Privacy Policy

Introduction

Lou Carruthers Photography is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains what personal data is collected when you use loucarruthers.co.uk (the “Website”), why it’s collected, how it’s used, and what rights you have under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies only to this Website. If you engage Lou Carruthers Photography for commissioned work, additional information about how your data is handled as a client will be set out in your project contract.

For information about how cookies are used on this site, please see our Cookie Policy.

Who we are

For the purposes of UK GDPR, the data controller is:Lou Carruthers Photography. Email: [email protected]

What information we collect

Two types of information are collected:

  • Personal information you provide directly: Your name, email address, and any other information you include when you submit the contact form or email [email protected]. Your email address and name when you sign up to the newsletter or download a lead magnet via MailerLite
  • Information collected automatically: Technical data through Google Analytics — including the pages you visit, time spent on the site, approximate location (country/region), device type and browser. Cookies set by the Website to support functionality and analytics (see Cookies section below).

No special category data (such as health, ethnicity, political views, religious beliefs) is collected.

Why we collect it and our legal basis

Personal data is processed under the following legal bases:

  • Contact enquiries: Processed on the basis of your consent (by submitting the form, you consent to being contacted in response). Legal basis: consent (UK GDPR Article 6(1)(a)).
  • Newsletter and lead magnet sign-ups: Processed on the basis of your explicit opt-in consent. You can withdraw consent at any time by unsubscribing or contacting [email protected]. Legal basis: consent.
  • Website analytics: Processed on the basis of legitimate interests (understanding how visitors use the Website in order to improve it) and consent where required for non-essential analytics cookies. Legal basis: legitimate interests (UK GDPR Article 6(1)(f)) and consent for cookies.
  • Responding to client enquiries that lead to commissioned work: Processed on the basis of taking steps to enter into a contract with you. Legal basis: contract (UK GDPR Article 6(1)(b)).

How we use your information

Your information is used only for the purposes for which it was collected. Specifically:

  • To respond to your enquiries and provide information about services
  • To deliver newsletters and lead magnets you’ve explicitly signed up for
  • To understand how visitors use the Website and improve it
  • To fulfil commissioned work where you become a client
  • To meet legal, tax and accounting obligations (such as keeping financial records for HMRC)

Your information will not be used for automated decision-making or profiling.

Who we share your information with

Your personal information is not sold, rented, or shared with any third party for marketing purposes. It is shared only with the following service providers who process data on our behalf:

  • Fasthosts (UK) — website hosting and email service. Data stored in the UK.
  • Google (Ireland / United States) — Google Analytics for website usage data. Data transferred to the United States.
  • MailerLite (Lithuania / EU) — email marketing platform for newsletter and lead magnet delivery. Data stored within the European Economic Area.

Each of these providers is bound by their own data protection agreements and processes data only on our instructions.

Your information may also be disclosed if legally required — for example, to comply with a court order, tax obligation, or lawful request from a regulatory authority.

International data transfers

Some of the service providers listed above are based outside the United Kingdom. Where data is transferred internationally, it is protected by appropriate safeguards as required by UK GDPR:

  • Transfers to MailerLite (EU) are covered by the UK adequacy decision for the European Economic Area.
  • Transfers to Google (United States) are covered by the UK–US Data Bridge (an extension of the EU–US Data Privacy Framework) and Standard Contractual Clauses.

How long we keep your information

Personal information is kept only for as long as necessary:

  • Website analytics data – anonymised and aggregated by Google Analytics; retention period set to the minimum currently permitted by the platform
  • Enquiries that don’t lead to a project – held for up to 2 years from your last contact, then deleted
  • Client project data (including contracts, invoices, correspondence) – held for 7 years after the project ends, in line with HMRC record-keeping requirements
  • Newsletter and lead magnet subscribers – held until you unsubscribe or withdraw consent

Your Rights

Under UK GDPR, you have the following rights regarding your personal information:

  • Right of access – to request a copy of the personal data held about you
  • Right to rectification – to have inaccurate personal data corrected
  • Right to erasure – to request that your personal data be deleted, subject to legal retention obligations
  • Right to restrict processing – to ask that use of your data be limited in certain circumstances
  • Right to object – to object to processing based on legitimate interests
  • Right to data portability – to receive your personal data in a structured, portable format
  • Right to withdraw consent – at any time, where processing is based on consent (this won’t affect processing that has already taken place)
  • Rights in relation to automated decision-making and profiling – no such processing takes place on this Website

To exercise any of these rights, please contact [email protected]. Responses will be provided within one month, as required by UK GDPR.

Cookies and tracking

This Website uses cookies to support functionality and understand how visitors use the site. Full details about the specific cookies used, their purpose, and how to manage your preferences are set out in our Cookie Policy.

Links to other websites

This Website may contain links to third-party websites or platforms. We are not responsible for the privacy practices of any external website. You are encouraged to read the privacy policies of any other sites you visit before providing them with personal information.

Changes to this policy

This Privacy Policy may be updated from time to time. Any changes will be posted on this page with a revised “last updated” date. Substantial changes will be communicated by email where appropriate (to newsletter subscribers and active clients).

How to complain

If you have a concern about how your personal data has been handled, please contact [email protected] in the first instance. We’ll aim to resolve any complaint within one month.

If you are not satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Website: ico.org.uk Helpline: 0303 123 1113

Contact us

For any questions about this Privacy Policy or your personal data, please contact [email protected].

Last Updated: April 2026