Last updated: 13 September 2026
Zoom Photo Studio respects your privacy. This statement explains what personal information we collect, why we use it, who we share it with, how long we keep it and the rights available to you.
1. Who is responsible for your information?
Zoom Photo Studio, operated by Justyna Ciemierz, is the controller of personal information used for its photography, booking, gallery and website services.
Contact details:
Zoom Photo Studio
Room 8, 48 Loons Road
Dundee, DD3 6AP
Email: hello@zoomphotostudio.co.uk
Telephone: 07305 796 808
2. Information we collect
Depending on how you interact with us, we may collect:
- your name, email address, telephone number, postal address and contact preferences;
- enquiry details, messages, consultation answers and correspondence;
- booking information, including the service, package, dates, times, participants, children’s names or ages, accessibility requirements and notes you choose to provide;
- payment status, amounts, currency, transaction references and limited payer information returned by PayPal; we do not receive or store your complete card number or security code;
- photographs, video, audio or behind-the-scenes material created in connection with a session;
- image selections, product orders, gallery activity and download counts;
- client-account details, password hashes, password-reset records and secure gallery-access identifiers;
- marketing choices, image-use permissions and records of consent or withdrawal;
- technical information such as IP address, browser type, device type, session identifiers, security logs, referring pages and website activity; and
- information needed to handle a complaint, legal claim, insurance matter or safeguarding concern.
We do not use photographs for facial recognition or biometric identification.
3. Information about children
Many of our services involve babies and children. We normally collect their information from a parent, guardian or adult arranging the session. We use only information reasonably needed to plan the photography, keep participants safe, deliver the gallery and fulfil the order.
A parent or person with parental responsibility must provide permission for public promotional use of an identifiable child’s image. We do not direct electronic marketing to children.
4. How we receive information
Most information comes directly from you through our website, email, telephone calls, social media, consultations, booking forms, contracts, payments and photography sessions. We may also receive information from another person arranging a group or family session, from PayPal about a payment, or from service providers supporting our website and communications.
If you provide information about another person, please make sure you are authorised to do so and that they have access to this statement where appropriate.
5. Why we use information and our lawful bases
Enquiries and bookings
We use contact, consultation and booking information to answer enquiries, provide quotations, reserve sessions, prepare for photography and deliver the agreed service. The lawful basis is taking steps at your request before a contract and performing our contract with you.
Payments, accounts and business records
We use booking and transaction records to collect payment, administer accounts, issue confirmations, prevent duplicate or fraudulent transactions, maintain tax records and resolve disputes. The lawful bases are contract, legal obligation and our legitimate interests in protecting and administering the business.
Photography, editing and fulfilment
We create, select, edit, store and deliver photographs and products in order to perform the photography contract. We may retain limited records where reasonably necessary to handle reorders, complaints, insurance matters or legal claims, based on contract, legal obligation or legitimate interests.
Private client galleries
We use client-account, gallery, selection and download information to provide secure viewing, purchasing and delivery, enforce package limits and protect images from unauthorised access. The lawful bases are contract and our legitimate interests in maintaining service security and protecting our work and clients.
Public portfolio and promotional image use
We do not regard booking a private session as automatic permission to publish the resulting photographs. Where consent is the appropriate basis, we ask separately before using identifiable client images on our website, social media, advertising, printed samples, exhibitions or competitions. Consent may be withdrawn as explained in our Image Disclaimer.
Marketing messages
We send optional email or text marketing where you have consented or where the law permits communication with an existing customer about similar services and a clear opt-out was offered. You can unsubscribe at any time. Service messages about a booking, payment or gallery are not marketing and are sent because they are needed to perform the contract.
Website operation, security and analytics
We use necessary technical information to operate and secure the website, prevent misuse and diagnose faults. With your cookie consent, we may use analytics or marketing technologies to measure visits and advertising. See our Cookie Policy.
6. Special-category information
Please avoid sending unnecessary medical or other sensitive information. If you voluntarily provide health information needed to adapt a session safely, we use it only for that purpose and with your explicit consent or another lawful condition where applicable. We do not infer health, ethnicity, religion, sexuality or other sensitive characteristics from photographs for profiling or marketing.
7. Who we share information with
We share only what is reasonably necessary with trusted recipients such as:
- website, database, backup, email and IT-support providers;
- PayPal and associated payment or fraud-prevention services;
- Google services used for email, calendar scheduling, maps, fonts, analytics or tag management;
- Meta where its marketing technology is enabled and you have consented;
- professional print laboratories, album makers, couriers and other fulfilment suppliers needed for your order;
- accountants, insurers, legal advisers and professional consultants;
- regulators, courts, law-enforcement bodies or other authorities where disclosure is required or lawfully necessary; and
- a purchaser or successor if the business is reorganised or transferred, subject to appropriate confidentiality and data-protection safeguards.
We do not sell client personal information or private gallery images.
8. International transfers
Some technology providers may process information outside the United Kingdom. Where this happens, we use providers and arrangements intended to protect the information in accordance with UK data-protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, as applicable.
You may contact us for more information about the safeguard relevant to a particular provider.
9. How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected. Our normal retention approach is:
- general enquiries that do not become bookings: up to 12 months after the last meaningful contact;
- booking, contract, payment and accounting records: normally six years after the relevant transaction or end of the client relationship;
- private online galleries: for the access period displayed to the client, normally 30 days once download access begins, unless an extension is agreed;
- working and delivered image files not selected for an approved public portfolio: normally up to 12 months after gallery access expires, unless a longer period is agreed or reasonably required for an order, complaint, insurance matter or legal claim;
- password-reset tokens: until used or expired, with limited security logs retained as reasonably necessary;
- marketing records: until you unsubscribe or consent is withdrawn, plus a minimal suppression record so that we respect the request; and
- images used with permission in a portfolio: while the permission remains valid and the work remains relevant, subject to withdrawal and any legal need to retain a record of earlier authorised use.
At the end of the relevant period, information is deleted, securely destroyed or anonymised. Backup copies may remain for a limited cycle before being overwritten.
10. Security
We use organisational and technical measures appropriate to the nature of the information, including access controls, private client accounts, password hashing, expiring reset links, limited download access, secure payment components, software maintenance and restricted administrative access.
No internet service can be guaranteed completely secure. Please use a unique password, keep gallery links private and tell us immediately if you suspect unauthorised access.
11. Your rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for access to your personal information;
- have inaccurate or incomplete information corrected;
- ask for information to be erased;
- restrict how information is used;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time where processing relies on consent; and
- complain to the Information Commissioner’s Office.
These rights are not absolute. For example, copyright ownership does not automatically change because a person shown in a photograph makes a data-protection request, and we may need to retain information required by law or for legal claims. We will explain the position if an exemption applies.
To exercise a right, email hello@zoomphotostudio.co.uk. We may need reasonable proof of identity and authority, particularly where a request concerns a child or another person.
12. Complaints
Please contact us first so that we can try to resolve a privacy concern. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or by telephoning 0303 123 1113.
13. Automated decisions
We do not make decisions about clients based solely on automated processing where those decisions have legal or similarly significant effects.
14. Changes to this statement
We may update this statement when our services, providers or legal obligations change. The latest version will be published on this page with a revised date.