Privacy Policy — Si Rutter Photography

Last updated: 30 September 2026

1. Who I am

I am Simon Rutter, a sole trader trading as Si Rutter Photography, based in the United Kingdom.

For the purposes of UK data protection law, I am the controller of the personal information described in this policy. This means I decide how and why that information is used.

This policy covers www.sirutterphotography.com, enquiries, photography bookings, image delivery and the publication of photographs.

For privacy questions, requests or complaints, contact:

Email: simonrutter18photography@gmail.com
Postal address: 22 Bay Avenue, Bilston, WV14 0TT, United Kingdom

2. Information I collect

Depending on how you interact with me, I may collect:

  • Contact information, such as your name, email address and telephone number.

  • Enquiry and correspondence information.

  • Booking information, such as event dates, locations, photography requirements and relevant client or guest information.

  • Photographs of identifiable people and associated information, such as the date and location of a photography session or event.

  • Order, billing and transaction records where you purchase services from me.

  • Technical information generated when you use my website, such as your IP address, browser, device, pages accessed, referring website and approximate location, depending on the website services and settings in use.

  • Records of permissions, privacy preferences and privacy requests.

Information may come directly from you, from photographs I take, through your use of my website or, where relevant, from a client or event organiser arranging photography involving you.

Please only provide personal information that is necessary for your enquiry or booking.

3. Why I use personal information and my lawful bases

I use personal information for the following purposes:

PurposeLawful basisResponding to requests for quotations and arranging bookingsTaking steps at your request before entering into a contractProviding booked photography services, editing and delivering photographsPerformance of a contractResponding to general enquiriesLegitimate interests in communicating with people interested in my servicesPhotographing guests and other participants who are not parties to the booking contractLegitimate interests in documenting the event and providing the commissioned photography, taking account of their rights, expectations and circumstancesMaintaining website security and dealing with misuseLegitimate interests in protecting my website, business and usersUnderstanding how my website is used through Squarespace Analytics and the Squarespace Activity LogLegitimate interests in understanding website use, maintaining and improving the website, and identifying technical or security issues, balanced against the privacy rights of visitorsKeeping records required for tax, accounting or other legal purposesCompliance with legal obligationsHandling disputes and establishing, exercising or defending legal claimsLegitimate interests in protecting my legal rightsUsing identifiable client photographs for promotional purposesConsent

Where I rely on legitimate interests, I consider the purpose of the processing, whether the processing is necessary and whether the individual's interests, rights or freedoms override my interests.

If personal information is needed to arrange or fulfil a booking, I may be unable to provide the requested service without it.

Permission for promotional photography is optional and is not a condition of booking.

4. Photographs and galleries

Photographs may identify an individual even where their name is not attached.

I use commissioned photographs to edit and deliver the work agreed with my client. This may include photographs of guests and other people attending an event.

Client galleries are hosted using Squarespace and are password-protected. Access requires the relevant gallery password. My galleries do not provide a download facility.

Client galleries remain available for two years from their publication date.

At the end of that period, I switch off gallery access and delete the photograph files stored within Squarespace. I do not continue using those client photographs in a separate portfolio on my website.

I retain internal copies of client photographs, including relevant RAW files and backups, for a further six years after the two-year gallery period ends. They are therefore deleted no later than eight years after the relevant gallery was first published, unless there is a specific legal or dispute-related reason requiring longer retention.

This archive allows me to respond to reasonable requests relating to previously delivered photographs and maintain appropriate records connected with the photography service.

Promotional use of photographs

I request permission for promotional use of identifiable client photographs through a separate, optional choice within the photography contract.

Promotional permission is limited to the uses specified when permission is requested, including use on my website and social media where applicable.

Declining promotional permission does not affect the photography service you receive.

You may withdraw your consent for future promotional use by contacting me.

Withdrawal of consent does not affect processing that took place lawfully before consent was withdrawn. Where appropriate, I will stop future consent-based use and remove material under my control.

I cannot guarantee deletion of copies that have independently been copied, downloaded or shared by other people.

Guests and children

Agreement by the booking client does not automatically provide permission for promotional use of identifiable photographs of other adult guests.

Where I wish to use an identifiable photograph of an adult guest for promotional purposes and consent is the appropriate lawful basis, I will obtain appropriate permission from that individual before publication.

I take particular care with photographs identifying children.

Where consent is relied upon for promotional publication of an identifiable child, I will consider the child's circumstances, age and understanding and, where appropriate, obtain permission from a person with parental responsibility before publication.

If you have a concern about a photograph of yourself or a child for whom you have parental responsibility, please contact me with the relevant page, post or photograph reference so I can review it.

Social media photographs

Photographs already published on social media with appropriate permission are treated separately from client galleries and internal backups.

Photographs used for promotional purposes on social media are reviewed periodically and may be removed when they are no longer required for the promotional purpose for which permission was obtained, or earlier where consent is withdrawn and removal is appropriate.

5. Who receives personal information

I only share personal information where this is necessary for the purposes described in this policy.

Recipients may include:

  • Squarespace, which provides my website, contact forms and client galleries.

  • Google, which provides the Gmail service I use for enquiries and correspondence.

  • Adobe, whose Lightroom Classic software I use as part of my photography editing workflow.

  • Clients and authorised gallery viewers receiving photographs.

  • Meta, including Instagram and Facebook, where photographs are published for promotional purposes with appropriate permission.

  • TikTok, where photographs or other content are published for promotional purposes with appropriate permission.

  • Professional advisers, insurers, authorities, regulators or courts where necessary for advice, compliance with legal obligations or legal claims.

Photograph backups are stored on my own home storage.

I do not currently use payment processors, print laboratories or delivery services in connection with the photography services covered by this policy.

Where service providers process personal information on my behalf, appropriate contractual requirements and safeguards are used where required.

Some service providers may also act as independent controllers for their own purposes. Their own privacy policies explain those uses.

6. Information processed outside the UK

Some of the organisations I use to provide my services operate internationally.

This means personal information may sometimes be processed outside the United Kingdom, including in the United States and other countries in which those organisations or their service providers operate.

This may apply to services provided by Squarespace, Google, Adobe, Meta and TikTok.

Where personal information is transferred internationally and UK data protection law requires safeguards, the relevant provider may use recognised transfer mechanisms such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, contractual safeguards or other approved transfer mechanisms, as applicable.

Further information about the safeguards applying to personal information handled by a particular provider can be obtained from that provider's privacy information or by contacting me using the details in this policy.

7. How long I keep information

I keep personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, contractual and dispute-related requirements.

My retention periods and criteria include:

InformationRetention period or criteriaEnquiries that do not result in a bookingKept only for as long as reasonably necessary to deal with the enquiry and any related follow-upBooking records, contracts and correspondenceKept for as long as reasonably necessary for the photography service and for applicable legal, accounting or dispute-related requirementsInvoices and tax/accounting recordsKept for the period required by applicable UK tax and accounting requirementsUnselected and RAW photographsRetained as part of my internal client photography archive and deleted no later than eight years after the relevant client gallery was first published, unless there is a specific legal or dispute-related reason requiring longer retentionClient galleries on my websiteTwo years from gallery publication, after which gallery access is switched off and the photograph files are deleted from SquarespaceInternal client photographs and backupsSix additional years after the two-year gallery period, meaning deletion no later than eight years from gallery publication unless there is a specific reason requiring longer retentionSeparate website portfolio copiesI do not continue keeping a separate client portfolio copy after the two-year gallery periodSocial-media promotional photographsReviewed periodically and removed where they are no longer required for the promotional purpose or where consent is withdrawn and removal is appropriateRecords of promotional permission or consentKept for as long as reasonably necessary to demonstrate and manage the permission relied upon, including while the relevant photograph continues to be usedSquarespace Activity LogSquarespace currently displays individual visits for the preceding seven days. This does not necessarily mean that all information processed or retained by Squarespace is deleted after seven daysOther website analytics informationKept according to the applicable Squarespace settings and retention arrangements

When personal information is no longer required, I delete or anonymise it where appropriate.

8. Cookies, analytics and similar technologies

My website is hosted by Squarespace.

I use Squarespace Analytics to understand information such as visits, unique visitors, page views and website usage. This helps me understand how my website is being used and how it may be improved.

Google Analytics is not connected to my website.

The Squarespace Activity Log is enabled. Depending on the information made available by Squarespace, this may show details including individual page visits, IP addresses, approximate locations, referring pages, browsers, operating systems and visit dates and times.

My website displays a cookie banner that provides the options:

  • Accept all

  • Decline all

  • Manage cookies

Squarespace's Non-essential Cookies setting is set to Restricted.

This means cookies controlled by that Squarespace setting are restricted unless the visitor makes the relevant choice.

Where a technology requires consent under applicable UK rules, it will only be used after the required consent has been obtained.

Some website technologies may operate without consent where they are strictly necessary for a service requested by the visitor or where another applicable legal exception applies.

UK rules provide a limited exception for certain technologies used solely to collect statistical information about how a website is used for the purpose of improving it. Where I rely on such an exception, I will only do so where its requirements are met, including providing clear information and an appropriate, simple and free way to object where required.

Visitors can manage or change their cookie preferences using the Cookie Preferences control displayed in the subfooter at the bottom of my website.

Browser settings may also allow cookies to be managed, although blocking certain necessary technologies may affect website functionality.

I do not currently use Google Analytics or knowingly operate advertising tracking technologies such as Meta Pixel, TikTok Pixel or Google Ads conversion tracking on my website.

If I introduce additional advertising, analytics or tracking technologies in the future, I will review the applicable consent and privacy requirements and update this policy where necessary.

9. Marketing

I do not currently send email newsletters or promotional marketing emails.

Emails relating to enquiries, quotations, bookings, delivery of photography services, galleries or customer service are service communications rather than promotional marketing.

10. Security

I use appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or misuse.

My devices and relevant accounts are password-protected, and I use two-factor authentication where available.

Client galleries are password-protected, and access to client photographs and backups is restricted.

I also use appropriate device security, software updates and controlled access to my home storage and business accounts.

Access to personal information is limited to me and to service providers that require access for the purposes described in this policy.

11. Your rights

Depending on the circumstances and the lawful basis being used, you may have rights under UK data protection law including the right to:

  • Request access to personal information held about you.

  • Request correction of inaccurate or incomplete information.

  • Request deletion of your information in certain circumstances.

  • Request restriction of processing in certain circumstances.

  • Object to certain processing.

  • Receive certain information you supplied in a portable format where applicable.

  • Withdraw consent where processing relies upon consent.

These rights are subject to the conditions and exceptions contained in applicable data protection law.

Your right to object

You may object to processing based on legitimate interests on grounds relating to your particular circumstances.

You have an absolute right to object to the use of your personal information for direct marketing.

Where I rely on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

To exercise your rights, contact:

simonrutter18photography@gmail.com

I may request information reasonably necessary to verify your identity before responding to a request.

I will respond within the period required by applicable data protection law, normally within one month, and will explain if a permitted extension is required.

I do not use solely automated processing to make decisions about individuals that have legal or similarly significant effects.

12. Complaints

Please contact me first if you are unhappy with the way I have handled your personal information so that I have the opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Information about making a complaint is available at:

https://ico.org.uk/make-a-complaint/

13. Changes to this policy

I review this Privacy Policy when my services, website or handling of personal information changes.

The date displayed at the top of this policy identifies the latest version.

Where required, I will bring significant changes to people's attention.

Updating this Privacy Policy does not replace consent where consent is required for a new use of personal information.