Privacy Policy — Memories by Maria

Privacy Policy

Memories by Maria  |  memoriesbymaria.co.uk  |  Last updated: April 2026

This Privacy Policy explains how Memories by Maria collects, uses, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Memories by Maria is a professional photography business based in Edinburgh, United Kingdom, operated by Maria. We provide pregnancy, newborn, baby, birthday, family, outdoor, Christmas, and bespoke photography sessions.

Business address: Edinburgh, United Kingdom
Contact e-mail: info@memoriesbymaria.co.uk
Website: memoriesbymaria.co.uk

For the purposes of data protection law, Memories by Maria is the data controller responsible for your personal data.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

  • Contact information — your full name, e-mail address, phone number, and postal address.
  • Booking details — session type, preferred date and location, and any special requests.
  • Photographs and images — images taken during your photography session, which may include images of children and newborns.
  • Payment information — transaction records and invoice details. We do not store card details directly; payments are processed through secure third-party providers.
  • Communications — any e-mails, messages, or enquiry form submissions you send to us.
  • Website usage data — IP address, browser type, pages visited, and time on site, collected via cookies (see Section 8).

3. How We Collect Your Data

We collect your personal data when you:

  • Fill in the contact or booking enquiry form on our website;
  • Send us an e-mail or message directly;
  • Book or attend a photography session;
  • Purchase digital images or printed products from us;
  • Subscribe to our newsletter or special offer communications;
  • Follow or interact with us on social media platforms (Facebook, Instagram).

4. Why We Use Your Data (Legal Bases)

We process your personal data on the following legal bases under UK GDPR:

  • Performance of a contract — to process bookings, deliver session files, and issue invoices.
  • Legitimate interests — to respond to enquiries, manage our client relationships, and improve our services.
  • Legal obligation — to retain financial and business records as required by HMRC and UK law.
  • Consent — to share photographs on our website, social media, or marketing materials where your images are identifiable. You may withdraw consent at any time.

5. Special Category Data — Children and Newborns

A significant part of our work involves photographing children, including newborns, and pregnant clients. Where sessions involve minors, we require explicit written consent from a parent or legal guardian before any images are taken or used.

Images of children will never be shared publicly without the express written consent of their parent or guardian. Consent can be withdrawn at any time by contacting us at info@memoriesbymaria.co.uk.

6. How We Use Your Data

We use your personal data to:

  • Process session bookings and respond to enquiries;
  • Deliver your photographs via secure gallery links or physical products;
  • Send booking confirmations, reminders, and follow-up communications;
  • Issue invoices and process payments;
  • Showcase our work on our website, portfolio, and social media (with consent);
  • Inform you of special offers, promotions, or new services (only where you have consented);
  • Comply with legal and financial record-keeping obligations.

7. How Long We Keep Your Data

  • Client records and invoices — retained for 7 years in compliance with HMRC requirements.
  • Photographs — digital files are held for a reasonable period following delivery, after which they are securely deleted unless you have purchased an archive or storage package.
  • Enquiry data (non-clients) — deleted within 12 months if no booking is made.
  • Marketing data — held until you unsubscribe or withdraw consent.

8. Cookies

Our website uses cookies to improve your browsing experience. Cookies are small text files stored on your device.

We use the following types of cookies:

  • Essential cookies — required for the website to function correctly.
  • Analytics cookies — we use Google Analytics to understand how visitors use our site (anonymised data). You can opt out at tools.google.com/dlpage/gaoptout.
  • Marketing cookies — if applicable, for Facebook Pixel or similar retargeting tools.

You can manage or disable cookies in your browser settings at any time. Please note that disabling cookies may affect the functionality of the website.

9. Sharing Your Data

We do not sell or rent your personal data to third parties. We may share your data with:

  • Online gallery providers — secure platforms used to deliver your photographs privately.
  • Payment processors — secure third-party services used to handle transactions.
  • E-mail service providers — used for booking confirmations and newsletters where applicable.
  • HMRC and legal authorities — where required by law.

All third-party providers are required to handle your data securely and in accordance with applicable data protection law.

10. Data Security

We take the security of your personal data seriously. All images are stored on password-protected devices and cloud storage platforms with appropriate access controls. Client galleries are delivered via secure, private links. We regularly review our security practices to minimise the risk of unauthorised access, loss, or disclosure.

11. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access — to request a copy of the personal data we hold about you.
  • Right to rectification — to request correction of inaccurate data.
  • Right to erasure — to request deletion of your data, subject to legal obligations.
  • Right to restrict processing — to ask us to limit how we use your data.
  • Right to data portability — to receive your data in a structured, machine-readable format.
  • Right to object — to object to processing based on legitimate interests or direct marketing.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@memoriesbymaria.co.uk. We will respond within 30 days.

12. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO.

13. Third-Party Links

Our website may contain links to external websites such as our Facebook or Instagram pages. This Privacy Policy does not apply to those external sites. We encourage you to read their own privacy policies before submitting any personal data.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most recent version will always be available on our website at memoriesbymaria.co.uk. The date at the top of this page indicates when the policy was last updated.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: