- Home
- Privacy & cookies
Your data
Privacy & cookies your rights
What personal data is collected, why, how long it is kept and what your rights are under UK data protection law.
1. Who is responsible for your data
The data controller is Tom Aizenberg (legal name), who trades as Tom Sheard Photography under the professional name Tom Sheard, Ground Floor Flat, 13 Beaumont Road, London W4 5AL, United Kingdom. Email: [email protected], telephone: 07941 795690.
This notice explains how personal data is used under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. What data is collected
When you send the booking form
Your name, email address, phone number, the type of session, preferred date, venue or area, your message and – if you used the calculator – the selected package and estimate. The form also records the date and time of sending and your confirmation that you have read this notice.
When you book a session
The details needed to perform the contract: addresses of venues, timelines, names of family members for group lists, invoices and payment records. Card payments are handled by the payment provider; I never see or store full card details.
Photographs
Photographs of you, your family and guests are personal data. Wedding or other ceremonies may indirectly reveal religious or philosophical beliefs; such images are processed only to deliver the service you booked. Photographs of children are taken only with the consent and presence of a parent or guardian.
When you visit the website
The web server records technical data such as IP address, browser type, the page requested and the time, in order to deliver the website and keep it secure. To prevent abuse of the booking form, a keyed one-way hash of your IP address is stored for up to one hour; the address itself is not stored with your request.
3. Why the data is used and the lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Answering your request, checking availability and preparing a quote | Steps taken at your request before a contract – Article 6(1)(b) |
| Planning and delivering the photography session, galleries, prints and albums | Performance of a contract – Article 6(1)(b) |
| Invoices and accounting records | Legal obligation – Article 6(1)(c) |
| Website security, preventing spam and misuse of the booking form | Legitimate interests – Article 6(1)(f) |
| Showing your photographs in the portfolio, on this website or in marketing | Your consent – Article 6(1)(a), which you may withdraw at any time |
There is no automated decision-making or profiling, and no newsletters or marketing emails are sent.
4. How your data is protected
Booking requests are stored on the web server in encrypted form (AES-256), in a folder that cannot be accessed over the internet. Only Tom Aizenberg has access. Photographs are kept on encrypted drives with a second backup and in an encrypted cloud backup. The website is served over a secure HTTPS connection.
5. Who your data is shared with
Your data is never sold or shared for marketing. It is shared only when necessary with service providers acting on my instructions under a written contract:
- the website hosting provider (storage of the website and booking requests);
- the online gallery platform (delivery of your photographs);
- the payment provider (processing card payments);
- a professional UK print laboratory (only if you order prints or albums);
- a second photographer or make-up artist (only if you book them, and only the details they need);
- an accountant, and HM Revenue & Customs where the law requires it.
If a provider stores data outside the UK, the transfer is protected by UK adequacy regulations or the International Data Transfer Agreement approved by the ICO.
6. How long data is kept
- Requests that do not lead to a booking: deleted after 12 months.
- Client and contract records: 6 years after the end of the tax year in which the service was provided, to meet HMRC record-keeping rules.
- Online galleries: 12 months after delivery. Backups of edited images: at least 5 years, so lost copies can be replaced. You can ask for earlier deletion at any time.
- Form security data (IP hash): 1 hour. Web server logs: up to 30 days, depending on the hosting provider.
7. Cookies
This website uses one cookie only:
| Name | Purpose | Duration | Type |
|---|---|---|---|
| azg_booking | Protects the booking form against forged and automated submissions | Deleted when you close the browser | Strictly necessary |
Strictly necessary cookies do not need consent under PECR, which is why there is no cookie banner. The website does not use analytics, advertising or social media cookies, and loads no fonts, scripts or content from third parties.
8. Your rights
Under UK GDPR you have the right to:
- access the personal data held about you and receive a copy;
- have inaccurate data corrected;
- have data deleted where there is no longer a reason to keep it;
- restrict or object to how it is used, including use based on legitimate interests;
- receive data you provided in a portable format;
- withdraw consent at any time, for example to the use of your photographs in the portfolio – this does not affect use made before withdrawal.
To use any of these rights, email [email protected]. There is no charge, and you will receive a reply within one month.
9. Complaints to the ICO
If you are unhappy with how your data is handled, please contact me first so that I can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Children
This website is not intended for children under 13, and the booking form should be sent by an adult. Sessions involving children are booked by a parent or guardian.
11. Changes to this notice
This notice may be updated when the services or the law change. The date at the top shows the latest version. Significant changes affecting existing clients will be communicated by email.