Privacy Policy
Kaileidoscope Photography
Last updated: 19 July 2026
1. Who I am
Kaileidoscope Photography is operated by Kai Glover, trading as Kaileidoscope Photography.
For most of the personal information covered by this Privacy Policy, I am the data controller. This means that I decide why and how that information is used.
Business owner: Kai Glover
Trading name: Kaileidoscope Photography
Email: kai@kaileidoscope.photography
Telephone: +44 7713 990920
Website: kaileidoscope.photography
Correspondence address:
You can use the contact details above to ask a privacy question, exercise a data-protection right or make a complaint about how your information has been handled.
2. Who this Privacy Policy applies to
This Privacy Policy applies to:
* people who visit my website;
* people who submit an enquiry or contact form;
* prospective, current and previous clients;
* people who appear in photographs or videos;
* parents and guardians;
* business and personal-branding clients;
* wedding clients, guests and suppliers;
* family, maternity, newborn, couple and portrait clients;
* pet owners;
* venue owners and representatives;
* models and other session participants;
* people who access an online gallery;
* people who purchase photographs or products;
* suppliers and professional contacts; and
* anyone who contacts me about privacy, a complaint or a legal matter.
It applies whether information is collected through my website, Pixieset, email, telephone, messaging services, social media, a questionnaire, a contract, a model release, an online gallery, an order, in person or during a photography session.
3. Information I may collect
Depending on how you interact with Kaileidoscope Photography, I may collect the following information.
3.1 Identity and contact information
This may include:
* your name;
* postal address;
* email address;
* telephone number;
* business or trading name;
* job title;
* social-media username; and
* the identity of an authorised representative.
3.2 Enquiry and booking information
This may include:
* the type of photography you are interested in;
* proposed dates and locations;
* session requirements;
* information submitted through contact forms and questionnaires;
* quotations;
* contracts;
* booking records;
* model and property releases;
* invoices;
* payment status;
* correspondence;
* reference images;
* mood boards;
* shot lists; and
* information about your preferred photographic style.
3.3 Photographs and related information
This may include:
* photographs and video captured during a session;
* image file names;
* dates and times;
* camera metadata;
* image selections;
* editing notes;
* gallery favourites;
* download records;
* image-use permissions;
* portfolio choices; and
* records of commercial licences.
An identifiable photograph may constitute personal information depending on its content, purpose and use.
3.4 Information about other participants
This may include information about:
* family members;
* partners;
* children;
* wedding guests;
* employees;
* models;
* collaborators;
* pets;
* venue representatives; and
* other people who may appear in or be involved with the photography.
Clients should avoid providing information about another person unless it is reasonably necessary for the enquiry or booking and they are authorised to provide it.
3.5 Payment and transaction information
This may include:
* invoice details;
* amounts paid;
* payment dates;
* order information;
* billing information;
* refund records; and
* transaction references.
Where card or online payments are handled by Pixieset or another payment provider, I do not ordinarily receive or store your complete payment-card details.
3.6 Website and technical information
This may include:
* your IP address;
* browser type;
* device type;
* operating system;
* approximate location derived from an IP address;
* pages visited;
* referral source;
* website security logs;
* form-submission records;
* cookie choices; and
* information about how the website or gallery is used.
Non-essential analytics or advertising information will only be collected where the applicable cookie or tracking requirements have been met.
3.7 Accessibility, safety and sensitive information
You may choose to provide limited information about:
* a disability;
* accessibility requirement;
* allergy;
* medical consideration;
* pregnancy;
* dietary requirement;
* anxiety or sensory requirement; or
* another matter relevant to safely and appropriately providing the service.
Please provide sensitive information only where it is genuinely necessary.
Where information is treated as special-category personal data, I will identify both an appropriate lawful basis and an additional legal condition. This may include your explicit consent where appropriate.
4. How I obtain information
Most information is obtained directly from you when you:
* visit the website;
* submit an enquiry;
* email, telephone or message me;
* complete a questionnaire;
* request a quotation;
* enter a contract;
* sign a release;
* attend a session;
* access a gallery;
* select favourite images;
* download images;
* place an order;
* submit a review; or
* make a privacy request or complaint.
Information may also be provided by:
* the person who arranged the photography;
* a business or commercial client;
* your partner or family member;
* a parent or guardian;
* an employer;
* an event organiser;
* a wedding planner;
* a venue;
* another photographer or supplier;
* a referral contact;
* a payment provider; or
* a publicly available business source.
Where I receive personal information from another source, I will provide appropriate privacy information where required.
5. Why I use personal information
I may use personal information for the following purposes.
5.1 Responding to enquiries
I use contact details and enquiry information to:
* respond to messages;
* discuss photography requirements;
* check availability;
* prepare a quotation;
* arrange a consultation; and
* take steps requested before entering a contract.
The lawful bases are normally taking steps at your request before entering a contract and my legitimate interests in responding to genuine enquiries.
5.2 Managing bookings and providing photography services
I use booking information, contact details and photographs to:
* prepare contracts and questionnaires;
* plan a session;
* communicate with clients and participants;
* provide photography services;
* select and edit images;
* deliver galleries;
* fulfil orders;
* provide customer support;
* manage revisions; and
* administer licences and releases.
The lawful bases are normally performance of a contract, taking steps before entering a contract and legitimate interests where the information relates to a participant who is not the contracting client.
5.3 Processing and delivering photographs
I use image files and related information to:
* import and back up photographs;
* select images;
* edit and retouch photographs;
* prepare high-resolution and web-resolution files;
* upload images to client galleries;
* provide downloads;
* fulfil print or product orders;
* respond to technical issues; and
* maintain appropriate project records.
The lawful bases are normally performance of a contract and legitimate interests in securely completing and supporting the commissioned service.
5.4 Payments, accounts and tax
I use transaction, invoice and contact information to:
* issue invoices;
* record payments;
* process refunds;
* maintain accounting records;
* prepare tax records;
* prevent fraud; and
* comply with financial and legal obligations.
The lawful bases are performance of a contract, compliance with legal obligations and legitimate interests in maintaining accurate business records.
5.5 Safety, accessibility and reasonable adjustments
I may use relevant information to:
* make reasonable adjustments;
* plan an accessible session;
* protect clients, participants, animals and equipment;
* respond appropriately in an emergency; and
* avoid known hazards.
The lawful basis will depend on the information and circumstances. Where special-category information is required, an additional condition such as explicit consent will be identified where appropriate.
5.6 Security, complaints and legal matters
I may use information to:
* secure my website, galleries and business systems;
* investigate suspected fraud or misuse;
* protect clients, participants, equipment and property;
* manage insurance matters;
* respond to complaints;
* exercise or defend legal rights;
* establish what was agreed; and
* comply with a lawful request from a regulator, court or public authority.
The lawful bases are legitimate interests and compliance with legal obligations.
5.7 Reviews and feedback
I may invite you to provide feedback or a review after a service has been completed.
You are not required to provide a review.
Where you voluntarily publish a review on a public website or social platform, that platform will also process your information under its own privacy policy.
5.8 Direct marketing
I may send information about photography services, availability, offers or related updates where:
* you have given consent;
* the law otherwise permits the communication; or
* the communication is sent to an appropriate business contact and the relevant requirements are met.
You may unsubscribe or object to direct marketing at any time.
I may retain a minimal suppression record containing your email address and opt-out preference so that I do not contact you again by mistake.
6. Photographs and portfolio use
The permission for a client to use photographs is separate from the lawful basis and permission for Kaileidoscope Photography to use identifiable photographs in its own portfolio or marketing.
6.1 Commissioned photography
Photographs are created, edited and delivered to provide the commissioned photography service.
They may also be retained for reasonable purposes including:
* backup and recovery;
* customer support;
* contractual records;
* insurance;
* complaints;
* legal claims;
* licensing evidence; and
* protection against unauthorised use.
6.2 Private and domestic sessions
For private and domestic photography, I will not normally publish an identifiable image in my public portfolio, website or social media unless:
* appropriate permission has been recorded;
* consent has been provided where consent is the applicable basis; or
* another clearly documented lawful basis applies.
Portfolio permission will be presented separately from the client’s right to receive and use their photographs.
6.3 Commercial and personal-branding sessions
For branding and commercial photography, the commissioning client may use photographs under the licence in the photography agreement.
My own portfolio use will follow:
* the Booking Summary;
* the commercial schedule;
* any model release;
* any agreed embargo or launch date;
* any portfolio restrictions; and
* the lawful basis recorded for that project.
For a clearly identified portfolio-building collaboration, I may rely on legitimate interests supported by the express contractual arrangement and an appropriate balancing assessment.
Where I ask for consent as a genuine optional choice, you may withdraw that consent for future use.
6.4 Portfolio safeguards
I will not knowingly use an identifiable photograph:
* in a defamatory or humiliating context;
* in a materially misleading context;
* for unlawful discrimination;
* to imply an unrelated political or commercial endorsement;
* in a stock-image library without separate permission;
* for an unrelated third party’s independent advertising;
* for facial-recognition development; or
* to train a generative artificial-intelligence model.
A request to stop a future portfolio use will be considered in accordance with the applicable lawful basis, the original agreement and your data-protection rights.
Stopping future publication may not allow me to retrieve:
* printed materials;
* archived publications;
* competition entries;
* award submissions;
* exhibition materials; or
* copies already lawfully published or shared by other people.
7. Commercial clients and separate controllers
For a branding, corporate or other commercial commission, Kaileidoscope Photography and the commissioning client may each act as separate data controllers.
I am responsible for my use of information to:
* communicate about the booking;
* plan and provide the photography;
* edit and deliver the images;
* administer payment;
* maintain records; and
* use selected images for my own portfolio where permitted.
The commissioning client is normally responsible for deciding how it uses the photographs for its own:
* advertising;
* website;
* social media;
* recruitment;
* employment;
* publicity;
* internal communications; and
* marketing campaigns.
A commercial client should provide its own privacy information to employees, models, customers and other participants where required.
8. Website, Pixieset and client galleries
My website, booking services, contracts and client galleries may be provided through Pixieset Media Inc.
Pixieset may process information to provide:
* website hosting;
* contact forms;
* questionnaires;
* Studio Manager;
* contracts and electronic signatures;
* invoices;
* client galleries;
* gallery access controls;
* image downloads;
* store and order functions;
* email notifications;
* system security; and
* technical support.
Pixieset may collect technical information when you access the website or a gallery and may act as my processor or as a separate controller for parts of its service.
Private galleries may use:
* a password;
* PIN;
* email registration;
* client-exclusive access; or
* another access restriction.
Clients are responsible for sharing gallery access details only with the intended recipients.
Although reasonable access controls may be used, no internet service can be guaranteed completely secure. Clients should download and securely store their delivered images.
9. Cookies and similar technologies
The website may use cookies, local storage, pixels and similar technologies.
9.1 Strictly necessary technologies
These may be used for purposes such as:
* website security;
* fraud prevention;
* navigation;
* maintaining a session;
* remembering cookie choices;
* processing forms;
* gallery access;
* shopping baskets; and
* providing a service requested by the visitor.
These technologies will be used where they are necessary or where another applicable exemption permits them.
9.2 Analytics and advertising technologies
Non-essential analytics, advertising or tracking technologies will only be used where the applicable consent and transparency requirements have been met.
Where consent is required:
* the technology will not be activated before consent;
* you will be given a meaningful choice;
* refusing non-essential cookies will not prevent ordinary access to the website; and
* you will be able to change your choice later.
The website’s cookie banner or cookie settings provide further information about the technologies actually in use.
This Privacy Policy does not itself obtain consent to non-essential cookies.
10. Who I share information with
I may share personal information where reasonably necessary with:
* Pixieset and other website, CRM, contract and gallery providers;
* email, calendar, cloud-storage, backup and file-transfer providers;
* payment processors, banks and invoicing providers;
* accountants, bookkeepers and tax advisers;
* insurers, solicitors and other professional advisers;
* professional printers, laboratories and album suppliers;
* couriers and delivery companies;
* assistants, second photographers and videographers;
* retouchers and other approved production suppliers;
* venues and event organisers;
* the commissioning client for a commercial project;
* web developers, designers and marketing service providers;
* social-media platforms where an authorised portfolio image is published;
* law-enforcement bodies, courts, regulators and public authorities where disclosure is lawfully required; and
* a genuine purchaser or successor if the photography business is sold or reorganised.
Service providers may only receive the information reasonably required for their role.
I do not sell personal information to data brokers.
I do not permit a supplier to use identifiable client photographs for its own independent advertising unless that separate use has been clearly disclosed and authorised.
11. International transfers
Some website, gallery, software, email, storage, payment and social-media providers may process personal information outside the United Kingdom or allow support access from another country.
Where a restricted international transfer takes place, I will take reasonable steps to ensure that an appropriate transfer mechanism or safeguard is used where required. This may include:
* UK adequacy regulations;
* the UK International Data Transfer Agreement;
* the UK Addendum to approved contractual clauses; or
* another legally permitted safeguard.
Information about the safeguards used for a particular supplier may be requested using the contact details in section 1.
12. How long I retain information
I retain personal information only for as long as reasonably necessary for the relevant purpose.
The following periods are my usual starting points and may be extended where there is an ongoing complaint, dispute, insurance matter, legal obligation or licence.
Enquiries that do not become bookings
Enquiry information will normally be retained for up to 12 months after the last meaningful contact.
-Contracts and key booking records
Contracts, releases, licence records and key booking correspondence will normally be retained for up to six years after the booking has been completed or terminated.
A release or licence record may be retained for longer where photographs continue to be lawfully used and the record is reasonably required to evidence the relevant permission.
- Invoices and accounting records
Invoices, payment and accounting records will be retained for the period required by applicable tax and accounting rules, normally up to six years or longer where required.
- RAW and working image files
RAW files, working files and editing project files will normally be retained for approximately 12 months after delivery.
They may be deleted earlier where storage is no longer reasonably necessary, except where a different archive period has been agreed.
- Delivered photographs and backups
I intend to retain a backup of delivered photographs for approximately 12 months after delivery.
Permanent storage is not guaranteed.
Clients are responsible for downloading and maintaining their own secure backup.
- Online galleries
Online galleries will normally remain available for at least three months after delivery or for the period stated in the booking information.
A gallery may be removed after its expiry date.
- Portfolio images
Portfolio photographs may be retained while the portfolio purpose, relevant permission and lawful basis continue.
Portfolio holdings will be reviewed periodically.
- Marketing preferences
Marketing information will be retained until you unsubscribe or object.
A minimal suppression record may be retained afterwards to ensure that your preference continues to be respected.
- Privacy requests and complaints
Records of data-protection requests and complaints may be retained for up to six years after the matter is closed where reasonably necessary to evidence how the request was handled.
Information may remain temporarily within encrypted or access-restricted backup cycles after deletion from active systems.
13. Security
I use reasonable technical and organisational measures intended to protect personal information.
These may include:
* password protection;
* account access controls;
* two-factor authentication where available;
* secure device settings;
* encrypted connections;
* controlled gallery access;
* software updates;
* backup procedures;
* access restrictions;
* confidentiality obligations; and
* secure deletion or disposal.
No method of internet transmission or electronic storage can be guaranteed completely secure.
If a personal-data breach occurs, I will assess the risk and notify the Information Commissioner’s Office and affected individuals where required.
14. Children and young people
Photography involving a child or young person will be handled with particular care.
Where required, I will:
* obtain information from a parent or person with lawful authority;
* record appropriate permissions;
* consider the child’s age and understanding;
* explain the intended photography and use in an appropriate way;
* limit access to private galleries;
* avoid publishing sensitive identifying information; and
* consider safeguarding and the child’s interests.
An identifiable image of a child will not be used publicly in my portfolio unless the necessary permission and lawful basis have been recorded.
A parent or guardian should not provide more information about a child than is reasonably necessary for the photography service.
15. Your data-protection rights
Depending on the circumstances, you may have the right to:
* be informed about how your information is used;
* request access to your personal information;
* ask for inaccurate information to be corrected;
* ask for incomplete information to be completed;
* ask for information to be erased;
* ask for processing to be restricted;
* object to processing based on legitimate interests;
* object to direct marketing;
* receive certain information in a portable format;
* withdraw consent where processing relies on consent; and
* complain about how your information has been handled.
These rights are not absolute and may not apply in every situation.
For example, information may need to be retained where it is required for:
* a legal obligation;
* contractual records;
* the establishment, exercise or defence of legal claims;
* accounting;
* insurance;
* fraud prevention; or
* another lawful purpose.
Withdrawing consent does not make processing that took place before withdrawal unlawful.
To exercise a right, contact me using the details in section 1.
I may need to request reasonable information to verify your identity or authority before responding.
16. Automated decision-making
I do not use personal information to make solely automated decisions that produce legal or similarly significant effects.
Website analytics or automated security systems may identify general usage or suspected security activity, but they are not used to make significant decisions about clients without appropriate human involvement.
17. Data-protection complaints
You may make a data-protection complaint by emailing:
Please explain:
* what you believe has gone wrong;
* the information or processing involved;
* any relevant dates;
* any supporting information; and
* the outcome you are seeking, if known.
I will acknowledge receipt of a data-protection complaint within 30 days.
I will take appropriate steps to investigate the complaint without undue delay, keep you informed where the investigation is ongoing and communicate the outcome.
You may also complain to the Information Commissioner’s Office.
You do not have to complain to me before approaching the Information Commissioner’s Office, although contacting me first may allow the matter to be resolved more quickly.
18. Other websites and social media
My website or communications may link to:
* Pixieset;
* Instagram;
* Facebook;
* LinkedIn;
* payment providers;
* venues;
* suppliers; or
* other third-party websites.
Those organisations are responsible for their own services and privacy practices.
This Privacy Policy does not control how an independent third-party website processes your information.
19. Information required to provide the service
Certain information is required so that I can:
* respond to an enquiry;
* identify the contracting client;
* prepare a contract;
* plan a session;
* issue an invoice;
* deliver images; or
* comply with a legal obligation.
Where required information is not provided, I may be unable to accept or complete a booking.
Other information, such as marketing preferences and optional portfolio permission for a standard private booking, may be voluntary.
20. Changes to this Privacy Policy
I will review this Privacy Policy when:
* my services change;
* my website or suppliers change;
* I introduce a new use of personal information;
* retention practices change; or
* legal requirements change.
The latest version will be published on my website.
Where a change would create a materially new use of existing personal information, I will provide additional information or seek further permission where required.
Current version: July 2026
Next planned review: July 2027