Privacy Policy

Bob Deeley, sole trader trading as Bob Deeley Photography, is the data controller for the personal data described in this policy, as defined under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: bdphotography.uk/pages/contact. A postal address is available on request via the contact form.

What personal data we collect and why

When you place an order we collect: your name, delivery address, email address, phone number (if provided), and order details (items ordered, prices, delivery method).

We do not receive or store your payment card details. Card payments are processed directly by Shopify Payments, which holds PCI DSS certification.

We use this data to:

  • Fulfil your order — process payment, arrange print production, and arrange delivery. Lawful basis: performance of a contract.
  • Communicate about your order — send confirmation, dispatch, and follow-up messages. Lawful basis: performance of a contract.
  • Comply with legal obligations — retain business records as required by HMRC and UK law. Lawful basis: legal obligation.

Who we share your data with

We share the minimum necessary data with the following processors:

  • Shopify — our e-commerce platform stores order records and customer data on our behalf as a data processor. Shopify complies with UK GDPR. See shopify.com/legal/privacy.
  • Prodigi — our print fulfilment partner receives your name and delivery address to produce and dispatch your order.
  • Shopify Payments — processes payment card transactions. We do not receive your card details.

We do not sell your personal data. We do not share it with any party for marketing purposes or for any purpose unrelated to fulfilling your order.

How long we keep your data

We keep order records, including the personal data they contain, for six years from the end of the tax year in which the order was placed. This is the minimum period required by HMRC for business records. After that period, personal data that we no longer have a legal need to retain is deleted.

Your rights

Under UK GDPR you have the right to:

  • Access — request a copy of the data we hold about you
  • Rectification — ask us to correct inaccurate data
  • Erasure — ask us to delete your data, subject to legal retention requirements
  • Restriction — ask us to limit how we process your data
  • Objection — object to processing based on legitimate interests
  • Portability — receive your data in a portable, machine-readable format

To exercise any of these rights, use the contact form. We will respond within one calendar month.

Complaints

If you believe we have not handled your personal data correctly, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would welcome the chance to resolve any concern directly before you escalate — please contact us first if you are comfortable doing so.

Cookies

This website uses cookies set by Shopify. Strictly necessary cookies (session management, shopping cart) are set without consent. Where you give consent via the cookie banner on your first visit, Shopify may also set analytics cookies. You can change your preferences at any time using the cookie settings in the site footer.

Changes to this policy

We may update this policy from time to time. The current version — with the date it was last updated — is always on this page.

Last updated: 3 September 2026