Privacy Policy

Last updated: 27 September 2026

About this policy

This privacy policy explains how I collect, use and protect personal information when you visit my website, contact me, make a booking or use my photography services.

I am Mark Merry, trading as Mark John Photography, and I am the data controller responsible for your personal information.

If you have any questions about how I use your information, you can contact me at:

Email: enquiries@markjohnphotography.co.uk

I handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information I collect

Depending on how you interact with me, I may collect:

Enquiries and bookings

  • Your name
  • Email address
  • Telephone number, if you provide it
  • Preferred date and time
  • Type of photography session
  • Stage name or alias, where relevant
  • Promo or discount codes
  • Messages and other information you provide when making an enquiry or booking
  • Information needed to arrange and carry out your session

Photographs

Photographs taken during a session are personal data where an individual can be identified from them.

I use photographs to provide the photography service you have booked, including editing, storing and delivering your photographs.

I may also use selected photographs for my portfolio, website or social media where I have appropriate permission or another lawful basis to do so.

I do not use facial recognition or similar biometric identification technology.

Prize wheel and giveaways

If you play my online prize wheel, I collect:

  • A one-way code created from your IP address, used only to keep the giveaway fair by limiting the number of spins per visitor
  • The result of your spin, the date and time, and a prize reference code
  • Your email address, if you choose to submit it to claim a prize

I do not store your IP address itself, and I do not store your name, location or any other details from playing. The code created from your IP address is not stored alongside your email address, and the email address you use to claim a prize is sent to me by email rather than being added to the giveaway records.

Playing is optional and no personal information is needed to spin the wheel. You only provide an email address if you win and decide to claim.

Website information

When you visit my website, some technical information may be collected automatically, such as your IP address, browser type, operating system, device information and information contained in server logs.

I use this information where necessary to operate, secure and maintain the website.

I do not use website analytics services, and I do not track visitors across other websites.

Where I get your information from

Most of the personal information I use is provided directly by you, for example when you:

  • Contact me through my website or by email
  • Make an enquiry or booking
  • Provide information during a photography session
  • Contact me through social media
  • Provide information through a consent or booking form

Some technical information is collected automatically when you use my website.

How I use your information

I may use your personal information to:

  • Respond to enquiries
  • Arrange and manage bookings
  • Check dates and availability
  • Provide photography services
  • Communicate with you about your booking or session
  • Edit, store and deliver photographs
  • Keep appropriate business and financial records
  • Deal with questions, complaints or disputes
  • Protect the security of my website and services
  • Meet legal, tax and accounting requirements
  • Send photography-related marketing where I am legally allowed to do so

I do not sell or rent your personal information to other organisations.

Why I am allowed to use your information

Depending on what I am doing, I rely on one or more of the following lawful bases:

  • Contract or steps before entering into a contract – where I need your information to respond to an enquiry, arrange a booking or provide the photography service you have requested.
  • Legitimate interests – where using information is necessary for reasonable business purposes, such as managing my business, maintaining records, protecting my website and dealing with enquiries or disputes, provided those interests do not override your rights.
  • Legal obligation – where I am required by law to keep or provide certain information, such as financial and tax records.
  • Consent – where I ask for your permission for a particular use of your information, such as agreed promotional use of photographs.

Where I rely on consent, you can withdraw that consent at any time. This will not affect processing that was lawful before you withdrew your consent.

Providing information

You can browse my website without providing personal information.

If you want to make an enquiry or booking, I need certain information to respond to you and, where applicable, arrange and provide the photography service.

If you do not provide information that is necessary for a booking or session, I may not be able to arrange or carry out the service.

Where information is required by law, I may also need to collect and retain it for the required period.

Who I share your information with

I do not sell your personal information.

I use a small number of trusted service providers to operate my business and website. These may process personal information on my behalf.

Krystal Hosting

My website hosting and business email services are provided by Krystal Hosting Ltd.

They may process information needed to host my website, operate email and maintain the security and reliability of these services.

Google

I use Google services including Google Workspace, Google Sheets and Google Apps Script.

For example, information submitted through my website contact or booking forms may be stored or processed using Google services.

Microsoft OneDrive

I use Microsoft OneDrive to store edited photographs and other files relating to photography sessions.

Photographs may contain identifiable people and are therefore treated as personal information where applicable.

OneDrive may also be used to manage and deliver photographs to clients.

Cloudflare

I use Cloudflare Turnstile on my contact forms to help prevent spam and automated submissions.

Cloudflare may process technical information such as IP address, browser and device information for this purpose.

ipify

My prize wheel uses ipify, a third-party service operated by Reflection Software Solutions, to detect the IP address of the device you are using.

This happens in your browser when the prize wheel page loads, which means your IP address is visible to ipify. It is used only so I can create the one-way code that limits spins per visitor, and ipify does not receive any other information about you from me.

Legal or regulatory requirements

I may disclose personal information where I am legally required to do so, for example to comply with a court order, legal obligation or request from a competent authority.

Information processed outside the UK

Some of the service providers I use may process personal information outside the UK.

Where UK data protection law requires safeguards for an international transfer, I use a lawful transfer mechanism, such as an adequacy regulation or appropriate contractual safeguards.

If you want more information about the safeguards applying to a particular transfer, you can contact me using the details above. Where required, I can provide further information about the relevant safeguards.

How long I keep your information

I only keep personal information for as long as I reasonably need it for the purpose for which it was collected, unless I am required to keep it for longer.

For example:

  • Enquiries: If an enquiry does not result in a booking, I would normally keep the information for up to 12 months before deleting it, unless there is a legitimate reason to keep it longer.
  • Bookings and business records: I may keep information relating to bookings and financial transactions for longer where necessary for business, accounting, tax or legal purposes. HMRC requires relevant self-employed business records to be kept for at least five years after the relevant 31 January tax return deadline.
  • Photographs: I may retain photographs for as long as reasonably necessary to provide the service, allow re-delivery, maintain business records or deal with potential disputes or legal requirements.
  • Portfolio and promotional photographs: Where I have permission or another lawful basis to use photographs for portfolio or promotional purposes, I may retain them for that purpose unless that permission is withdrawn or there is another reason I should no longer use them.
  • Prize wheel records: Giveaway records, including the one-way code created from your IP address, are deleted automatically after three months. This matches how long a prize remains valid, after which the records are no longer needed. If you claim a prize, the email you send or receive about that claim is kept with my other enquiry or booking records as described above.

Cookies

My website does not use advertising or analytics cookies, and I do not track visitors across other websites.

Cookies or similar technologies may be used where they are strictly necessary for the website to function, operate securely or remember essential settings. This includes the anti-spam check used on my contact form.

Strictly necessary technologies of this kind do not require your consent, but you can still control cookies through your browser settings.

If I introduce any non-essential cookies or similar technologies in future, I will update this policy and ask for your consent before using them.

Marketing

I may occasionally send marketing about my photography services.

Where consent is required, I will only send electronic marketing where I have obtained the appropriate consent.

In some circumstances, I may rely on the legal exception known as the soft opt-in. This can apply where you have bought a service from me, or actively negotiated with me about buying a service, and I am contacting you about my own similar photography services.

Where I rely on the soft opt-in, I will provide an opportunity to opt out when collecting your details and in every subsequent marketing message.

You can opt out of marketing at any time. Every marketing message will provide a simple way to do this.

Service-related messages, such as information about an existing booking, are not marketing and may still be sent when necessary.

Children and young people

My photography services may be booked for people aged 14–17.

If someone under 18 attends a photography session, I require appropriate permission from a parent or legal guardian before photographing them.

If someone under 18 attends as part of a group that includes someone aged 18 or over, I ask a parent or legal guardian to complete and sign a parental consent form before the session.

I use information provided through these forms to confirm that the appropriate permission has been given and to keep a record of it.

Information about a young person, including their name and photographs, will only be collected and used where necessary to provide the photography service or for another purpose explained to them and their parent or legal guardian.

If you are a parent or legal guardian and have questions about how information relating to a young person is handled, you can contact me at enquiries@markjohnphotography.co.uk.

Your rights

Under UK data protection law, you may have the right to:

  • Ask for a copy of the personal information I hold about you
  • Ask me to correct inaccurate or incomplete information
  • Ask me to delete your personal information in certain circumstances
  • Ask me to restrict how I use your information in certain circumstances
  • Object to certain uses of your information
  • Request your information in a portable format where the right applies
  • Withdraw consent where I am relying on consent
  • Object to direct marketing at any time

These rights are subject to certain exceptions and conditions under data protection law.

If you want to exercise a right, contact me at enquiries@markjohnphotography.co.uk.

I will normally respond within one month. I may need to ask for information to confirm your identity before dealing with a request.

Keeping your information secure

I take reasonable steps to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

This includes using secure connections, access controls, account security measures and appropriate security features provided by the services I use.

No online service can be guaranteed to be completely secure, but I take reasonable steps to protect the information I hold.

Third-party websites

My website may contain links to third-party websites or social media platforms.

If you follow one of these links, that organisation will have its own privacy policy and terms. I am not responsible for how those third parties use your information.

Automated decision-making

I do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you.

Complaints

If you have a concern about how I have handled your personal information, please contact me first so I have an opportunity to resolve it.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Changes to this policy

I may update this privacy policy from time to time if my business, website, services or the way I process personal information changes.

The latest version will always be made available on my website and will show the date it was last updated.

Contact