Privacy Policy

1. Introduction

Good Mews Studio ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you use our website and services, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

Good Mews Studio is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or how we handle your data, please contact us at: hello@goodmews.studio

3. Information We Collect

We collect the following types of personal data:

3.1 Information You Provide

• Contact Information: Name, email address, phone number
• Professional Information: Spotlight ID, agent details, Instagram handle
• Booking Information: Service type, preferred dates and times, special requirements
• Payment Information: Processed securely through Stripe (we do not store full card details)
• Referral Information: How you heard about us

3.2 Information Collected Automatically

• Usage Data: Pages visited, page load times, time spent on site, navigation paths, click interactions, referral sources
• Device Information: IP address (anonymised), browser type and version, operating system, device type, screen resolution, geolocation data (country/city level only)
• Performance Metrics: Core Web Vitals, page load performance, interaction latency, visual stability metrics
• Cookies and Similar Technologies: See our Cookie Policy section below for detailed information

This information is collected through Vercel Analytics and Vercel Speed Insights, which operate in compliance with UK GDPR. These services do not use persistent identifiers and do not track users across other websites.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: To fulfil our photography services contract with you
• Legitimate Interests: To improve our services, prevent fraud, and communicate about our business
• Legal Obligation: To comply with accounting, tax and legal requirements
• Consent: For marketing communications (you can withdraw consent at any time)

5. How We Use Your Information

We use your personal data to:

• Process and manage your bookings
• Communicate with you about your booking, including confirmations and reminders
• Process payments and prevent fraud
• Provide customer support
• Send you marketing communications (with your consent)
• Improve our website and services
• Comply with legal obligations

6. Information Sharing

We may share your personal data with:

• Payment Processors: Stripe for secure payment processing
• Email Service Providers: Resend for sending booking confirmations and communications
• Cloud Service Providers: Supabase for secure data storage
• Analytics Providers: Vercel Analytics and Vercel Speed Insights to understand how our website is used and to monitor performance
• Advertising Partners: We may share data with advertising platforms in the future (subject to your consent)
• Legal Authorities: When required by law or to protect our rights

We do not sell your personal data to third parties. All third-party processors are carefully selected and bound by data protection agreements.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Booking Data: 7 years (for accounting and tax purposes)
• Marketing Data: Until you unsubscribe or request deletion
• Images/Photos: As specified in your booking agreement

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing at any time

To exercise any of these rights, please contact us at hello@goodmews.studio. We will respond within one month.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes:

• SSL/TLS encryption for data transmission
• Secure cloud storage with encryption at rest
• Regular security audits and updates
• Access controls and authentication
• Staff training on data protection

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and UK GDPR. A cookie is a small text file stored on your device that allows us to recognise your browser and capture certain information.

10.1 Types of Cookies We Use

10.2 Third-Party Cookies

Some cookies are placed by third-party services that appear on our pages:

• Vercel (Analytics & Speed Insights): Performance monitoring and analytics services that comply with UK GDPR and do not sell or share personal data with third parties for advertising purposes
• Stripe: Payment processing services that may set cookies during checkout (subject to Stripe's privacy policy)

10.3 Managing Your Cookie Preferences

You have the right to accept or refuse cookies. You can exercise your cookie preferences through:

• Cookie Banner: When you first visit our site, you can accept or decline non-essential cookies
• Browser Settings: Most browsers allow you to refuse cookies through their settings. Please note that disabling strictly necessary cookies may prevent certain website features from functioning
• Opt-Out Links: You may opt out of performance cookies by declining consent in our cookie banner

10.4 Cookie Retention Periods

Different cookies have different retention periods:

• Session Cookies: Deleted when you close your browser
• Persistent Cookies: Remain on your device until expiry or manual deletion (typically 1 year maximum)
• Analytics Cookies: Retained for the duration necessary to provide analytics services (typically 1 year maximum)

For more information about cookies and how to manage them, visit www.allaboutcookies.org or ico.org.uk/cookies.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.

12. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

13. International Transfers

Some of our service providers may be located outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through a notice on our website. The "Last updated" date at the top of this policy indicates when it was last revised.

15. Complaints

If you have concerns about how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Good Mews Studio
Email: hello@goodmews.studio
2, The Mews, Alston Works, EN5 4EL