Legal
Privacy policy
Last updated 4 November 2026
This explains what Creative Moments does with your personal information. It is written to be read, not to be impenetrable — if anything here is unclear, email me and I'll explain it in plain words.
Who is responsible for your information
Creative Moments is the data controller, based in Aberdeen, Scotland. For anything in this policy — questions, requests, complaints — write to nkcreativemoment@gmail.com.
This site is run by one photographer, not a company with a privacy department. Your request reaches me directly.
What I collect, and why I'm allowed to
Under UK data protection law every use of your information needs a lawful basis. Here is each one, in full:
- Enquiry form
- Your name, email, phone (if you give it) and your message. Used to reply to you. Lawful basis: legitimate interests — you contacted me and expect an answer.
- Booking form
- Your name, email, phone, the session you want, the date and any notes. Used to hold the date, confirm the booking and turn up in the right place. Lawful basis: performance of a contract.
- Client gallery
- The name and email of the person a private gallery belongs to, so the right people can reach it. Lawful basis: performance of a contract.
- Favourites
- Which photographs you mark, and a first name if you choose to add one, so I know which images you want edited. Lawful basis: performance of a contract.
- Photographs
- Covered separately below, because they need more than a line.
I do not buy contact lists, I do not sell or share your details for anyone else's marketing, and I will not add you to a mailing list because you enquired.
Photographs of you
A photograph of a recognisable person is personal information, so it gets the same protection as your email address — and in some cases more, because images can reveal things like ethnicity, religious dress or a disability.
- Taking and delivering them is done to carry out our contract: it is the thing you hired me for.
- Showing them in my portfolio, on this site or on social media is a separate matter and needs your agreement. I ask for it in writing before the session, it is never a condition of booking, and you can change your mind afterwards.
- Private client galleries are never indexed by search engines and the photographs inside them are not served to anyone without the gallery link, and the password where one is set.
- Children are only photographed with the agreement of someone with parental responsibility, and I will not use an image of a child in my portfolio without it being asked for separately.
If you want a photograph of you taken down from my portfolio, say so and it comes down. You do not have to give a reason.
Cookies
A cookie is a small file this site asks your browser to keep. This site sets four, and only one of them is optional:
Every cookie this site sets
- cm_consent
- Remembers your choice about the cookie below, so you are not asked on every page. Essential. Twelve months.
- cm_g_…
- Set when you unlock a password-protected gallery, so you do not retype the password on every photograph. Essential. Thirty days.
- cm_admin
- My own login to the dashboard. Only ever set for me. Essential.
- cm_visitor
- A random identifier with no name attached. Needed to remember which photographs you have marked as favourites. It is also what lets me count how many people have opened a gallery — that counting is the optional part, and it does not happen unless you agree.
There is no Google Analytics here, no advertising pixels, no social media trackers and no embedded third-party scripts of any kind. The fonts are served from this site rather than from Google, so loading a page tells nobody but me that you visited.
You can change your mind at any time — the banner reappears if you clear your browser's site data, and refusing costs you nothing but the visit counter.
Who else can see it
As few people as possible. I use these companies to run the site, and nothing more:
- Hostinger
- The server this site runs on, in London. Your information is stored on it. It does not leave the UK for ordinary use of this site.
- Cloudflare
- Looks after the domain name only. It does not sit between you and this site, and does not see the pages you visit.
- Resend
- Sends me the email alert when you make an enquiry or a booking, which means your message passes through them. They are based in the United States and the transfer relies on the UK's approved safeguards.
I will hand information to someone else only where the law requires it. Nobody gets it for marketing.
How long I keep it
- Enquiries
- Twelve months, then deleted — long enough to pick up a conversation that went quiet.
- Bookings and invoices
- Six years after the end of the tax year they fall in. This one is not my choice: HMRC requires business records to be kept that long.
- Client galleries
- Live for at least twelve months after delivery, or until the expiry date shown on the gallery. I will tell you before one closes.
- Edited photographs
- Archived indefinitely so you can come back years later for another copy — unless you ask me to delete them.
- Favourites and visit counts
- Deleted when the gallery is deleted.
Your rights
You can ask me, free of charge, to:
- give you a copy of everything I hold about you
- correct anything that is wrong
- delete it — including photographs, subject only to records I am legally required to keep
- stop using your photographs in my portfolio
- stop a particular use you object to, or restrict it while we sort it out
- send your information to you or someone else in a portable format
I will respond within one month. The only thing I may ask for is enough information to be sure it is really you — I am not going to email somebody's wedding photographs to a stranger who knows their name.
Keeping it safe
The whole site is served over an encrypted connection. Passwords are stored as one-way hashes, never as text. Private galleries are checked on every single image request rather than merely being unlisted, so a guessed address gets nothing. Backups run nightly and are kept on the server for fourteen days.
Your IP address is held in the server's memory for about a minute to stop automated abuse of the forms. It is never written to the database and never logged.
If you are unhappy
Tell me first — most things are a misunderstanding and I would rather fix it. If that does not resolve it, you have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk or on 0303 123 1113. You do not need my permission and it costs nothing.
Changes
If this policy changes in a way that affects you, the date at the top changes and the cookie banner will ask you again where your earlier choice no longer covers what the site does. See also the terms of use.