Privacy Policy

Last updated: 1 October 2026

Lucy Rose Studios respects your privacy and is committed to looking after your personal information. This policy explains what I collect, why I need it, how it may be shared and the choices you have.

It applies when you visit my website, make an enquiry, book a photography session, purchase a product, join my mailing list or otherwise communicate with Lucy Rose Studios.

Who is responsible for your information?

Lucy Rose Studios is owned and operated by Lucy Okey, trading as Lucy Rose Studios. I am the data controller responsible for the personal information described in this policy.  
For privacy questions or to exercise your data-protection rights, please email lucy@lucyrosestudios.com.

What information do I collect?

The information I collect depends on how you interact with me.

When you enquire, book a session or place an order, I may collect your name, address, email address and telephone number. I may also keep booking information, questionnaire responses, session preferences, correspondence and notes that help me provide a personal service.

For people taking part in a photoshoot, I may record names, ages and relationships between family members. I also create and store photographs and, where agreed, video or behind-the-scenes footage.

Payment providers may process your payment information. I do not normally receive or retain your complete card details, although I may retain payment references and transaction records.

If you contact me through email, a website form, telephone or social media, I may retain the information contained within that conversation.

You may choose to tell me about health, accessibility, pregnancy, birth or feeding matters that could help me make your session safe and comfortable. I will only use this information for that purpose and will not ask for more than I reasonably need.

When you visit my website, information may be collected automatically through cookies and similar technologies. This can include your IP address, approximate location, browser and device information, pages viewed, the time spent on the website, the website or advert that referred you and identifiers connected with advertising or conversion measurement.

 Information about children

My work frequently involves babies and children. I may collect a child’s name, age and photographs where this is necessary to provide the photography service requested by their parent or guardian.

A parent or person with appropriate parental responsibility must make the booking and agree to the session terms on the child’s behalf.

Creating photographs for a family’s private gallery is separate from using those photographs publicly. I will not knowingly use an identifiable child’s photographs on my website, social media, advertising or portfolio unless the appropriate adult has agreed to that use through my image-release process.

Agreement to public use is optional and is not a condition of receiving the photography service.

Why I use your information

I use personal information for the following purposes and lawful bases.

Enquiries and bookings

I use your information to respond to enquiries, provide quotations, arrange sessions and take steps requested by you before entering into a contract.

Once you book, I use the information needed to deliver the photography service, communicate with you, prepare your gallery and fulfil product orders. The lawful basis for this is the performance of our contract.

Business administration

I may use information to manage appointments, provide customer service, maintain business records, handle complaints and protect or establish legal rights.

The lawful basis may be the performance of our contract or my legitimate interests in operating and protecting my business and providing an effective service.

Financial records

I retain invoices, transaction details and other records where required for accounting and tax purposes. The lawful basis is compliance with my legal obligations.

Health or accessibility information

Where you voluntarily provide health or similarly sensitive information so I can adapt your session, I use it only for that purpose. Where required, I rely on your explicit consent. You may withdraw that consent, although I may then be unable to make the requested adjustment safely.

Marketing emails

I send newsletters and promotional emails only where you have actively chosen to receive them or where another lawful direct-marketing rule permits the communication.

You can unsubscribe at any time by using the link in an email or contacting me. Withdrawing from marketing does not affect service emails relating to an existing enquiry, booking or order.

Public use of photographs

Where I use identifiable photographs or video in my portfolio, website, social media, competitions, printed marketing or advertising, I rely on the permission recorded through my image-release process.

The release will explain the intended uses. You may contact me if you later change your mind. Withdrawal will apply to future use where reasonably possible, but it may not be possible to recall printed materials or copies already shared by other people.

Google Analytics and Google Ads

I use Google Analytics 4 to understand how visitors find and use my website. This helps me assess which pages are useful, identify website problems and understand the general performance of my marketing.

I also use Google Ads conversion measurement to understand whether an advert leads to an action such as an enquiry. Google Analytics may be linked with my Google Ads account for measurement and reporting.

These services may use cookies or similar identifiers to collect information about your visit, device, browser, interactions and the advert or referring link that brought you to the website. This may include Google advertising click identifiers.

I do not currently use Google Analytics or Google Ads to remarket personalised adverts to previous website visitors. If I introduce remarketing or another form of personalised advertising, I will update this policy and my cookie choices before doing so.

Analytics and advertising cookies will only be used where the required permission has been provided through the website’s cookie controls. You can reject these cookies without affecting your ability to browse the website or make an enquiry.

Information about how Google uses information from websites that use its services is available at:

**https://policies.google.com/
technologies/partner-sites**

Google’s privacy policy is available at:

**https://policies.google.com/
privacy**

You can also manage advertising preferences through Google’s advertising settings:

**https://myadcenter.google.
com/**

Cookies

Cookies are small files or similar technologies placed on or accessed from your device.

My website may use the following categories.

Essential cookies

These cookies support functions required for the website to operate, remain secure or remember your privacy choices. They do not require consent where they are strictly necessary.

Analytics cookies

These help me understand how visitors use the website. I use Google Analytics for this purpose. Analytics cookies are controlled through the website’s cookie-consent system.

Advertising and conversion cookies

These help measure whether my Google advertising leads to website visits and enquiries. They may store or access advertising identifiers and information about the advert you followed.

I do not place non-essential analytics or advertising cookies merely because you continue to browse. You can accept or reject them through the cookie banner and change your choice later.

Rejecting non-essential cookies will not prevent you from using the main parts of the website.

A current list of individual cookies, their providers, purposes and durations should be available within the website’s cookie-preference panel.

Where I obtain information

I usually receive information directly from you.

I may also receive information from another person where, for example, they purchase a voucher for you, include you in a family booking or provide your details so that I can fulfil an agreed service.

Website and advertising information may be provided by analytics, advertising and website-service providers.

Who I share information with

I do not sell personal information.

Where necessary, information may be shared with carefully selected service providers that help me run Lucy Rose Studios. These may include:

- Website hosting, website-form and technical-support providers.
- Client-management, booking and workflow systems.
- Online gallery and image-delivery services.
- Secure cloud storage and backup providers.
- Email and newsletter platforms.
- Payment processors and bookkeeping services.
- Professional printing laboratories, album manufacturers and delivery companies.
- Google Analytics and Google Ads.
- Professional advisers, insurers, accountants or legal representatives.
- Government bodies, regulators or law-enforcement authorities where disclosure is legally required.

These providers receive only the information reasonably necessary to perform their services. Where they act on my behalf, I require them to handle information securely and only in accordance with my instructions and applicable data-protection law.

If an order is delivered directly from a professional laboratory, the laboratory or delivery provider may receive the recipient’s name, delivery address and relevant contact details.

International transfers

Some service providers, including Google and providers of website, gallery, email or cloud-storage services, may process information outside the United Kingdom.

Where personal information is transferred internationally, I take reasonable steps to ensure that an appropriate legal safeguard is used. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another safeguard permitted by UK data-protection law.

You may contact me if you would like further information about the safeguards relevant to a particular provider.

How long I keep information

I do not keep every type of information for the same period.

General enquiries that do not result in a booking will normally be kept for up to two years after the last meaningful contact, unless there is a reason to retain them for longer.

Booking records, contracts, important correspondence and customer-service records will normally be retained for up to six years after the service has been completed. This allows me to manage queries, establish or defend legal rights and maintain appropriate business records.

Financial and transaction records will be retained for at least the period required by tax and accounting law.

Marketing information will be retained until you unsubscribe or the information is no longer useful. I may keep a minimal suppression record so that I can honour an unsubscribe request.

Online galleries are made available for the period explained in your gallery-delivery communication. Clients are responsible for downloading and safely backing up their purchased photographs during that period.

RAW files and finished photographs may be retained as part of Lucy Rose Studios’ long-term photographic archive. This enables me to assist with replacement requests, preserve the integrity of delivered work and maintain an accurate record of my professional work.

Archived image files are stored securely and access is restricted. I review long-term image storage periodically and may delete files where they are no longer required, cannot be stored securely or have no continuing archival or business value. Long-term storage does not guarantee that a replacement copy will always remain available, so clients should maintain their own backups.

Google Analytics event data is currently retained for 14 MONTHS. Cookie durations are listed in the cookie-preference panel.

Information may remain within secure backups for a limited period after deletion until those backups are overwritten.

How I protect information

I use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

These measures may include password protection, access controls, reputable service providers, secure backups and limiting access to information to those who genuinely need it.

No internet or storage system can be guaranteed to be completely secure, but I regularly consider the safeguards appropriate to the nature of the information I hold.

Image editing and processing

To provide my photography services, I use professional editing, retouching and gallery software. This may include trusted third-party or cloud-based providers that process photographs on my behalf. I only provide them with the information needed to deliver the service and require personal data to be handled securely. If information is processed outside the UK, I take steps to ensure appropriate data-protection safeguards are in place. You can contact me if you would like further information about the providers I use.

Your rights

Depending on the circumstances and the lawful basis being used, you have the right to:

- Ask for a copy of the personal information I hold about you.
- Ask for inaccurate or incomplete information to be corrected.
- Ask for information to be deleted.
- Ask for the use of your information to be restricted.
- Object to particular uses of your information.
- Receive certain information in a portable format.
- Withdraw consent where processing is based on consent.
- Object to direct marketing at any time.

These rights are not absolute, and an exemption or continuing legal obligation may sometimes apply.

You have the right to object to the use of your personal information where I rely on legitimate interests. You also have an absolute right to object to direct marketing.

To exercise a right, email **lucy@lucyrosestudios.com**. I may need to confirm your identity before responding.

There is no charge, and I will respond within the period required by applicable data-protection law.

Automated decision-making

Lucy Rose Studios does not make decisions about clients using solely automated processing where those decisions would have legal or similarly significant effects.

Google and other service providers may use automated systems as part of analytics, security and advertising measurement, subject to their own privacy information and the choices available through the website’s cookie controls.

Complaints

Please contact me first if you have concerns about how I have handled your personal information, and I will do my best to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office.

Changes to this policy

I may update this policy when my services, providers or legal obligations change. The latest version will be published on this page with a revised update date.

Where a change has a significant effect on how I use information already collected, I will take reasonable steps to bring that change to the attention of the people affected.