PRIVACY & COOKIES POLICY

Effective date: 9 September 2026

Elizabeth Biggs Photography, Training & Consulting (“EBPTC”, “we”, “us” or “our”) is operated by Elizabeth Biggs.

Business address: 6 Hunter Street, Chester, Cheshire, CH1 2AR
Email: info@elizabethbiggs.co.uk
Telephone: 07878 437843
Website: elizabethbiggs.co.uk

This policy explains what personal information we use, why we use it, who we share it with, how long we keep it and your rights.

For data-protection purposes, the controller is Elizabeth Biggs.

Sometimes EBPTC processes personal information only on another organisation’s instructions. In that case, that organisation is the controller, and its privacy information and any agreed data-processing arrangements also apply.

A PDF copy of this policy is available on request.

1. WHO THIS POLICY COVERS

This policy covers personal information we hold about clients and prospective clients; people taking part in photography, training, consultations, events or recordings; people appearing in photographs or video; client staff and guests; business contacts; suppliers; website visitors; newsletter subscribers; and other people whose information we need to run EBPTC or provide an agreed service.

2. INFORMATION WE MAY COLLECT

Depending on the service or contact, we may process:

• name, address, email address, telephone number and other contact details;

• business, job, role and organisation information;

• enquiry, quotation, booking, contract, invoice and payment information;

• correspondence, questionnaires, planning notes, session notes and preferences;

• photographs, video, audio, recordings, transcripts or other media in which someone may be identifiable;

• image selections, editing requests, delivery information, licences and release or consent records;

• training, teaching, consulting, coaching and advisory information, including participant details, business or operational context, goals, audit findings, recommendations, action points and working notes where these identify or relate to an individual;

• client-supplied documents, materials and information used to understand, plan or deliver the agreed work where they contain personal information;

• information needed for safe or accessible service delivery;

• website and device information, such as IP address, browser or device data and cookie information; and

• records needed for accounting, tax, insurance, legal, security or business administration.

Some personal information is classed as special category data because it needs extra protection. For EBPTC, this is most likely to include health or accessibility information provided so we can make an adjustment or deliver a service safely.

We use this information only when it is needed and the law allows us to. Special-category data also needs an additional legal condition. In some circumstances, that will be your explicit consent.

We may also receive or create confidential business or operational information that is not personal data. Confidentiality for that information is covered separately by our Terms & Conditions and any agreed confidentiality arrangements.

3. WHERE INFORMATION COMES FROM

Most information comes directly from you.

It may also come from:

• the person or organisation commissioning the work;

• client staff, participants or attendees;

• client-supplied documents, systems or materials used for an audit, consultation, training or other agreed service;

• a referral source;

• a supplier;

• a publicly available business source; or

• a service or platform you use to contact or book EBPTC.

4. WHY WE USE PERSONAL INFORMATION

We use personal information only when it is needed for a clear purpose and data-protection law allows that use. The main ways this applies to EBPTC are below.

Enquiries, quotations and bookings

We use information to answer enquiries, prepare quotations, take requested steps before a booking, create bookings and administer agreed services.

Where you are personally entering into a contract with EBPTC, we may rely on steps requested before the contract and/or the contract itself.

Where you are acting for a business or organisation, we may instead rely on our legitimate interests in communicating with that organisation and managing the business relationship.

Photography, editing, galleries, delivery and licensing

We use information to plan, photograph, edit, select, supply, archive where appropriate and license commissioned photography.

Where an individual is personally the client, we may rely on the contract.

For other people appearing in commissioned photography, including participants at events, we may rely on legitimate interests where taking and using the photographs is necessary, proportionate and within what people could reasonably expect.

For planned event coverage, we will make relevant event or participant information available, including the practicalities of opting out.

We may separately request a more specific individual agreement where appropriate, for example for a feature, testimonial or particular promotional use.

Training, teaching, consulting, coaching and advisory services

We use information to plan and provide the agreed service, communicate with clients and participants, prepare or supply agreed materials and keep the working records reasonably needed to provide the service.

Where an individual is personally the client, we may rely on the contract.

Where information relates to participants, staff or other people involved through a client organisation, we may rely on legitimate interests where the use is necessary, proportionate and reasonably expected.

Recording and transcription

Where EBPTC proposes to make an audio or video recording, or create a transcript, of a meeting, consultation, training session, workshop, photography session or another part of our services, we will explain why it is being made and how it will be used before it begins.

It may be used for internal working purposes, such as transcription, note-making or checking an agreed brief or requirements; form part of an agreed client deliverable, such as a replay, workshop recording or behind-the-scenes footage; or be used for publication, promotion or wider sharing where that use has been agreed or otherwise appropriately covered.

More specific individual permission may be requested for featured, testimonial or other uses where that is appropriate.

Depending on the purpose and circumstances, we may rely on the contract, legitimate interests or consent.

Business administration and protection

We use information to manage payments, accounting, tax, insurance, security, backups, complaints, disputes, legal claims and business continuity.

We may rely on our legal obligations and/or our legitimate interests in running and protecting EBPTC.

Efficient working and service improvement

We use information where reasonably needed to organise work, keep accurate and consistent records, avoid unnecessary duplication and improve our workflows and service delivery.

We normally rely on our legitimate interests in running EBPTC efficiently and accurately.

Where the information is needed to provide a service you have contracted with us for, we may instead rely on the contract.

Website and analytics

We use technical information needed to operate, maintain and protect our website.

Where optional website analytics is enabled, we use it only after the relevant cookie choice allows it. Our currently verified optional analytics setup includes Google Analytics.

Direct marketing

We may contact people about EBPTC services by email, text, direct message, telephone or post.

Where consent is required, we ask for it. In other cases, we may rely on legitimate interests where appropriate.

You can opt out of direct marketing at any time.

EBPTC portfolio and promotional use

Using identifiable photographs for EBPTC’s own portfolio, website, social media, advertising or other promotion is separate from supplying the photography service.

Where we ask for optional individual promotional permission, refusing it does not reduce the service you receive.

Other uses, such as agreed collaborative marketing or event coverage, may instead be covered by the booking, event arrangements and the lawful basis that applies to that use.

Where we rely on consent, you can withdraw it at any time for future use. This does not affect anything that was lawful before consent was withdrawn.

We will stop future use under our control as soon as reasonably practicable. We cannot necessarily recall copies already downloaded or independently republished by other people.

5. HOW WE USE TECHNOLOGY

EBPTC uses local devices and systems, cloud services, software, AI-assisted tools and specialist service providers to deliver and administer our services.

They may support work such as:

• business administration and record keeping;

• drafting and research;

• quotations, proposals and booking materials;

• planning and workflow management;

• transcription and note-making;

• image organisation, retouching and editing;

• background removal and design;

• training materials and presentations;

• consultation or audit outputs, action plans and client briefings; and

• other work needed to provide or administer our services.

Some processing takes place locally on EBPTC-controlled devices and systems. Other processing uses third-party services, including providers described in section 6.

AI-assisted processing may also be carried out locally on EBPTC systems. Where information remains on those systems, it is not shared with a third-party AI provider.

We do not use AI to make decisions about people solely by automated processing where those decisions would have legal or similarly significant effects.

We do not intentionally submit client photographs or personal information for the purpose of training general third-party AI models.

Where identifiable client material is used with an AI-assisted service, we limit the information shared to what is needed for the task and use appropriate privacy, security and account controls.

6. WHO WE MAY SHARE INFORMATION WITH

We share personal information only where it is reasonably needed for the relevant purpose.

This may include:

• Google and Microsoft services used for email, calendar, documents, storage and business administration;

• Google Analytics, where optional analytics has been allowed;

• Google reCAPTCHA, where used to protect website forms from spam or misuse;

• social-media and business-profile platforms we use for communication or publishing;

• ShootProof and similar gallery, contract, invoicing or image-delivery providers;

• Squarespace and other website, form or hosting providers;

• Adobe, Canva and other photography, editing, design or production software providers;

• OpenAI/ChatGPT, Anthropic/Claude, Microsoft Copilot and other AI-assisted services, where used as described in this policy;

• payment providers, banks, accounting and bookkeeping providers;

• assistants, photographers, retouchers, trainers, specialists and other suppliers supporting a booking;

• marketing, social-media or administrative support providers where used;

• printers, print laboratories, couriers, venues and other suppliers needed to provide an agreed service;

• insurers and professional or legal advisers where necessary; and

• regulators, courts, law-enforcement bodies or other authorities where disclosure is required or lawful.

Some of these providers handle information on EBPTC’s behalf. Others decide some of their own uses and apply their own privacy terms.

We do not sell personal information.

7. INTERNATIONAL PROCESSING

Some of the providers we use operate internationally and may process personal information outside the UK.

Where UK data-protection law requires additional protection for an international transfer, the transfer uses a recognised legal route, such as UK adequacy arrangements or approved contractual safeguards.

You can ask us for information about the safeguard used for a relevant transfer.

8. HOW LONG WE KEEP INFORMATION

We keep personal information for as long as reasonably necessary for the reason it is held, taking account of contractual, tax, accounting, insurance, legal, copyright, licensing, backup and client-service requirements.

Contract, invoice and core business records are kept for the periods required by law and for a reasonable period in which contractual or legal issues could arise.

Photographic files may be kept longer where there is a continuing reason, such as:

• client re-supply;

• a separately agreed archive or storage service;

• copyright or licensing evidence;

• backup integrity; or

• professional record keeping.

Selected reference images, setup notes and client or project history may be kept longer where there is an ongoing client-service reason, for example to recreate an established lighting setup, photographic style, brand treatment or previous brief for repeat or long-cycle work.

Training, consulting and advisory notes or outputs may also be kept where reasonably needed for continuity, follow-up, evidence of the agreed work or a continuing client relationship.

Recordings, transcripts and working notes are kept only for as long as reasonably needed for their stated purpose, the relevant service or another applicable legal or record-keeping reason.

Consent and release records may be kept while the related use continues and afterwards where needed to show what permission was given, its scope or any later withdrawal.

We may keep the minimum information needed on marketing contact or do-not-contact records so we can manage marketing and respect opt-outs.

When information is no longer needed, we delete, anonymise or securely dispose of it, subject to legal requirements and normal backup cycles.

9. SECURITY

We protect personal information using measures appropriate to the information and the systems involved.

Depending on the system, these may include password protection, multi-factor authentication, access controls, device security, backups, encryption where appropriate and limiting access to people who need the information for their work.

Where a client requires additional confidentiality, storage, access, encryption or other security arrangements, these can be agreed for the relevant service. See also our Terms & Conditions at elizabethbiggs.co.uk/terms-and-conditions.

10. YOUR DATA-PROTECTION RIGHTS AND COMPLAINTS

Depending on the circumstances and the lawful basis being used, you may have the right to:

• access your personal information;

• correct inaccurate information;

• ask for information to be erased or its use restricted;

• receive certain information in a portable format; or

• object to particular uses of your information.

Where processing is based on consent, you can withdraw that consent at any time for future processing.

You can object at any time to our use of your personal information for direct marketing. If you object, we will stop using it for that purpose.

Where we rely on legitimate interests, you can also object to that processing. We will consider the circumstances and stop unless there is a compelling lawful reason to continue or the information is needed for legal claims.

To exercise a data-protection right, contact info@elizabethbiggs.co.uk.

We may need to confirm your identity before releasing or changing personal information.

Data-protection complaints

If you believe we have not handled your personal information properly, you can raise a complaint using the contact details in this policy.

We will acknowledge a data-protection complaint within 30 days, investigate it without unnecessary delay, keep you informed and tell you the outcome.

You can also complain to the Information Commissioner’s Office (ICO).

Information is available at ico.org.uk.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

11. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses necessary cookies and similar technologies to operate the site, remember privacy choices and protect the website and forms from misuse.

Google reCAPTCHA may be used on protected forms as an anti-spam and security measure.

With your permission, Google Analytics is used to understand how the website is used and help us improve it.

Current website cookies include:

• Squarespace crumb: a necessary security cookie used to help protect against forged requests. It lasts for the browser session.

• Squarespace ss_performanceCookiesAllowed and ss_marketingCookiesAllowed: remember your cookie choices for 30 days.

• Google Analytics _ga and _ga_<measurement ID>: optional analytics cookies used to distinguish visitors and measure website use. They are set only where Performance and Analytics cookies have been allowed and may remain for up to approximately 400 days, subject to browser settings and Google’s controls.

Optional analytics is restricted until you make your choice through the cookie banner.

You can accept optional cookies, decline them or manage your preferences. You can change those choices later through the website’s cookie controls.

Third-party content or services embedded into the website may use their own technologies and are subject to the relevant provider’s privacy information.

12. CHANGES TO THIS POLICY

We update this policy when the law, our services, technology or business practices materially change.

The effective date at the top shows the current published version.

Questions about privacy can be sent to:

Elizabeth Biggs Photography, Training & Consulting
operated by Elizabeth Biggs

6 Hunter Street

Chester