Sarah Johnson Photography / Say Yes To Being Seen®
How I look after personal information when you enquire, book photography or coaching, attend an event or sign up for updates.
I only collect information that has a real purpose for the work we do.
Newsletter, optional AI notes and promotional image use have their own safeguards.
You can ask about your data, object to some uses or request a correction.
I want you to feel comfortable sharing your information with me.
If something isn't clear, just email sarah@sarahjohnsonphotography.co.uk and I'll help.
This policy applies to Sarah Johnson Photography, Say Yes To Being Seen® and North East Pet Photographer where I provide the service and decide how personal information is used.
Data controller: Sarah Johnson, trading as Sarah Johnson Photography, based in County Durham, England.
Email: sarah@sarahjohnsonphotography.co.uk
Website: sarahjohnsonphotography.co.uk
If you have a question about how I use your data, or want to exercise your privacy rights, please contact me at the email address above.
It covers contact through my website, email, social media and enquiry forms; photography and pet photography bookings; business coaching; consulting, websites and marketing support; events, retreats and workshops; my shop and digital resources; newsletters; and online meetings.
It applies to information handled both online and offline. Websites, apps and other providers that I link to may have separate privacy notices.
Please don't send health or other especially sensitive information unless it is necessary for the service and we've discussed how it will be handled.
| Purpose | Usual lawful basis |
|---|---|
| Responding to enquiries and preparing a quote | Steps requested before a contract, or legitimate interests in responding to genuine enquiries. |
| Booking, delivering photography, coaching, events, workshops or business support | Performance of a contract or steps taken at your request before a contract. |
| Payments, accounting, tax and legally required records | Legal obligation, and contract where applicable. |
| Business administration, fraud prevention, reasonable security and improving services | Legitimate interests, balanced against your rights and expectations, or legal obligation where applicable. |
| Optional newsletters and promotions | Consent, or another basis where the relevant UK electronic marketing rules permit it. You can opt out of marketing at any time. |
| Optional AI-assisted meeting transcription and notes | Appropriate lawful basis and privacy information determined before use; separate choice/consent where required. |
| Event and portfolio photography used in my own marketing | Appropriate lawful basis assessed for the specific use; consent sought when required and objections considered. |
Where I rely on legitimate interests, those interests include operating and improving my small business, answering enquiries, protecting systems and documenting my professional work. You can object to processing based on legitimate interests in certain circumstances.
Photographs or video are a central part of my work. Commissioned client images are captured, edited, stored and delivered to fulfil the photography service. Finished images may be delivered through a private client gallery.
Photography and filming may also take place during my events, co-working sessions and retreats. I provide notice where filming is planned and ask attendees who would prefer not to appear to tell me. I make reasonable efforts to respect preferences and objections. A booking terms checkbox does not automatically mean that everyone has consented to every promotional use of their image.
If I wish to use a client image, testimonial or identifiable event photograph for my own portfolio, social media, website or advertising, I consider the appropriate lawful basis and seek separate permission where required. Please contact me if you have concerns about a particular image.
For children and family photography, I take additional care over consent, permissions and safeguarding, and do not knowingly collect children's data for direct marketing.
Coaching conversations may involve personal experiences, health, grief, relationships or other sensitive subjects. I ask clients to share only what is relevant and handle what is shared with appropriate confidentiality and security.
Some information may be classed as special category personal data under the UK GDPR. Where I need to process such information, I must identify both a lawful basis and a separate applicable special-category condition, such as explicit consent where appropriate. I will not rely on acceptance of a general contract as blanket consent to process sensitive information.
In a group event, I ask attendees to respect one another's privacy, although I cannot guarantee confidentiality between participants.
For some coaching, planning and training sessions, I may offer meeting transcription or AI-assisted notes. These can help me prepare summaries, practical instructions, agreed action points and follow-up resources.
AI-assisted transcription is optional. Before switching it on, I will explain the tools involved, the information they process, relevant safeguards and retention arrangements, and ask for a separate agreement where consent is required. You can decline transcription and still access the underlying service.
AI-generated notes are reviewed by me before being shared. Video recording is a separate activity and will be explained and agreed where required. Please avoid introducing other people's confidential or sensitive information into recordings without a suitable basis.
I use trusted service providers to run my business. Depending on the service, these may include:
I share only information reasonably necessary for the purpose and do not sell clients' personal information to advertisers.
Some of the technology providers used by my business operate or store information outside the UK. Where a restricted international transfer takes place, I must ensure that a valid transfer mechanism and appropriate safeguards apply, such as UK adequacy regulations or contractual transfer safeguards, as appropriate.
You can contact me for information about the relevant providers and safeguards for a particular service. The current provider locations and contractual arrangements should be checked before this policy is activated.
I keep personal information only for as long as it is reasonably needed for the purpose collected, to meet legal obligations or to handle potential claims.
Specific retention periods are reviewed according to record type and the legal requirements that apply.
I use appropriate account security, access controls, provider safeguards and working practices to protect information. No online system can be guaranteed completely secure.
Where I share a private gallery, form or link, please avoid forwarding access to anyone who does not need it. If you believe information has been sent to the wrong person or exposed, contact me promptly.
If you subscribe to my newsletter, I may send updates about photography, coaching, retreats, co-working, resources and practical business tips. You can unsubscribe using the link in the email or by contacting me.
Booking confirmations, invoices, appointment reminders and essential service information are not the same as optional marketing. Event attendance alone does not automatically mean you are subscribed to marketing emails.
My website may use essential cookies for security, forms, shopping baskets and bookings, as well as optional technologies for analytics, embedded content or advertising.
Read the separate Cookie Policy for more information. Optional tracking must be configured in accordance with the applicable UK cookie rules. Your choices should be managed through the website's cookie preference controls once those controls have been verified.
Depending on the circumstances and lawful basis, you may have rights to access your information, have inaccuracies corrected, request erasure, restrict processing, object to certain uses, receive portable information, and withdraw consent where processing relies on consent.
You can also object to direct marketing at any time. To exercise a right, email sarah@sarahjohnsonphotography.co.uk. I will respond within the period required by law, subject to any permitted extensions or exemptions.
If you are unhappy with my response, you can complain to the Information Commissioner's Office (ICO).
I may update this Privacy Policy when services, suppliers or the law change. The date at the top of this page shows the current version. Material changes will be explained where appropriate.
I'm happy to explain how information is used, or help with a privacy-related request.