Privacy policy.

This privacy policy explains how I, Andrew Heeley, trading as Andrew Heeley Photo, collect, use, store and protect your personal information. It applies when you use andrewheeleyphoto.com ("this website"), when you enquire about or book my photography services, and when you appear in photographs I take.

I am the data controller and am responsible for your personal information. I follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

You can contact me at:

I may update this policy from time to time. The date below shows when it last changed. If I make significant changes, I'll let current clients know.

This policy is effective from 25 September 2026.

What I collect

If you enquire about or book my services, I may collect:

  • your names and contact details (email address, phone number, postal address, dates of birth);

  • details of your wedding, such as the date, venue, timings, the names of key family members, and your supplier contacts;

  • your booking records, including your proposal, contract, invoices and payments. I never see or store your card details: card payments are processed securely by Stripe, Pic-Time or PayPal. If you pay by bank transfer, I receive the bank details shown on your payment;

  • your choices about photo-use consent and marketing emails;

  • our emails, messages and call notes.

When I photograph a wedding, I collect images of the couple, their wedding party and their guests.

When you visit this website, I collect technical information through cookies, but only if you accept them. See the cookies section below.

Some information you share may be sensitive. For example, the type of ceremony can reveal religious beliefs, a wedding can reveal sexual orientation, and accessibility or dietary requirements can reveal health information. I only use this kind of information to plan and photograph your day.

If you give me information about other people, such as family members or suppliers, please let them know you've shared it.

It's important that the information I hold about you is accurate. Please tell me if anything changes.

Photographs

Photographing your wedding and delivering the images is part of my contract with you. I deliver your images through a private online gallery hosted by Pic-Time.

I may use photographs of you to promote my work, for example on my website, social media, wedding blogs, publications and award entries. You can withdraw consent at any time by emailing me. I'll then remove your photographs from the website and social media channels I control within 30 days. I can't recall material that has already been printed or published by others.

If you were a guest at a wedding I photographed and you appear in an image on my website or social media and you wish to have the image removed and your appearance in the image was more than incidental, email me and I'll remove it.

I won't feature children as the main subject of an image in my portfolio without consent from a parent or guardian.

The legal basis for processing your data

I process your information on the following legal bases:

  • Contract. I use this basis for responding to your enquiry with a quote, managing your booking, photographing your wedding, and delivering your images and products.

  • Consent. I use this basis for using your photographs to promote my work, for sending marketing emails, and for non-essential cookies such as analytics and advertising cookies. Sensitive information (see above) is only used with your explicit consent. You can withdraw any consent at any time.

  • Legitimate interests. I use this basis for photographing guests at weddings I've been booked for, keeping business records, and handling any disputes. I only rely on this where it doesn't override your rights.

  • Legal obligation. I use this basis for keeping financial records for tax and accounting purposes.

How is your data collected?

  • Directly from you, through my contact form, emails, calls, messages, your booking proposal, your contract and planning questionnaires.

  • From others involved in your wedding, such as your partner, planner or other suppliers.

  • Through photographs taken at your wedding or pre-wedding session.

  • Automatically, through cookies you've accepted on this website.

What I do with the information I gather

  • Respond to enquiries and send quotes.

  • Manage bookings, contracts, invoices and payments.

  • Plan and photograph your wedding.

  • Edit and deliver your images, albums and prints.

  • Promote my work.

  • Send marketing emails, with your consent. I'll ask you to renew this consent every two years.

  • Understand how this website is used and measure my advertising, with your cookie consent.

  • Keep the records I'm legally required to keep.

Who I share your data with

I will never sell your personal information. I share it only with service providers who act on my instructions and keep it secure:

  • Squarespace: website hosting and contact forms.

  • LightBlue Software: my client management system, used for enquiries, bookings, contracts and invoices.

  • Pic-Time: online galleries and the print store.

  • Stripe: secure processing of card payments.

  • Folio Albums: albums and prints.

  • Google (Gmail): email.

  • Meta (WhatsApp, Instagram and Facebook Messenger): messages you send me on these platforms.

  • Adobe (Lightroom): editing, with cloud sync of images.

  • Mailchimp: marketing emails.

  • Backblaze and Dropbox: secure backup of files and images.

  • Google Analytics and Meta: website analytics and advertising measurement, with your cookie consent.

  • Second photographers: photographers who work with me at weddings where a second photographer is booked.

  • Brearley and Co.: tax and accounts.

I may also share information with other suppliers at your wedding where it's needed to provide my services, where you have consented, or where the law requires it.

If I sell, transfer or merge any part of my business, your information may be transferred to the new owner. They could only use it as this policy describes.

International transfers

Some of my service providers store data outside the UK, for example in the USA. Where they do, I make sure your information is protected. This is either because the UK has recognised the country as providing adequate protection (including the UK Extension to the EU-US Data Privacy Framework for certified companies), or because a UK-approved contract is in place. These contracts are the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact me if you'd like more detail.

How long do I keep your personal information for?

  • Enquiries that don't become bookings: 12 months.

  • Contracts, invoices and financial records: around 6 years after the transaction, as tax law requires.

  • Edited images: Up to 10 years after delivery when archived.

  • Unedited (raw) files: 12 months after delivery.

  • Portfolio images: until you withdraw photo-use consent.

  • Marketing email details: until you unsubscribe or don't renew your consent.

Controlling your personal information: your rights

You have the right to:

  • access a copy of the information I hold about you;

  • have inaccurate information corrected;

  • have your information deleted, unless I need to keep it for a legal reason;

  • restrict how I use your information;

  • receive your information in a format you can reuse elsewhere (data portability);

  • object to how I use your information where I rely on legitimate interests;

  • withdraw consent at any time.

To use any of these rights, email me. There's no charge, and I'll respond within one month. I don't make decisions about you using fully automated systems.

Security

I use appropriate technical and practical measures to keep your information secure. Information is stored on secure systems run by me and my service providers. Any paper records are kept locked away or on my person. Only people who need access for my business have it, and they must keep it confidential.

Please keep your gallery link and any passwords private. If you think they've been shared with the wrong person, tell me straight away.

If there's ever a data breach affecting your information, I'll tell the Information Commissioner's Office and you where the law requires.

Complaints

If you're unhappy with how I've handled your information, please contact me first so I can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

How I use cookies on this website

Cookies are small files stored on your device when you visit a website. When you first visit this website, a banner asks which cookies you're happy to accept. You can change your choice at any time through [cookie settings link].

  • Essential cookies are needed for the website to work, for example for forms [and the shopping cart]. These don't need your consent.

  • Analytics cookies (Google Analytics) show me how visitors use the website, such as which pages they visit and for how long, so I can improve it. These are only used if you accept them.

  • Marketing cookies (Meta Pixel) are explained below. These are only used if you accept them.

Meta Pixel

If you accept marketing cookies, this website uses the Meta Pixel from Meta Platforms, the owner of Facebook and Instagram. It helps me measure how well my Facebook and Instagram adverts work, for example whether people visit this website after seeing an ad. I don't see who individual visitors are. However, Meta may link this data to your Facebook or Instagram account and use it for its own purposes under its privacy policy (facebook.com/privacy/policy). You can manage how Meta uses your data for ads in your Facebook or Instagram ad settings.

Links to other websites

This website may link to other websites. I'm not responsible for how those sites handle your information, so please check their own privacy policies.