Privacy

Privacy Policy

Last updated: 2026-05-11

Who we are

This site is operated by Anna Zhmaylik Photography, a photography business based in Milton Keynes, United Kingdom. For the purposes of UK GDPR, the data controller is Anna Zhmaylik. You can contact the controller at anna@anna-photo.co.uk.

What we collect

When you submit the contact form on this website we collect:

• Your name
• Your email address
• Your phone number (optional)
• The service you're interested in
• Your event date (optional)
• Your venue or location (optional)
• The message you write
• The IP address and basic technical metadata of your request (for spam protection)

We do not use third-party advertising trackers or cookies for marketing. The site uses two analytics providers: Cloudflare Web Analytics (aggregate, cookieless) and Google Analytics 4. Google Analytics 4 sets first-party cookies (the _ga family) to count returning visitors, measure traffic sources, and understand which pages people visit. IP addresses are anonymised by Google before storage and are not shared with us in raw form. We never join analytics data with the enquiry form data above.

Why we collect it

To respond to your enquiry, prepare a quote, and (if you book) to deliver your photography session. The lawful basis under UK GDPR Article 6(1)(b) is "performance of a contract or pre-contractual steps at your request"; for spam-protection metadata it is Article 6(1)(f) "legitimate interests" (preventing automated abuse of the contact form).

How long we keep it

• Enquiries that don't lead to a booking: deleted after 90 days.
• Enquiries that lead to a booking: kept for the duration of the engagement plus seven years afterwards (HMRC retention requirement for transaction records).
• Photographs from sessions you booked: retained for at least the time needed to deliver your gallery and any reasonable follow-up requests (typically a few months). Beyond that, retention is at Anna's discretion — some photos may be kept longer for portfolio, marketing, or archival use (in line with the model release / consent agreed at booking); others may be deleted. We make no specific commitment to keep your photographs for any minimum or maximum period beyond delivery. If you want a copy preserved long-term, please download your gallery while it is available. You can also request deletion at any time — see "Your rights" below.
• Spam-protection metadata: automatically discarded after 30 days.

Who we share it with

Your data is shared only with the third-party processors required to operate the site and respond to enquiries:

• Resend (resend.com) — sends the enquiry email to Anna and the auto-confirmation back to you.
• Cloudflare (cloudflare.com) — hosts the website, runs spam protection (Turnstile), and stores the form-handler logs for short-term troubleshooting.
• Google — (a) Google Analytics 4, which sets first-party cookies to measure site traffic; (b) only if you find us via the Google Business Profile and choose to leave a review there. Google's privacy policy applies to both interactions.

We do not sell, rent, or share your data for marketing.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data ("rectification")
• Have your data deleted ("erasure", subject to the HMRC retention rule above)
• Restrict or object to how we process your data
• Receive your data in a portable format
• Withdraw any consent you've given
• Lodge a complaint with the ICO (Information Commissioner's Office)

To exercise any of these rights, email anna@anna-photo.co.uk. We aim to respond within 30 days.

Cookies

This site uses no marketing cookies. The cookies that may be set are:

• Google Analytics 4 sets first-party _ga and _ga_<property-id> cookies (typical lifetime two years) to count returning visitors and measure aggregate site usage. No personal identifiers are stored.
• Cloudflare Turnstile may set a single technical cookie to verify that the contact-form submission is from a real browser; this cookie is essential to spam protection and contains no tracking identifiers.

You can block or delete cookies at any time via your browser settings; doing so will not affect your ability to use the site or submit an enquiry.

Children

Photography sessions involving children are booked by their parent or guardian, who provides consent for any photographs and any decision about how those photographs may be used (private family use, portfolio use, etc.). The contact form is not intended for use by anyone under 16 acting alone.

How to complain

If you believe we have not handled your data lawfully you can contact the UK regulator, the Information Commissioner's Office, at ico.org.uk or by phone on 0303 123 1113.

Changes to this policy

We may update this policy occasionally. Material changes will be reflected in the "Last updated" date at the top. For substantive changes affecting how we handle existing enquiry data, we'll email anyone with an active enquiry.