Privacy Policy

Last updated: 16 May 2026

This Privacy Policy explains how Soo Burnell collects, uses, stores and protects personal information when people visit soo-burnell.com, contact the business, join a mailing list, book services, or purchase products through the website.

This policy is intended for a UK-based photography business using Squarespace and related online tools, and is written to reflect the information rights and transparency expectations set out by the UK GDPR and ICO guidance.

Who controls the data

The data controller for personal information collected through this website and in the course of providing services is:

As the data controller, Soo Burnell is responsible for deciding how personal data is collected and used.

Personal data collected

The website and business may collect the following categories of personal data:

  • Contact details, such as name, email address, telephone number and postal address.

  • Enquiry information, including details submitted through contact forms, email messages, service requests and correspondence.

  • Order and booking information, including items purchased, booking details, delivery details, invoices and related customer service records.

  • Payment-related information needed to process purchases, although full card details are usually handled by third-party payment processors rather than stored directly on the website.

  • Technical information, such as IP address, browser type, device information, cookie identifiers and website usage data collected through Squarespace and analytics tools.

  • Marketing preferences, including whether a visitor has subscribed to receive newsletters or promotional messages.

  • Photographic image data where services involve creating or delivering images of clients or their families.

How data is collected

Personal data may be collected in several ways:

  • Directly from the person, for example when submitting a form, sending an email, making a booking, signing up to a mailing list, or purchasing artwork or services.

  • Automatically through the website by means of cookies, server logs and analytics technologies.

  • From third-party services used to operate the website or business, such as scheduling, payment, email marketing, gallery delivery or ecommerce tools, where those services are connected to the website.

Why data is used

Personal information may be used for the following purposes:

  • To respond to enquiries and provide information about services or products.

  • To process bookings, orders, payments, fulfilment, delivery and customer support.

  • To maintain internal records, accounting records and compliance documentation.

  • To improve the website, monitor usage, troubleshoot issues and understand visitor behaviour through analytics.

  • To send marketing emails or updates where consent has been given, or where this is otherwise permitted by law.

  • To protect the website, business operations and personal data against misuse, fraud or security threats.

Legal bases for processing

Under UK data protection law, personal data is processed only where there is a lawful basis for doing so.

The lawful bases most likely to apply are:

  • Contract: where processing is necessary to take steps before entering into a contract, or to provide photography services, artwork, orders or related support.

  • Legal obligation: where records must be kept for tax, accounting or regulatory reasons.

  • Legitimate interests: where processing is reasonably necessary to run and improve the business, manage customer relationships, secure the website and prevent misuse, provided those interests are not overridden by the individual's rights.

  • Consent: where a person has chosen to join a mailing list or agreed to receive certain marketing communications, or where specific image use consent is requested.

Cookies and analytics

The website may use cookies and similar technologies to keep the site functioning, remember preferences, understand usage patterns and improve performance.

Squarespace provides platform-level cookie and privacy information, and visitors can usually manage non-essential cookies through cookie banner settings or browser controls.

If analytics tools are enabled, they may collect information such as IP address, device type, referral source and pages visited in order to generate aggregate reports about site performance and visitor behaviour.

Sharing personal data

Personal data is not sold to third parties.

Data may be shared where necessary with trusted service providers that support the operation of the website and business, which may include:

  • Squarespace, as website platform provider.

  • Scheduling or booking tools linked to the site.

  • Payment processors used to handle secure transactions.

  • Email marketing providers used for newsletters or customer communications.

  • Gallery delivery, cloud storage, print fulfilment or ecommerce partners where relevant to the service being provided.

Information may also be disclosed where required by law, regulation, legal process or to protect legal rights.

International transfers

Some service providers used by online businesses may store or process personal data outside the UK.

Where this happens, appropriate safeguards should be used, such as recognised transfer mechanisms and contractual protections that meet UK data protection requirements.

Data retention

Personal data is kept only for as long as necessary for the purposes for which it was collected, including providing services, handling enquiries, maintaining business records and meeting legal obligations.

Where data is no longer needed, it should be deleted, securely destroyed or anonymised so that individuals can no longer be identified.

Security

Appropriate technical and organisational measures are used to protect personal data against unauthorised access, loss, misuse or disclosure.

This may include secure hosted systems, password protection, controlled access, encryption provided by service providers and good administrative practices for paper and digital records.

No website or transmission method can be guaranteed completely secure, but reasonable steps are taken to reduce risk and protect information.

Children’s data

The website is not intended to be used independently by young children, and extra care should be taken where personal data or images relate to children.

Where photography services involve children, any necessary permissions should be provided by a parent or guardian, particularly in relation to image use and publication.

Individual rights

Under UK data protection law, individuals may have the right to:

  • Request access to the personal data held about them.

  • Ask for inaccurate personal data to be corrected.

  • Request deletion of personal data in certain circumstances.

  • Object to processing based on legitimate interests in certain circumstances.

  • Ask for processing to be restricted in certain cases.

  • Withdraw consent where processing relies on consent.

  • Request transfer of certain personal data to another organisation where applicable.

Requests relating to personal data can be sent to hello@soo-burnell.com

Complaints

Concerns about how personal data is handled should first be raised by email at hello@soo-burnell.com

Individuals also have the right to complain to the Information Commissioner’s Office (ICO), which provides guidance and complaint routes for UK data protection matters

Changes to this policy

This policy may be updated from time to time to reflect changes to the website, legal obligations or business practices.

The latest version should always appear on this page with the revised effective date shown at the top.