Who we are

This website is operated by Paul Underhill Photography. Paul Underhill is the data controller responsible for your personal information.

Website: paulunderhill.com
Location: Bournemouth, Dorset, United Kingdom

If you have any questions about how we handle your personal data, please get in touch via the contact page.

What information we collect

We collect personal information in the following ways:

Contact and enquiry forms

When you submit an enquiry through the website, we collect your name, email address, phone number (if provided), and the details you include in your message. This information is used solely to respond to your enquiry.

Email correspondence

If you contact us directly, we will retain a record of that correspondence and any personal information it contains.

Website usage data

We collect anonymised data about how visitors use the website via Google Analytics. This includes pages visited, time spent on the site, and general information about the device and browser used. This data does not identify you personally.

Cookies

Our website uses cookies. See the Cookies section below for full details.

How we use your information

We use the information you provide to:

• Respond to your enquiry or booking request
• Communicate with you about your booking or contract
• Send you your photographs and related files
• Meet our legal and contractual obligations
• Improve the website and our services

We will not use your personal information for marketing purposes, and we will never sell your data to third parties.

Legal basis for processing your data

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases for processing your personal data:

• Legitimate interests when responding to your enquiry before a contract is in place
• Contractual necessity when processing is required to fulfil a booking or contract you have entered into with us
• Legal obligation when we are required to retain records for tax or regulatory purposes
• Legitimate interests when using Google Analytics to understand how the website is used and improve its performance

How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy.

• Enquiry data from non-clients is typically deleted within 12 months
• Client records and related correspondence are retained for up to 7 years for tax and accounting purposes, in line with HMRC requirements
• Photographs delivered to clients may be retained as portfolio backups for longer periods. If you would prefer your images are not retained beyond delivery, please let us know via the contact page

Who we share your data with

We do not sell or rent your personal data to anyone. We may share your information with trusted third-party services that help us operate the website and run our business, including:

• Hosting and website platform providers (e.g. WordPress hosting)
• Google Analytics for anonymised website usage data (see Cookies section)
• Cloud storage and file delivery services used to deliver your photographs
• Email providers used to manage correspondence
• Accountancy software for invoicing and financial records

All third-party providers we use are required to process your data in accordance with applicable data protection laws. We do not transfer your data outside the UK or EEA without appropriate safeguards in place.

Cookies

Cookies are small text files stored on your device when you visit a website. We use cookies to help the website function correctly and to understand how visitors use it.

The types of cookies we use include:

• Essential cookies needed for the website to work properly
• Analytics cookies set by Google Analytics to collect anonymised data about how visitors interact with the site, including pages visited and time spent. Google Analytics does not identify individual users. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on

You can control and delete cookies through your browser settings. Disabling cookies may affect some features of the website. For more information, visit aboutcookies.org.

Your rights under UK GDPR

Under UK data protection law, you have the following rights:

• Right to access the personal data we hold about you
• Right to rectification if any information we hold is inaccurate or incomplete
• Right to erasure of your personal data in certain circumstances
• Right to restrict processing in certain circumstances
• Right to data portability where technically feasible
• Right to object to processing based on legitimate interests

To exercise any of these rights, please get in touch via the contact page and we will respond within one month.

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

Third-party websites

This website may include links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal information.

Changes to this policy

We may update this privacy policy from time to time. Any changes will be published on this page with an updated effective date. We recommend checking this page periodically.

Last updated: May 2026