Privacy Policy
1. Who We Are
The Headshot Guy (UK) Limited is a corporate headshot photography company. We are registered in England, company number 09305707.
Registered office: TOR, Saint-Cloud Way, Maidenhead SL6 8BN.
We are registered with the Information Commissioner’s Office (ICO), registration number ZA095589.
Our data protection lead is John Cassidy, Director. You can contact him at info@theheadshotguy.co.uk or on 020 3011 0394.
2. Who This Policy Covers
- People who visit our website or send us an enquiry
- People who book or organise a shoot, and the companies they work for
- People we photograph, at their office, at an event, in our studio or remotely
- People who subscribe to our weekly email, Your Weekly Dose of Mental Sunshine
3. What We Collect
- Contact details: name, work email, phone number, job title and company
- Shoot details: your booking time, the location and any style preferences
- Your photographs: the images we take, and the versions we edit for you
- Order and payment details: what you order, invoices and payments. We do not store card details. Card payments are handled by Stripe or PayPal.
- Website data: basic information about how you use our site, collected through cookies (see section 12)
We do not ask for sensitive information such as health, religion or ethnicity.
4. How We Use Your Data
| What we do | Why we are allowed to |
|---|---|
| Answer your enquiry and send a quote | To take steps you have asked for before a contract |
| Schedule, photograph, edit and deliver your images | To carry out our contract with you or your employer |
| Send invoices and keep accounts | Legal obligation (tax and company law) |
| Send occasional updates about headshots to people who book shoots | Our legitimate interest in keeping clients informed. You can opt out at any time |
| Send Your Weekly Dose of Mental Sunshine | Your consent, given when you sign up |
| Improve our website | Our legitimate interest, and your cookie choices |
We never sell your data. We never use it to train AI.
We only use your photographs in our own marketing with written permission from you, and from your employer for a corporate shoot.
5. Corporate Shoots: Your Employer Is In Charge
When your employer books a team or event shoot, your employer is the controller of your data and we are the processor. That means we only use your name, email and photographs to run that shoot, on your employer’s instructions.
If you want to see, correct or delete your data from a corporate shoot, you can ask your employer or us. If you ask us, we tell your employer within 2 working days and help them reply within one month.
For individual studio and remote shoots you book yourself, we are the controller.
6. Who We Share Your Data With
We only share what each supplier needs to do its job, and we require every supplier to keep it secure and confidential.
- Our associate photographers, who are bound by our associate agreement
- Our freelance editors. Images we send for editing carry no names or client details
- Gallery and ordering platforms (GotPhoto, Headshot Tools), so you can view and choose your images
- Booking system (OnceHub), so you can pick your shoot time
- Image storage and transfer (Dropbox)
- Retouching software (Evoto)
- Email, newsletter and client records (Google Workspace, ActiveCampaign, Salesforce)
- Accounts (Xero), and our accountants
- Payments (Stripe, PayPal)
- Professional advisers such as lawyers and insurers, where needed
We tell a corporate client which suppliers will handle their data before the shoot, when they ask or when their contract requires it.
7. Data Stored Outside The UK
Some of our suppliers store data outside the UK, including in the EU and the USA.
When data leaves the UK, we make sure it is protected in one of these ways:
- The country has a UK adequacy decision, as the EU does
- The supplier is certified under the UK Extension to the EU-US Data Privacy Framework
- We have a UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, with the supplier
We will not send a corporate client’s data outside the UK without their prior written approval, where their contract requires it.
8. How Long We Keep It
| Data | How long |
|---|---|
| Online galleries | 18 months after the shoot |
| Unedited (raw) images | 5 years after the shoot, then deleted |
| Edited images we have delivered | Kept so we can resupply lost or replacement files for as long as you, or your employer, remain a client. Deleted sooner on request |
| Names and emails used to run a shoot | 5 years after the shoot, then deleted |
| Invoices and accounting records | 6 years, as tax law requires |
| Enquiries that did not lead to a booking | 2 years after the last contact |
| Newsletter subscription | Until you unsubscribe |
You, or your employer for a corporate shoot, can ask us to delete your data sooner. We do it within 30 days and confirm in writing, unless the law requires us to keep it.
9. Marketing Emails
We only send Your Weekly Dose of Mental Sunshine if you sign up for it.
People who book shoots may receive occasional updates about headshots and studio dates.
Every email has an unsubscribe link. You can also email info@theheadshotguy.co.uk to opt out.
We never add the people we photograph at a corporate shoot or event to a marketing list unless they ask to join.
10. How We Keep Your Data Safe
- Two-factor sign-in on our email, file storage and gallery accounts
- Password-protected, encrypted laptops
- Memory cards cleared once images are safely uploaded and backed up
- Private galleries, sent only to the person photographed or to the client’s chosen contact
- Access to client folders limited to the people working on that shoot
- Associates must delete client data when their work with us ends
If a data breach happens, we tell the affected client within 24 hours. Where we are the controller and the law requires it, we report it to the ICO within 72 hours.
11. Your Rights
You have the right to:
- Ask for a copy of the data we hold about you
- Ask us to correct it
- Ask us to delete it
- Ask us to limit how we use it, or object to how we use it
- Ask us to move it to another organisation
- Withdraw your consent at any time, where we rely on consent
Email info@theheadshotguy.co.uk. There is no charge. We reply within one month.
12. Cookies
Our website uses cookies. You can accept or decline non-essential cookies when you first visit. Our Cookie Policy explains which cookies we use and why.
13. Complaints
Please contact us first at info@theheadshotguy.co.uk so we can put things right.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
14. Changes To This Policy
We review this policy every year, and sooner if the law or our suppliers change.
Last updated: 26 October 2026.