Last updated: 8 June 2026

This policy explains how your personal data is collected, used, and protected when you visit our website, buy our products, join our email list, make an enquiry, or take part in a photography session with us. Please read it alongside our cookie notice.

1. Who we are

We are the "data controller" responsible for your personal data.

• Controller: Rosie Parsons, trading as Rosie Parsons Photography 
• Address: 14 Codrington Street, Exeter EX1 2BU
• Email for data queries: rosie@rosieparsons.com
• ICO registration number: 

2. The personal data we collect

Depending on how you interact with us, we may collect:

• Customers and buyers: name, email, billing and delivery address, phone number, order history, and payment confirmation details (we do not store full card numbers; payments are handled by our payment provider).
• Website visitors: device and browser information, IP address, pages viewed, and similar analytics and cookie data.
• Email subscribers: name and email address, and information about which emails you open or click.
• Enquiries: anything you choose to tell us when you contact us.
• Models and people we photograph: name, contact details, the signed model release, and the photographs, video, and other images created during a session. Where the person is a child, this includes the details of, and consent given by, their parent or guardian.

3. How we use your data, and our lawful basis

We only use your data where the law allows. The main bases we rely on are:

• To fulfil your order and provide products or courses (basis: performance of a contract).
• To send marketing emails and updates, where you have signed up (basis: your consent, which you can withdraw at any time).
• To run analytics and advertising, and to set non-essential cookies (basis: your consent, given through our cookie banner).
• To use photographs and likeness commercially in our guides, courses, marketing, website, blog, advertising, PR, and other products (basis: your consent, recorded in the signed model release).
• To keep accounting and tax records (basis: legal obligation).
• To keep our website secure and improve our services (basis: our legitimate interests, balanced against your rights).

4. Photography, images, and likeness

If you take part in a session as a model or photographic subject, your image is personal data and we treat it as such. We use these images for the commercial purposes set out in the model release you sign, which may include posing guides and courses, our website, blog, email, and social media, marketing and advertising, PR and press coverage, and current or future products such as a posing app. The model release is your record of the consent you have given and the specific uses you have agreed to.

5. Children's data

We take particular care with children's personal data. We only photograph or hold data about a child with the consent of their parent or legal guardian, given through a signed model release completed by that adult. A parent or guardian can withdraw consent for future use at any time by contacting us, although we may not be able to recall images that have already been printed, published, or distributed.

6. Who we share your data with

We share data only with service providers who help us run our business, and only as needed. These currently include:

• Online shop and hosting: Shopify, Wordpress, BigScoots
• Payment processing: Shopify Payments, Stripe, PayPal
• Email marketing: Klaviyo, Flodesk 
• Online courses: Tevello
• Advertising and analytics: Meta, Pinterest, TikTok, Google
• Design and content tools: Canva, Photoshop, Lightroom

These providers process data on our behalf under their own data protection terms. We do not sell your personal data. We may also disclose data where required by law.

7. International transfers

Some of our providers are based outside the UK. Where data is transferred abroad, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses to keep it protected.

8. Cookies and tracking

Our website uses cookies and similar technologies for essential functions, analytics, and advertising. Non-essential cookies, including advertising pixels from the platforms listed above, are only set with your consent through our cookie banner. You can change your preferences at any time.

9. How long we keep your data

We keep personal data only as long as we need it:

• Order and accounting records: 6 years, to meet HMRC requirements.
• Marketing list: until you unsubscribe or ask to be removed.
• Enquiries: up to 2 years
• Photographs and model releases: for as long as we may use the images commercially, which under the release may be indefinite. The release is kept for as long as the images are in use.

10. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data (this may be limited where images are already published or where we must keep records by law);
• ask us to restrict or object to certain processing;
• withdraw consent at any time, including unsubscribing from marketing;
• ask for your data in a portable format.

To exercise any of these, email us at rosie@rosieparsons.com

11. How to complain

If you are unhappy with how we have handled your data, please contact us first at rosie@rosieparsons.com. We will acknowledge your complaint within 30 days and do our best to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to address your concerns before you approach the ICO.

12. Security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access.

13. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and the date at the top shows when it was last changed.