This Privacy Policy explains how Simon Baxter Limited collects, uses and protects personal information when you visit baxter.photos, contact me, subscribe to an email list, place an order or book a photography workshop.
Last updated: 9 September 2026
Who is responsible for your information
The data controller is Simon Baxter Limited (company number 10934325), trading as Simon Baxter Photography. In this policy, “I”, “me” and “my” refer to Simon Baxter Limited.
Registered office:
22 Hunters Hill Close
Guisborough
North Yorkshire
TS14 7FH
United Kingdom
Email: simon@baxter.photos
The information I collect
Orders and workshop bookings
When you buy a print or book, or book a photography workshop, I may collect your name, email address, telephone number, billing and delivery addresses, order details, payment status and any correspondence relating to the purchase or booking.
Payment-card and PayPal account details are handled securely by the payment provider you choose. I do not receive or store your complete card details.
Customer accounts
If you create a customer account, the site stores the account details you provide together with information such as your order history and saved addresses. You can view and update much of this information from your account area.
Enquiries and correspondence
If you use the contact form or email me directly, I receive the information you provide, such as your name, email address, chosen subject and message. The contact form sends the message to my business mailbox; it does not save a separate copy of the message in the WordPress database.
Newsletter and workshop priority list
If you join the general newsletter or the workshop priority list, I collect your email address and, if supplied, your first name. I also retain your subscription status and the list you chose to join. The two lists are separate: joining the workshop priority list does not automatically subscribe you to the general newsletter.
Website and technical information
When you use the website, technical information may be processed automatically, including your IP address, browser and device information, pages requested, referral information, security logs and your cookie-consent choices. If you permit analytics, information about how you use the website is also collected as described below.
Workshop accessibility and safety information
If you voluntarily provide health, accessibility or dietary information that is relevant to participating safely in a workshop, I will use it only to make appropriate arrangements and protect participants. Where this is special-category information, I rely on your explicit consent unless another legal basis applies in an emergency.
How and why I use your information
- To fulfil orders and workshop bookings: processing is necessary to enter into or perform a contract with you.
- To respond to enquiries and provide customer service: I rely on steps taken at your request before a contract, performance of a contract, or my legitimate interest in responding to people who contact the business.
- To maintain tax, accounting and business records: processing is necessary to comply with legal obligations.
- To protect the website, customers and business: I rely on legitimate interests to prevent spam, abuse, fraud and security incidents, provided those interests are not overridden by your rights.
- To send the newsletter or workshop-priority emails you requested: I rely on your consent. You can withdraw it at any time.
- To measure and improve the website: non-essential analytics are used only after you have given consent through the cookie banner.
I do not sell your personal information.
Payments
Online payments are processed by Stripe or PayPal, depending on the method you select. They receive the information necessary to process the transaction, authenticate the payment, prevent fraud and handle refunds or disputes. Their own privacy terms also apply to the information they process.
Email lists
The newsletter and workshop priority list are managed using MailerLite. Signup information is sent securely from this website to MailerLite. A confirmation email is used so that the subscription is not activated until you confirm it. Every marketing email includes an unsubscribe link.
Cookies and analytics
The website uses essential cookies and similar browser storage to operate features such as the basket, checkout, payment processing, security and consent preferences. These technologies are necessary for the service you request.
With your permission, the website uses Google Analytics to understand matters such as which pages are visited, how visitors arrive and how the site is used. Analytics is not used for advertising on this website and is not loaded as ordinary analytics unless you select “Accept analytics” or enable it in your preferences. Google may process technical and usage information under its own Privacy Policy.
Complianz records and applies your cookie choices. Full details of the cookies and browser-storage items currently used, their purposes and durations are provided in the Cookie Policy. You can change your choices at any time using the “Manage consent” control on the website.
Who I share information with
I share personal information only where it is necessary for the purposes described in this policy. Recipients may include:
- Krystal Hosting, which hosts the website and its data;
- Stripe and PayPal for payment processing and fraud prevention;
- MailerLite for newsletter and workshop-priority subscriptions;
- business email and email-delivery providers used to receive enquiries and send transactional messages;
- Royal Mail, couriers and, for international orders, customs or postal authorities where needed to deliver your order;
- workshop co-leaders, venues or service providers where this is necessary to administer a workshop you have booked;
- accountants, insurers, professional advisers and service providers where reasonably necessary to run and protect the business; and
- courts, regulators, law-enforcement bodies or other authorities where disclosure is required by law.
International transfers
Some service providers may process information outside the United Kingdom. Where personal information is transferred internationally, I rely on an applicable UK adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or an approved UK addendum to standard contractual clauses, as appropriate.
How long I keep information
- Orders, payments and tax records: normally six years from the end of the relevant financial year, or longer if required for a dispute or legal obligation.
- Customer accounts: while the account remains active or is reasonably needed, with purchase records retained separately for the period above.
- Enquiries and correspondence: for as long as reasonably necessary to respond, provide support and manage any resulting business relationship or legal issue.
- Newsletter and priority-list information: until you unsubscribe or the list is cleaned. A minimal suppression record may be retained so that an unsubscribe request continues to be respected.
- Workshop accessibility or safety information: only for as long as it is needed for the workshop and any related safety, insurance or legal requirement.
- Analytics and technical records: for the period configured in the relevant service and only for as long as needed for measurement, security or troubleshooting. Aggregated reports that no longer identify an individual may be retained for longer.
The contact and newsletter forms use a short-lived, one-way fingerprint derived from the source IP address to limit automated abuse. The theme does not retain the raw IP address for this purpose, and the fingerprint expires after ten minutes. The hosting platform may separately retain limited server and security logs.
How I protect your information
I use appropriate technical and organisational measures intended to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure. Access is limited to people and service providers who need the information for the purposes described above.
Your rights
Depending on the circumstances, UK data-protection law gives you the right to:
- request access to the personal information held about you;
- ask for inaccurate or incomplete information to be corrected;
- ask for information to be erased in certain circumstances;
- ask for processing to be restricted;
- object to processing based on legitimate interests;
- receive certain information in a portable format; and
- withdraw consent at any time where processing is based on consent.
To exercise a right, email simon@baxter.photos. I may need to verify your identity before acting on a request. Some rights are subject to legal exceptions, including information that must be retained for tax, contractual or legal reasons.
Complaints
If you have a concern about how your information has been handled, please contact me first so that I can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office through ico.org.uk.
Links to other websites
This website links to other websites and social-media services. Once you follow an external link, the other organisation controls how it collects and uses your information, and its own privacy policy applies.
Changes to this policy
I may update this policy when the website, services or legal requirements change. The date at the top of the page shows when it was last revised.