Privacy Policy

1. Data controller and contact details

The data controller for your personal data is:

Dan Mackenzie, trading as Dan Mackenzie Creative ("we", "us", "our")

The Cabin, Brownshill Road

Stroud, Gloucestershire, GL6 8AS

United Kingdom

Email: [email protected]

In plain terms: we decide why and how your personal data is used, and you can contact us at any time using the details above. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

2. Personal data we collect

We collect personal data:

• Directly from you (for example, via bookings, contact and enquiry forms, email, or purchases).
• Automatically (through cookies and analytics — see our Cookie Policy).
• From trusted third parties (such as gallery platforms and payment processors).

Types of data may include:

• Contact details (name, address, email, phone).
• Booking and order information.
• Payment-related data. Card payments are processed and tokenised by Stripe, Inc.; we do not store full card numbers.
• Enquiry and form-submission content collected through Typeform forms (such as our Client Inquiry Form, Creative Services Enquiry, and shoot forms), which may include your name, email, and project details.
• Newsletter and marketing data held in Mailchimp (email address, name, sign-up source, and campaign engagement) where you have opted in.
• Meeting and consultation data captured through Zoom (such as your name, email, and, where enabled and notified, recordings or transcripts).
• Technical data (IP address, device and browser information, time zone), including data processed at the network edge by Cloudflare, Inc.
• Usage data (pages viewed, interactions, preferences).

3. How and why we use your information

We use personal data to:

• Provide and manage bookings, sessions, consulting and events.
• Deliver client galleries, digital downloads, and physical products.
• Respond to enquiries and provide customer support.
• Maintain, secure, and improve our websites and services.
• Send relevant updates and marketing communications where permitted.
• Meet legal, regulatory and accounting obligations.

4. Cookies and tracking technologies

We use cookies and similar technologies for:

• Essential site functionality.
• Analytics and performance, using Google Analytics 4 (GA4), which is deployed through Google Tag Manager.
• Marketing and measurement (for example, pixels or tags), which may include activity linked to our Facebook (Meta) Page.

Full details, including consent categories and how to change your preferences, are set out in our Cookie Policy. You can manage preferences via our on-site consent tools and your browser settings.

5. Lawful bases for processing

Depending on the context, we rely on one or more of the following lawful bases:

• Performance of a contract (for bookings, orders and services).
• Consent (for certain marketing and non-essential analytics activities, including our Mailchimp newsletter and analytics cookies).
• Legitimate interests (for basic analytics, security, fraud prevention, and service improvement).
• Legal obligation (for record-keeping and compliance).

6. Data sharing and third-party processors

We share personal data only with trusted third parties where necessary. Our current key processors and platforms include:

• Pixieset and Stripe, Inc. (client galleries, store, and payment processing).
• Print fulfilment labs and shipping providers.
• Google LLC (Google Analytics 4 and Google Tag Manager; Google Search Console for indexing).
• Mailchimp (The Rocket Science Group LLC) for newsletter and email marketing.
• Typeform SL for enquiry and booking forms.
• Cloudflare, Inc. for content delivery, DNS, and edge security.
• Zoom Video Communications, Inc. for consultations, meetings, and webinars.
• Meta Platforms, Inc. for our Facebook Page and related insights.

Each third party is engaged under appropriate data protection terms and may only process data on our instructions for defined purposes. Whether an account/identity provider (Clerk) is used for gallery or store login is [NEEDS VENDOR CONFIRMATION].

7. Data retention

We retain data only for as long as necessary for the purposes stated and in line with legal obligations.

Indicative retention periods include:

• Client photo archives: typically up to 12 months in RAW format, and longer where agreed.
• Booking and transaction records: typically at least 6 months, and longer where required for accounting or legal reasons.
• Marketing lists (Mailchimp): up to 3 years from last meaningful interaction or until you unsubscribe.
• Analytics data (GA4): retention window as configured in Google Analytics — [NEEDS VENDOR CONFIRMATION].
• Cloudflare edge/security logs: retention as set by the platform — [NEEDS VENDOR CONFIRMATION].

We may anonymise data for longer-term analytics.

8. International transfers

Some suppliers and platforms process data outside the UK/EEA. In particular, Stripe, Google, Mailchimp, Cloudflare, Zoom, and Meta are US-based or operate globally, and our Mailchimp audience is hosted in a US data centre. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement, or standard contractual clauses, together with any additional measures required.

9. Your rights under UK GDPR

You have rights to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion in certain circumstances.
• Restrict or object to processing.
• Data portability, where applicable.
• Withdraw consent where processing is based on consent (for example, unsubscribing from our newsletter at any time).

In plain terms: you can ask us what we hold about you, ask us to fix or delete it, or tell us to stop certain uses. To exercise these rights, contact us using the details in Section 1. We will respond within one month, as required by UK GDPR. You also have the right to complain to the ICO.

10. Security measures

We use technical and organisational measures to protect personal data, including secure hosting, encryption in transit for key services, Cloudflare edge security, access controls, and staff/contractor confidentiality commitments.

11. Changes to this Policy

We review and update this Privacy Policy periodically. The latest version will be published on our website with an updated effective date. Material changes may be highlighted via site notices or email.

13. Related policies

• Cookie Policy
• Website Terms of Use
• Terms of Service
• AI Ethics and Responsible Use Policy
• Disclaimer Statement