Privacy Policy

Effective Date: 12 August 2026

Business Name: Lumens & Grace Photography

Owner: Adrian Chiu

1. Introduction

Lumens & Grace Photography values your privacy and is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). We are the data controller for the personal data described in this policy.

2. Information Collected

We may collect:

Enquiry and website data. Your name, email address and any details you include when you use our contact form, book a call, or sign up to our newsletter.

Client booking data. Where you book a shoot or wedding with us: your name, email address, telephone number, billing address, venue addresses, the schedule for the day, the names of members of your wedding party or family for group photographs, and any specific requests you give us, such as accessibility needs or family sensitivities.

Payment data. Invoice records and payment references. We do not store your full card details; card payments are handled by our payment provider.

Photographs. Images and video we capture at your shoot or wedding, including images of you, your family and your guests. Photographs of identifiable people are personal data.

Technical data. Browser type, device and IP address collected via cookies and analytics tools on this website.

3. Legal Basis for Processing Data

We only process your data where one of the following applies:

Contract. To provide the photography services you have booked, to answer pre-booking enquiries, and to issue invoices and galleries.

Legal obligation. To keep accounting and tax records, which we must retain for six years.

Legitimate interests. To run and improve our website, to keep a record of our past work, and to display selected images from your session in our portfolio, on our website and on our social media channels, as set out in your contract. We have considered your rights in doing so, and you can object at any time using the contact details below.

Consent. Where you have opted in to our newsletter, and for any non-essential cookies.

4. How Information Is Used

Your data may be used to:

  • Deliver the photography services you have booked, including planning your day and delivering your online gallery

  • Respond to enquiries and service requests

  • Issue invoices and keep accounting records

  • Display selected images in our portfolio, on our website, on social media and in advertising, as permitted by your contract

  • Send newsletters or blog updates, if you have opted in

  • Improve our website content and user experience

5. Photographs of You and Your Guests

Photographs are the heart of what we do, and we treat them with care.

Your images are stored securely on our own devices and on the Pixieset platform. Access to your gallery is controlled by you, and you decide who you share the link with.

Where your contract permits, we may use selected images from your session in our portfolio, on our website, on social media and in advertising. You can ask us at any time not to use particular images for promotional purposes, and we will comply as soon as reasonably practicable, although we cannot recall images that have already been printed or published elsewhere.

Guests at your wedding or event. We photograph guests on the basis of our legitimate interest in documenting the day we have been asked to cover. If a guest would prefer not to be photographed, or would like an image of them removed from our promotional use, they can contact us directly using the details below and we will deal with the request promptly. Please let us know before the day if there is anyone we should be especially careful with.

Children. Where children are photographed, we rely on the consent of a parent or guardian, given through the person booking us. We will not use images of children in our marketing where a parent or guardian has asked us not to.

6. Cookies

We use cookies to enhance site functionality and collect anonymous analytics. Under PECR, we must obtain your consent before setting non-essential cookies. You can accept or reject cookies using our cookie banner, and adjust cookie settings through your browser at any time.

7. Sharing of Information

We never sell or trade your personal information, and we do not supply your photographs to third parties for their own marketing.

We use the following trusted providers, who process data on our behalf under their own UK GDPR-compliant terms:

  • Pixieset — online galleries, contracts, invoices and client management

  • Squarespace — website hosting and contact forms

  • Google — Google Business Profile and website analytics

  • Our email provider — correspondence with you

  • Print labs and album suppliers — only where you order prints or an album, and only the images and delivery details needed to fulfil your order

  • A replacement photographer — only where we are unable to attend your wedding and you have agreed to this under your contract

Some of these providers store data outside the UK. Where that happens, we rely on the transfer safeguards those providers have in place, such as the UK International Data Transfer Addendum.

We may also disclose data where we are required to do so by law.

8. Your Rights Under UK GDPR

You have the right to:

  • Access the data we hold about you

  • Have inaccurate data corrected

  • Ask us to delete your personal data

  • Restrict or object to processing, including objecting to our use of your images for promotion

  • Receive a copy of the data you gave us in a portable format

  • Withdraw consent at any time, where we rely on consent

  • Complain to the Information Commissioner's Office (ICO) at https://ico.org.uk

To exercise any of these rights, contact us using the details in section 11. We will respond within one month.

9. Data Retention

  • Enquiries that do not lead to a booking: up to 12 months

  • Booking records, contracts and correspondence: for the duration of the contract and for 6 years afterwards, to meet our legal and accounting obligations

  • Your online gallery: live for a minimum of 12 months from delivery — please download and back up your images within that period

  • Image files after the gallery closes: we make reasonable efforts to keep a copy for a further 12 months, but we cannot guarantee archiving beyond the gallery period

  • Images used in our portfolio or marketing: retained while in use, unless you ask us to stop using them

  • Newsletter subscribers: until you unsubscribe

10. Data Security

We implement industry-standard measures to protect your data, including password-protected devices, encrypted storage and reputable platforms for galleries and client records. However, no method of online transmission is 100% secure.

11. Contact

If you have any questions, or would like to exercise your data rights, please contact:

Adrian Chiu — Lumens & Grace Photography

Email: adrian.chiu@lumensandgracephotography.co.uk

Serving Edinburgh, West Lothian and central Scotland

If you are not satisfied with our response, you can complain to the Information Commissioner's Office at https://ico.org.uk or on 0303 123 1113.

12. Changes to This Policy

This policy may be updated as needed. The latest version will always be posted here with the updated date.