Personal Information
& Data Protection

Personal information is handled in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018 and relevant amendments introduced by the Data (Use and Access) Act 2025.

I aim to ensure that personal information is:

• used lawfully, fairly and transparently;
• collected for clear and legitimate purposes;
• limited to what is reasonably necessary;
• accurate and kept up to date where appropriate;
• retained only for as long as reasonably necessary;
• kept secure; and
• handled in a way that respects your legal rights.

Depending on the nature of our relationship, I may collect and process information including:

• your name;
• job title or professional role;
• organisation or company name;
• postal address;
• email address;
• telephone number;
• billing and payment information;
• correspondence relating to bookings, commissions or licences;
• production, event or project information;
• contractual and licensing information;
• information necessary for safeguarding or legal compliance;
• photographs where those photographs constitute personal information;
• technical information submitted through the website, where applicable; and
• any other information you choose to provide when contacting Steve Gregson Photography.

I do not intentionally collect personal information that is unnecessary for the work being undertaken.

Information may be collected:

• directly from you;
• through email, telephone or other correspondence;
• when you request a quotation or make a booking;
• during the administration and delivery of photographic services;
• through contracts, licences and invoices;
• from a theatre, production company, school, agency or other organisation for which you work;
• through professional or publicly available sources where appropriate; and
• through the website when you contact Steve Gregson Photography.

I may use personal information in order to:

• respond to enquiries;
• prepare quotations and confirm bookings;
• provide photographic services;
• administer projects and commissions;
• communicate with clients, venues, creatives and other project participants;
• deliver and license photographs;
• issue invoices and maintain financial records;
• administer copyright and image-licensing arrangements;
• maintain appropriate business and customer records;
• fulfil legal, regulatory, accounting and tax obligations;
• protect the security and integrity of the business and its systems;
• establish, exercise or defend legal rights;
• manage safeguarding obligations where applicable;
• maintain an accurate professional archive; and
• promote Steve Gregson Photography where there is an appropriate lawful basis for doing so.

I will not use personal information for purposes that are incompatible with the purpose for which it was originally collected unless there is a lawful basis for doing so.

Depending on the circumstances, I may rely on one or more lawful bases for processing personal information.

These may include:

Examples may include maintaining customer records, administering commissions, protecting copyright, maintaining business security and carrying out appropriate business communications.

Where processing is based on consent, you may withdraw that consent at any time.

The ICO requires organisations to identify a valid lawful basis for processing and to be clear about the purposes for which personal information is used.

Photographs may constitute personal information where an individual can be identified.

Photography undertaken by Steve Gregson Photography is generally created in connection with professional theatre, performance, education, publicity, editorial or commissioned photographic activity.

Responsibility for obtaining any production-specific permissions, performer permissions, parental or guardian consents, performance licences or similar authorisations may depend upon the nature of the commission and the contractual arrangements between Steve Gregson Photography and the commissioning organisation.

Where children or young people are photographed, Steve Gregson Photography also operates in accordance with its Safeguarding & Child Protection Policy.

I will only send direct marketing communications where there is an appropriate lawful basis for doing so.

Where consent is relied upon, you may withdraw it at any time.

You may also ask at any time not to receive marketing communications from Steve Gregson Photography.

Personal information may be shared where reasonably necessary with organisations or individuals involved in providing or supporting the services you have requested.

These may include:

• production companies;
• theatres and venues;
• agents or representatives;
• printers, reprographics providers or image-delivery services;
• accountants and professional advisers;
• IT, hosting and technical service providers;
• payment or financial service providers where applicable;
• regulatory, legal or public authorities where disclosure is required by law; and
• other service providers acting on behalf of Steve Gregson Photography.

Only information reasonably necessary for the relevant purpose will be shared.

Where third parties process personal information on behalf of Steve Gregson Photography, reasonable steps will be taken to ensure appropriate confidentiality and data-protection arrangements are in place.

Some technology or service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, I will take reasonable steps to ensure that the transfer is made using an appropriate legal mechanism and that the information continues to receive an appropriate level of protection.

Personal information will not be retained for longer than reasonably necessary.

Different types of information may need to be retained for different periods depending on:

• the nature of the commission;
• contractual obligations;
• copyright and licensing records;
• safeguarding requirements;
• insurance requirements;
• accounting and taxation obligations;
• potential legal claims; and
• legitimate archival or business-record purposes.

Financial and contractual records may therefore be retained for longer than general correspondence.

Where information is no longer required, it will be securely deleted, destroyed or anonymised where reasonably practicable.

Steve Gregson Photography maintains a professional photographic archive documenting productions, performances and commissions.

Photographs and associated production information may be retained for long-term professional, historical, artistic, evidential and copyright-management purposes.

Where personal information is retained as part of that archive, it will be handled in accordance with applicable data protection law.

Reasonable technical and organisational measures are used to protect personal information against:

• unauthorised access;
• unlawful use;
• accidental loss;
• alteration;
• disclosure; and
• destruction.

Access to personal information is limited to those who reasonably require it for legitimate business purposes.

No internet-based system can be guaranteed to be completely secure, but appropriate precautions are taken to protect information under my control.

Depending on the circumstances, UK data protection law may give you rights including the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of information in certain circumstances;
• request restriction of processing;
• object to certain forms of processing;
• object to direct marketing;
• request transfer of information in certain circumstances;
• withdraw consent where consent is relied upon; and
• raise a concern about how your personal information has been handled.

These rights are not absolute and may be subject to exemptions or other lawful reasons for continuing to process or retain information.

If you wish to exercise any data-protection right or ask what personal information Steve Gregson Photography holds about you, please contact:

I may need to verify your identity before responding to a request.

If you have concerns about the way your personal information has been handled, please contact Steve Gregson Photography first so that the issue can be investigated.

You also have the right to raise a complaint with the UK Information Commissioner's Office where applicable.

The website may use cookies or similar technologies that are necessary for its operation or used to understand how the website performs.

Where non-essential cookies or similar technologies requiring consent are introduced, appropriate information and consent controls will be provided.

This website may contain links to third-party websites, including theatres, venues, organisations and creative professionals.

Steve Gregson Photography is not responsible for the privacy practices, security or content of external websites.

This Privacy Policy may be updated from time to time to reflect changes in the website, business practices, technology or applicable law.

The latest version will be published on this website with an updated review date.