Privacy Policy

Last updated: [Insert Date]

A note on this document. This policy was drafted to accurately describe how this specific website works, based on a full review of its code and data flows. It is not a substitute for advice from a qualified solicitor. Given that some data on this site relates to under-18s, it's worth having a solicitor give this a final read-through before it goes live — particularly the retention and contact sections, which contain placeholders only you can fill in accurately.

1. Who we are

This website is operated by [Insert Full Name / Business Name], trading as Fin Stead Photography ("we", "us", "our"), a motorsport photography business based in [Insert Country/Region, e.g. the United Kingdom].

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the "data controller" for the personal data described in this policy.

2. What data we collect

We only collect what we actually need to run bookings and deliver your photos. Here's exactly what that is:

Where	What's collected
Booking form	Name, race number, group/class, email address, Instagram handle, motorcycle/kit colour scheme, any special requests or distinguishing features you tell us, and which event round you're booking
Incomplete booking forms	If you start filling in the booking form but don't submit it, we automatically save what you've entered so far, so we can see (and where helpful, follow up on) forms that were abandoned partway through. This is saved automatically as you type, not just on submission.
Get Your Photos	The Instagram handle you type in to unlock your private photo album (checked against albums we've already set up — nothing new is collected here beyond the handle itself)
Photographs	Images we take of you at events, which may show your face, name, race number, or other identifying details
Technical data	Your IP address, used briefly and automatically to prevent abuse (e.g. stopping automated attempts to guess other people's unlock codes) — see Section 8

We do not collect payment card details. Payment is handled separately through Square via a payment link we provide — we never see or store your card information.

On incomplete forms specifically: we keep this data for up to 7 days after your last edit, then it's deleted automatically. It's deleted immediately (rather than kept for 7 days) the moment you do submit the form. You can ask us to delete an in-progress form sooner at any time — see Section 11.

3. How we use your data

To process and manage your photography booking
To contact you about your booking or event (e.g. confirming details, letting you know your photos are ready)
To follow up on a booking form you started but didn't finish, if we think it'd be helpful
To match you with the correct private photo album via your Instagram handle
To take and deliver photographs of you at the event you've booked
To keep the site secure and prevent abuse (e.g. rate-limiting repeated attempts to guess unlock codes)

We do not use your data for advertising, and we do not sell or rent your data to anyone.

4. Our legal basis for processing

Under UK GDPR, we rely on the following legal bases:

Contract — processing your booking details is necessary to provide the photography service you've asked for
Legitimate interests — for basic security measures like rate-limiting, and for saving incomplete booking forms so we can follow up where useful. In both cases this is limited in scope, kept for a short time only, and you can ask us to stop or delete it at any point.

5. Who we share data with

We use a small number of service providers ("processors") to run this site. We don't use any advertising or analytics companies.

Cloudflare — provides the hosting, storage, and security infrastructure this site runs on. Cloudflare may process data on servers outside the UK/EU as part of its global network; Cloudflare's own privacy and data processing terms govern this. See Cloudflare's GDPR resources for details.
Square — processes payments via an external payment link. We don't receive or store your card details; Square's own privacy policy governs how they handle your payment information.

6. International data transfers

Because we use Cloudflare's global infrastructure, your data may be processed in countries outside the UK or European Economic Area, including the United States. Where this happens, it's covered by Cloudflare's own safeguards (such as Standard Contractual Clauses). [Confirm the specific safeguards that apply to your Cloudflare account/plan].

7. How long we keep your data

Booking and album data is currently kept until we manually remove it — there is no automatic deletion. We intend to retain your data for [Insert Retention Period, e.g. 12 months after your event, or until you ask us to delete it], after which it will be deleted unless we're required to keep it for a legal reason.

Incomplete/abandoned booking forms are the one exception with a fixed, automatic retention period: these are deleted automatically 7 days after your last edit, or immediately once you do submit the form — whichever happens first.

If you'd like your data deleted sooner, contact us using the details in Section 11 and we'll action this promptly.

8. Security measures

We take reasonable technical steps to protect your data, including encrypting all traffic to this site (HTTPS), restricting admin access behind authentication, and rate-limiting repeated attempts to guess private access codes. No method of storing or transmitting data online is 100% secure, but we work to keep this risk as low as reasonably possible.

9. Children's data

Some of our events include junior and youth categories, which means some booking data may relate to under-18s. Where a booking is for a rider under 18, we expect this information to be submitted by a parent or guardian on their behalf. If you're a parent or guardian and want to review, correct, or delete information relating to a child, please contact us — we'll treat these requests with particular care.

10. Your rights

Under UK GDPR, you have the right to:

Ask what personal data we hold about you, and get a copy of it (right of access)
Ask us to correct inaccurate data (right to rectification)
Ask us to delete your data (right to erasure), subject to any legal reasons we may need to keep it
Ask us to restrict how we use your data (right to restriction)
Object to us processing your data in certain circumstances (right to object)
Ask for your data in a portable format (right to data portability)

To exercise any of these rights, contact us using the details below. If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

11. Contact us

If you have any questions about this policy or how we handle your data, contact:
[Insert Contact Name]
[Insert Contact Email]
[Insert Postal Address, if applicable]

12. Changes to this policy

We may update this policy from time to time, for example if the site's features change. We'll update the "Last updated" date at the top of this page when we do.

13. Cookies

This site uses a small number of cookies, described in full in our Cookie Policy.