before launch] · Last updated [PLACEHOLDER: date]

Who I am

I’m Matt Roberts, a photographer trading as Matt Roberts Photography. I’m responsible for the personal data described here (the “data controller”). [PLACEHOLDER: business address]. [PLACEHOLDER: ICO registration number, if registered]. You can contact me about privacy through the contact page.

What I collect and why

When you send an enquiry

Your name, email address, the type of shoot, and anything else you choose to tell me (a date, a location, your message). I use them to reply to you and, if you book, to arrange and deliver your shoot. The legal basis is taking steps at your request before entering into a contract, and then the contract itself.

When you buy a photo

Your name, email address and the photo you bought, so I can email you your download link and help with any questions about your order. Payment is handled by Stripe: I never see or store your card details. The legal basis is the contract between us, and keeping records that UK tax law requires.

If you’re a client I’ve photographed

Your photos are delivered to you privately. I only show photos of you or your family on this website, on social media or in my portfolio with your permission, and you can ask me to remove them at any time. Before publishing photos online I remove location data from them.

When you visit the website

The site doesn’t use advertising or tracking cookies. Like any website, the servers that deliver it briefly process technical information such as your IP address, to send you the pages and keep the site secure. The fonts and animation code are served from this site itself, not from other services.

To see which pages are visited, I use Umami, a privacy-friendly analytics service. It doesn’t use cookies and doesn’t collect information that identifies you: I see totals such as page views, which pages are popular, which websites sent visitors, and the type of device and country. It also counts when a Buy button is clicked or a contact message is sent, without recording who did it.

Who helps me

I use a small number of trusted services to run the site. They only process your data on my instructions:

• Stripe: takes payments for photo files.
• Resend: sends order emails and passes enquiries to my inbox.
• Cloudflare: hosts the website and stores the photo files you download.
• Umami: counts website visits, without cookies.
• WeTransfer: sends clients their finished photos after a shoot.
• Google (Gmail): receives my email (messages to matt@mosroberts.com are forwarded there).
• [PLACEHOLDER: email forwarding service: Squarespace Domains now, or Cloudflare Email Routing if the DNS moves]

Some of these companies are based outside the UK, mainly in the USA. Where your data is transferred abroad, it’s protected by the safeguards UK law requires, such as the UK–US data bridge or standard contract clauses.

How long I keep it

• Enquiries that don’t lead to a booking: [PLACEHOLDER: e.g. 12 months], then deleted.
• Bookings and photo sales: as long as UK tax law requires (currently at least 5 years after the tax year ends).
• Download links stop working after 7 days.
• Client photos: [PLACEHOLDER: how long you keep client photos and backups].

Your rights

You can ask me for a copy of the personal data I hold about you, ask me to correct it or delete it, object to or restrict how I use it, ask for it in a portable format, and withdraw any permission you’ve given. Just get in touch through the contact page; I’ll reply within one month.

If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. I’d appreciate the chance to put things right first.

Changes

If I change how I use personal data, I’ll update this page and the date at the top.