Privacy Policy

1. About this privacy policy

The Wedding Content Studio respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, make an enquiry, request availability, build or make a booking, purchase wedding photography or wedding content creation services, use our customer online portal, use our wedding guest portal, upload photographs or videos, communicate with us, enter into a contract with us or otherwise interact with The Wedding Content Studio.

We process personal information in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018, as amended from time to time.

2. Who we are

The data controller responsible for your personal information is:

[twcs_company_name]

Registered office:

[twcs_registered_address]

Company number:

[twcs_company_number]

[twcs_company_registration]

You can contact us regarding privacy or data protection matters through the Contact page on our website.

3. Information we may collect

The personal information we collect depends on how you interact with us.

Enquiries and prospective customers

• your name;
• email address;
• telephone number;
• proposed wedding date;
• wedding venue or location;
• services you are interested in;
• information you include in messages to us;
• enquiry source;
• follow-up information;
• correspondence between you and our team.

Customers and bookings

• your full name;
• your partner’s name and contact information;
• email address;
• telephone number;
• postal address;
• wedding date;
• ceremony, reception, preparation and other venue details;
• venue postcodes and travel information;
• packages and additional services selected;
• booking totals, deposit information, payment method and payment status;
• amounts paid and outstanding;
• booking reference;
• contractual information;
• electronic signatures;
• communications relating to your booking;
• information you voluntarily provide about your wedding plans.

Electronic contracts

When you electronically sign a contract, we may record your full name, your drawn electronic signature, the date and time of signing, your IP address, browser or device information and the version of the contract you signed. A PDF record of the signed contract may be retained as part of your booking record.

Payments

If you choose to pay by bank transfer, we record information necessary to identify and reconcile the payment, including your booking reference, amount due, amount received and payment status. We do not normally require you to provide us with your personal online banking credentials.

If you choose to pay online through Square, payment information is processed by Square. We receive information necessary to identify the transaction and determine whether payment was successful. We do not normally receive or store your complete payment card number or card security code.

Customer portal

• account identifiers;
• your login email address;
• encrypted authentication credentials;
• login dates and times;
• failed login attempts;
• IP addresses;
• password-reset activity;
• profile information;
• booking information;
• contracts;
• payments;
• secure messages;
• photographs, videos, galleries, files and other content associated with your booking.

Your email address acts as your account identifier and therefore cannot normally be changed directly through the customer portal.

Wedding guest accounts

Wedding guests may be provided with a unique access code associated with a particular wedding. When a guest registers, we may collect their name, email address, account information, wedding access codes entered, weddings to which access has been granted, login and security information and photographs or videos uploaded by the guest. A guest account may be connected to more than one wedding where the guest has entered a valid access code for each wedding.

Photographs and videos

As a wedding photography and content creation business, photographs and video recordings form a fundamental part of the services we provide. These may contain identifiable images of customers, wedding guests, suppliers, venue staff, members of the wedding party, children attending the wedding and other individuals present during the event.

Guests may also voluntarily upload photographs and videos through the wedding guest portal. We do not use wedding photographs or videos for biometric identification or facial-recognition purposes.

4. Information collected automatically

When you use our website or online services, we may automatically collect technical information including IP address, browser type, device type, operating system, pages visited, date and time of access, referral source, login attempts, session information, security events and cookie identifiers where applicable.

We use this information for website operation, security, fraud prevention, troubleshooting, analytics and service improvement.

5. How we use personal information

• respond to enquiries;
• check wedding-date availability;
• provide quotations;
• create and administer bookings;
• calculate travel and additional venue costs;
• communicate with customers;
• prepare and manage contracts;
• collect and reconcile deposits and other payments;
• provide photography and content creation services;
• create and deliver wedding photographs and videos;
• manage customer accounts;
• provide customer and guest portal services;
• allow guests to contribute photographs and videos;
• allow couples to share wedding content with authorised guests;
• provide secure messaging;
• provide galleries, downloads and other digital content;
• manage password resets and account security;
• maintain business and financial records;
• prevent fraud and misuse;
• investigate security incidents;
• maintain email and audit logs;
• establish, exercise or defend legal claims;
• comply with legal and regulatory obligations.

6. Our lawful bases for processing

Contract

We process information where it is necessary to take steps at your request before entering into a contract or to perform our contract with you. This includes checking availability, processing bookings, providing booked services, managing payments, administering contracts, operating your customer account and delivering photographs, videos and other content.

Legal obligations

We may process information where necessary to meet obligations imposed on us by UK law, including accounting, taxation, business record-keeping and regulatory requirements.

Legitimate interests

We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests. These may include administering our business, maintaining appropriate records, securing our website and CRM, detecting fraud or misuse, maintaining audit trails, responding to enquiries, improving our services, protecting our legal rights, managing communications and providing appropriate access to wedding content.

Consent

Where consent is the appropriate basis, we will ask for it. You may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

7. Wedding photography and guest privacy

A wedding is an event attended by many people who may appear incidentally or deliberately within photographs and video footage created as part of our contracted services.

• ceremonies;
• speeches;
• celebrations;
• dancing;
• group photographs;
• candid interactions;
• venue atmosphere;
• guest reactions;
• other moments that form part of the wedding story.

Where reasonably practicable, customers should make their guests aware that professional photography and content creation will take place during their wedding. If you are a wedding guest and have concerns regarding a particular image or recording, you may contact us. We will consider requests in accordance with applicable data protection law and the circumstances in which the content was created and is being used.

8. Children

Children may appear in photographs or videos taken at weddings. We do not intentionally create accounts for young children or ask children to provide personal information directly to us through our customer services. Where photographs or videos include children, we take reasonable care regarding how those materials are handled, stored and disclosed. Parents or guardians with concerns about content involving a child should contact us.

9. Guest-uploaded content

Wedding guests may be able to upload their own photographs or videos to a wedding’s private online space. Guests should only upload content that they are entitled to share.

Guests must not intentionally upload unlawful content, abusive or threatening content, material that seriously infringes another person’s privacy or content they do not have permission or authority to share.

Uploaded content will be associated with the relevant wedding account. Access to such content may be provided to the couple and other authorised users of that wedding portal.

10. Who we may share information with

We do not sell your personal information.

• website and hosting providers;
• cloud infrastructure providers;
• email delivery providers;
• payment processors including Square;
• IT and security service providers;
• professional advisers such as accountants or legal advisers;
• photographers, content creators or authorised subcontractors working on your wedding;
• storage, gallery or digital-content delivery providers;
• government bodies, regulators, courts or law-enforcement authorities where legally required.

We only provide third parties with information reasonably necessary for the relevant purpose. Where another organisation processes personal information on our behalf, we expect appropriate data-protection and security arrangements to be in place.

11. Additional photographers and content creators

For larger weddings or where additional coverage has been booked, we may use authorised additional photographers, content creators or contractors. They may have access to information necessary to carry out their work, including wedding schedules, customer names, venue details and photographs or recordings created during the event. They are expected to handle personal information appropriately and only for purposes connected with providing our services.

12. International transfers

Some service providers we use may process or store personal information outside the United Kingdom. Where personal information is transferred internationally, we will take appropriate measures required by UK data protection law to protect that information. These may include using countries recognised as providing an adequate level of protection or appropriate contractual safeguards.

13. How long we keep information

We do not retain personal information for longer than reasonably necessary for the purposes for which it was collected, subject to legal, contractual and business requirements.

• Enquiries that do not become bookings: normally up to 24 months after the last meaningful contact.
• Customer and booking records: normally retained for up to 7 years after completion of the booking where required for accounting, contractual or legal purposes.
• Contracts and financial records: normally up to 7 years after the relevant transaction or end of the contractual relationship.
• Email and audit logs: retained for a reasonable period appropriate to security, operational and legal requirements.
• Failed login/security information: retained for as long as reasonably necessary for security and fraud-prevention purposes.
• Customer and guest accounts: retained while required to provide the portal service and for a reasonable period afterwards.
• Wedding photographs, videos and delivered content: retention may vary depending on package, delivery arrangements, archival arrangements and agreements with the customer.
• Guest-uploaded content: may be retained while the relevant wedding portal remains available and may subsequently be deleted or archived.

Where information no longer needs to be retained, we will delete, anonymise or securely dispose of it where reasonably practicable.

14. Email communications

Our CRM maintains records of emails sent by the system. Email logs may contain recipient email address, subject, message content, date and time, delivery or processing status and associated booking or customer information. These logs help us maintain reliable customer communications, resolve disputes and investigate technical or security issues.

15. Audit and security records

For security and accountability, we maintain an audit trail of important system activity. This can include successful logins, failed login attempts, password-reset activity, administrative actions, customer-account activity, guest access, contract actions, payment-status changes, booking changes, administrator access to customer portal views and security events. These records are used to protect customers, guests, our systems and our business.

16. Secure messaging

Messages exchanged through the customer portal form part of the relevant booking record. Messages may be accessible to authorised members of our team involved in managing or delivering your booking. We retain these communications where reasonably necessary to provide our services, maintain an accurate history of the booking and deal with complaints or disputes.

17. Cookies

Our website may use cookies and similar technologies. Some cookies are strictly necessary for functions such as account login, security, booking sessions, customer and guest portals and remembering necessary settings.

We may also use optional cookies for analytics or other purposes. Where consent is legally required for non-essential cookies, they should not be activated until the appropriate consent has been obtained. Further information is available in our Cookie Policy.

18. How we protect personal information

• access controls;
• user authentication;
• password hashing;
• secure password-reset links;
• one-time access tokens;
• role-based permissions;
• protected customer and guest portals;
• activity logging;
• audit trails;
• encrypted HTTPS connections;
• restricted administrative access;
• software and security maintenance;
• separation of test and production CRM data;
• controlled access to customer content.

No internet-based system can be guaranteed to be completely secure, but we take reasonable steps to reduce foreseeable risks.

19. Your data protection rights

• the right to be informed about how your information is used;
• the right of access to personal information we hold about you;
• the right to rectification of inaccurate or incomplete information;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability where applicable;
• the right to object to certain processing;
• rights relating to certain forms of automated decision-making;
• the right to withdraw consent where processing relies on consent.

These rights are not absolute and particular exemptions may apply depending on why information is being processed. To exercise your rights, contact us using the details on our website. We may need to verify your identity before completing a request.

20. Automated decision-making

We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.

Automated processes may nevertheless be used for operational purposes such as checking booking availability, calculating prices, calculating travel costs, sending reminders, updating booking workflow statuses and providing account access.

21. Marketing

We will only send direct marketing communications where we have an appropriate lawful basis to do so. Where marketing communications rely on your consent, you can withdraw that consent at any time. Marketing preferences do not affect necessary communications relating to an enquiry, booking, contract, payment, customer account or service you have requested.

22. Links to other websites

Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices of those organisations. You should review their privacy information before providing personal information to them.

23. Data breaches

We maintain procedures for identifying and responding to personal-data breaches. Where required by law, we will notify the Information Commissioner’s Office and, where necessary, affected individuals.

24. Complaints

If you have concerns about how we use your personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

25. Changes to this Privacy Policy

We may update this Privacy Policy where our services, technology, suppliers or legal obligations change. The current version will always be published on our website and the Last updated date at the top of this policy will be amended when material changes are made.