PLEASE READ THIS PRIVACY NOTICE CAREFULLY

We are Victoria Amrose Photography & Films. We are a business based in England and Wales. Our registered address is Victoria Amrose Photography, Smithy House, Shrewsbury, SY4 2HA. In this privacy notice, we refer to ourselves as “we”, “us” or “our”.

We are the Data Controller for the personal information described in this notice.

You can contact us in the following ways:
• Telephone: +44 (0)7730 876440
• Email: victoria@victoriaamrose.com
• Post: Victoria Amrose Photography & Films, Smithy House, Shrewsbury, SY4 2HA.

We take the privacy and security of your personal information seriously. This privacy notice explains how and why we collect, use, store, and share personal information, and sets out your rights under UK data protection law.

This privacy notice was last updated on 19 January 2026.


1. Who is responsible for data protection?
We do not have a formal Data Protection Officer. Responsibility for data protection matters sits with the business owner, Victoria Amrose.
If you have any questions about this privacy notice or how your personal information is handled, you can contact us using the details above.


2. Key definitions
Personal information (or personal data): Any information that can identify a living individual, either directly or indirectly.
Special category data: Certain types of particularly sensitive personal information, such as information about health, ethnicity, religious beliefs, political opinions, trade union membership, genetic data, biometric data, sex life, or sexual orientation. We do not collect special category data.
Data Controller: The person or organisation that decides how and why personal information is processed.
Data Processor: A third party that processes personal information on behalf of the Data Controller, following their instructions.


3. Personal information we collect
Depending on your relationship with us, we may collect and hold the following categories of personal information:
Identity information
Name and title.
Contact information
Email address, telephone number, and postal address.
Enquiry and client information
Details provided when you make an enquiry, book our services or communicate with us.
Payment and transaction information
Records of payments made and invoices issued. We do not store full card details. Payments are processed securely by third-party providers such as Stripe and PayPal.
Marketing information
Your communication preferences and records of consent or opt‑out.
Website, device, and technical information
Information about how you use our website, including IP address, browser type, operating system, time zone, and usage data collected via cookies and similar technologies (subject to your consent).


4. How we collect personal information
We collect personal information in the following ways:
• Directly from you when you make an enquiry, book our services, complete a form, subscribe to our mailing list, or contact us by email, phon,e or post
• Automatically, when you use our website, through cookies and similar technologies (subject to your consent)
• Through third-party platforms used to deliver our services, such as our CRM, invoicing system, or online galleries
We do not sell or trade your personal information.


5. How and why we use your personal information
Under UK data protection law, we must have a lawful reason for using your personal information. We rely on the following legal bases:
• Contract – where processing is necessary to provide our services or fulfil a contract with you
• Legal obligation – where we are required to comply with the law (for example, accounting or tax obligations)
• Legitimate interests – where processing is necessary for our business and does not override your rights
• Consent – where you have given clear permission for a specific purpose

We use personal information for the following purposes:
• To respond to enquiries and manage bookings
Legal basis: Contract or legitimate interests
• To deliver photography and related services
Legal basis: Contract
• To issue invoices and process payments
Legal basis: Contract and legal obligation
• To manage our client relationships and communications
Legal basis: Contract and legitimate interests
• To maintain business records for legal, tax, and accounting purposes
Legal basis: Legal obligation
• To improve our services and website
Legal basis: Legitimate interests
• To send marketing communications (where permitted)
Legal basis: Consent or legitimate interests, depending on the circumstances
• To operate and secure our website
Legal basis: Legitimate interests
• To understand how visitors use our website via analytics
Legal basis: Consent (via cookies)

Where consent is used as the legal basis, you have the right to withdraw it at any time.


6. Marketing communications
We may send you marketing communications about our services where:
• You have opted in to receive them; or
• We are permitted to do so under applicable marketing laws
We use ActiveCampaign as our email marketing platform. You can unsubscribe or change your preferences at any time using the link in our emails or by contacting us directly.
We do not share your personal information with third parties for their own marketing purposes.

7. Cookies and analytics
Our website uses cookies and similar technologies. Some cookies are essential for the website to function, while others are used for analytics and marketing.
We use Google Analytics to understand how visitors use our website, and Meta (Facebook) Pixel for marketing purposes. These cookies are only set where you have provided consent via our cookie banner.
Full details are available in our Cookie Policy.


8. Third-party service providers
We use trusted third-party providers to help run our business, including:
• Website platform and hosting providers (Showit & Wordpress)
• CRM and invoicing system (Dubsado)
• Payment processors (Stripe and PayPal)
• Email marketing platform (ActiveCampaign)
• Online gallery and delivery platform (SmugMug)
These providers act as Data Processors and only process personal information on our instructions, subject to appropriate contractual and security safeguards.
Some providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place in line with UK GDPR requirements.


9. How long do we keep your personal information?
We only keep personal information for as long as necessary for the purposes it was collected.
Typical retention periods are:
• Client and contract records: up to 6 years (to meet legal and accounting obligations)
• Enquiry data (where no booking is made): up to 24 months
• Marketing data: until you unsubscribe or withdraw consent
• Website analytics data: up to 26 months


10. Your rights
Under UK data protection law, you have the right to:
• Request access to your personal information
• Request correction of inaccurate or incomplete information
• Request erasure of your personal information (in certain circumstances)
• Request restriction of processing (in certain circumstances)
• Request data portability
• Object to processing based on legitimate interests or for direct marketing
• Withdraw consent at any time where processing is based on consent
To exercise any of these rights, please contact us using the details at the top of this notice. We may need to verify your identity before responding.


11. Complaints
If you are unhappy with how we handle your personal information, please contact us first so we can try to resolve the issue.
You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk

12. Third-party websites
Our website may contain links to third-party websites. We are not responsible for their privacy practices, and we encourage you to review their privacy notices separately.


13. Changes to this privacy notice
We keep this privacy notice under regular review and may update it from time to time. Any updates will be posted on this page, with the revised date shown at the top.

view cookie
policy here