Privacy Policy
Last updated: July 2026
This Privacy Policy explains how 'Lizzie Mayson LTD' collects, uses, stores and protects personal data when you visit this website, get in touch about a shoot or commission, or subscribe to our mailing list. It is written to comply with the UK GDPR and the Data Protection Act 2018.
We are the data controller for the personal data described below. If you have any questions about this policy or how your data is handled, you can contact us at:
Lizzie Mayson / Lizzie Mayson LTD, lizzie@lizziemayson.com.
1. What personal data we collect
Depending on how you interact with this site, we may collect:
- Enquiry and booking details: name, email address, phone number, company name, and any details you share about a project or shoot when you contact us via a form or email.
- Mailing list details: name and email address, if you choose to subscribe for updates, portfolio news, or availability.
- Client and commissioning data: billing name, address, and payment details needed to invoice for commissioned photography or licensing work (payment itself is processed securely by [your invoicing/payment provider, e.g. Stripe, GoCardless, or your accounting software]; we do not store full card details ourselves).
- Images of individuals: where a shoot involves people (for example, talent, chefs, or hosts on a commercial or editorial job), we process images under the terms agreed with the commissioning client or through a model release, rather than under this website policy. Ask us for a copy of the relevant release if you need it.
- Technical data: standard website analytics such as IP address, browser type, device type, and pages visited, collected automatically when you browse the site.
- Cookies: small files used to run the site and, where enabled, to understand how visitors use it. See Section 6 below.
We do not knowingly collect data from children, and this site is not directed at children.
2. How we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries about shoots, commissions, or licensing | Contract / legitimate interest (to respond to your request) |
| Invoicing and fulfilling a commissioned project | Contract |
| Sending newsletter or portfolio updates you've subscribed to | Consent |
| Keeping the site secure and diagnosing technical issues | Legitimate interest |
| Understanding how visitors use the site (analytics) | Consent (where analytics cookies require it) or legitimate interest |
| Complying with tax and accounting obligations | Legal obligation |
3. Who we share data with
We do not sell personal data. We share it only where necessary, with:
- Service providers who support the running of this website and business, such as our website host ([e.g. Squarespace / Wix / WordPress host]), email/mailing list provider ([e.g. Mailchimp / Flodesk]), and accounting or invoicing software ([e.g. Xero / QuickBooks / FreeAgent]).
- Commissioning clients and agencies (such as NCA at Rare), where enquiry or project details need to be shared to deliver a job.
- Professional advisers, such as an accountant, where needed for tax and legal compliance.
Where a service provider is based outside the UK or EU (for example, some email or hosting platforms are US-based), we rely on their standard contractual clauses or equivalent safeguards to ensure your data is protected to UK standards.
4. How long we keep your data
- Enquiry details that don't turn into a booking are kept for up to [12 months], then deleted.
- Client and invoicing records are kept for as long as required by HMRC (currently six years) for accounting purposes.
- Mailing list details are kept until you unsubscribe or request deletion.
- Analytics data is retained according to the settings of our analytics provider (typically 14 to 26 months).
5. Your rights
Under the UK GDPR, you have the right to:
- Ask what personal data we hold about you and receive a copy (right of access)
- Ask us to correct inaccurate data (right to rectification)
- Ask us to delete your data, where there's no legal reason for us to keep it (right to erasure)
- Ask us to restrict or object to how your data is used, including for marketing (right to restrict / object)
- Receive your data in a portable format, where relevant (right to data portability)
- Withdraw consent at any time, where consent is the basis for processing (for example, unsubscribing from the mailing list)
- Complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data: ico.org.uk
To exercise any of these rights, email us at [your email address].
6. Cookies
This site uses cookies to help it function and, where enabled, to understand visitor behaviour. You can control or delete cookies through your browser settings at any time. [If you use a cookie consent banner, insert a line here noting that visitors can manage preferences via the banner, and add a link to a separate Cookie Policy if you have one.]
7. Security
We take reasonable technical and organisational steps to protect the personal data we hold, including secure hosting, restricted access to client records, and use of reputable third-party platforms for payments and email. No method of transmission over the internet is completely secure, so we can't guarantee absolute security, but we work to protect your data appropriately.
8. Changes to this policy
We may update this policy from time to time, for example if we change website providers or add new data collection features. The "last updated" date at the top will reflect the most recent version.