Privacy notice

Who is responsible for your data

Christopher Harrison Photography is the data controller for the personal data described here.

If you have a question about your data, the quickest route is the contact form.

What I collect, and why

If you send me a message

The contact form collects your name, email address, the reason you picked and your message. I use them to reply to you and for nothing else.

Lawful basis: legitimate interests — you have asked me a question and answering it is the reason the form exists.

If you buy a print

To fulfil an order I need your name, email address, delivery address and any delivery notes you add. These are used to make, post and track your order, and to keep the accounting records I am legally required to keep.

Lawful basis: performance of a contract for the order itself, and legal obligation for the tax records that follow it.

I never see your card details. Payment is handled entirely by the payment provider on their own secure page. Your card number does not pass through this website and is not stored anywhere I control.

If you tick the newsletter box

Your email address, used to tell you occasionally about new prints. The box is never pre-ticked, ticking it is not required to place an order, and every email has a one-click unsubscribe.

Lawful basis: consent, which you can withdraw at any time without affecting anything else.

What I do not do

• No tracking cookies. This site sets no cookies at all.
• No analytics or advertising pixels. No Google Analytics, no Meta pixel, nothing that follows you elsewhere.
• No profiling and no automated decision-making.
• Nothing is ever sold, rented or shared for anyone else's marketing.

This is why you have not been shown a cookie banner. There is genuinely nothing to consent to — not because consent has been assumed, but because nothing is collected that would need it.

Your basket stays in your browser

When you add a print to your basket it is saved in your own browser's local storage. It is not a cookie: it is never sent to this website or anyone else, and I cannot see it. It stays until you check out, remove it, or clear your browser data.

Who else is involved

A few services are necessary to run the site. Each one only ever receives what it needs to do its job:

• Netlify — hosts the website and receives contact form submissions.
• Sanity — stores the photographs and text that make up the site. No customer data.
• The payment provider — handles card payments and holds the payment record. I receive confirmation and your delivery address, never your card details.
• Royal Mail or the chosen carrier — receives the delivery address, because otherwise the parcel cannot arrive.

Some of these operate outside the UK. Where data is transferred, it is done under the safeguards UK data protection law requires — standard contractual clauses or an adequacy decision.

How long it is kept

• Order records: 7 years. This is not really a choice — HMRC requires business records to be kept for six years after the end of the tax year they relate to.
• Enquiries that do not become orders: up to two years, then deleted.
• Newsletter: until you unsubscribe, and removed promptly when you do.

Your rights

Under UK GDPR you can ask me to:

• tell you what data I hold about you, and give you a copy
• correct anything that is wrong
• delete it, where I am not required to keep it for tax purposes
• restrict or object to how it is used
• provide it in a portable format
• stop sending you marketing, at any moment, for any reason

Ask through the contact form and I will respond within one month. There is no charge.

Complaints

If you think I have handled your data badly, please tell me first — it is usually a mistake and I would rather fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. You do not have to speak to me first.

Changes

If this notice changes, the date at the top changes with it. If a change is significant and I hold your email address, I will tell you.