GDPR Compliance

Last updated: July 2026

Our Commitment to Data Protection

We are committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations.

Data Controller Information

For the purposes of UK GDPR, the data controller is:

Business name: willow-soar
Address: Studio 14, Riverside Business Centre, 42 Merchant Street, Bristol BS1 3NX, United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

Contract Performance

Processing is necessary to fulfill our contractual obligations when you engage our photography services, including scheduling, service delivery, and project communication.

Legitimate Interests

We process data where necessary for legitimate business interests, including:

• Responding to inquiries and providing customer service
• Operating and improving our website and services
• Fraud prevention and security
• Internal record keeping and business analytics

Consent

Where required, we obtain explicit consent for specific processing activities such as marketing communications or non-essential cookies.

Legal Obligation

Processing necessary to comply with legal requirements, including tax obligations, accounting regulations, and response to lawful requests from authorities.

Your Data Protection Rights

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information within one month of receiving a valid request.

Right to Rectification

If you believe personal data we hold is inaccurate or incomplete, you can request correction or completion.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including:

• Data no longer necessary for original purpose
• You withdraw consent and no other legal basis exists
• You object to processing and no overriding legitimate grounds exist
• Data has been unlawfully processed

Right to Restriction of Processing

You can request we limit how we use your data in specific situations:

• While we verify accuracy of disputed data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• While we verify legitimate grounds following your objection

Right to Data Portability

Where processing is based on consent or contract performance and carried out by automated means, you can request your data in structured, commonly used, machine-readable format and have it transferred to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not currently use automated decision making or profiling that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected] with:

• Clear description of your request
• Identification verification (to protect your data from unauthorized access)
• Any relevant reference numbers or dates

We will respond within one month. In complex cases, this may be extended by two additional months with notification and explanation.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security:

• Encrypted data transmission and storage
• Access controls limiting employee data access to role requirements
• Regular security audits and vulnerability assessments
• Secure backup procedures
• Staff training on data protection obligations
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR.

International Data Transfers

Our primary operations are within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place through:

• Adequacy decisions recognizing equivalent data protection standards
• Standard contractual clauses approved by regulatory authorities
• Other mechanisms recognized under UK GDPR

Third-Party Processors

We work with carefully selected third-party service providers who process data on our behalf. These processors are contractually bound to:

• Process data only according to our documented instructions
• Maintain appropriate security measures
• Assist with fulfilling data subject rights
• Delete or return data upon service termination

Data Retention

We retain personal data only as long as necessary for stated purposes:

• Active clients: Duration of service relationship plus 36 months
• Inquiries not converted: 24 months from last contact
• Financial records: As required by UK tax and accounting law
• Marketing consent: Until consent withdrawn or 48 months of inactivity

Children's Data

Our services are not directed to individuals under 16. We do not knowingly collect or process data from children without appropriate parental consent.

Complaints and Supervisory Authority

If you believe we have not handled your data in accordance with UK GDPR, you can lodge a complaint with:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Policy Updates

We review and update our GDPR compliance measures regularly. Material changes to how we process personal data will be communicated through website updates and, where appropriate, direct notification to affected individuals.

Contact for Data Protection Matters

For questions about our data protection practices or to exercise your rights, contact:

Email: [email protected]
Subject line: GDPR Inquiry