My Privacy Policy

Who am I?

My website address is: www.lightninginabottle.co.uk. I am a freelancer, Heather Hughes, trading under the name Lightning in a Bottle, who is a photographer, videographer, content creator, and a mentor and teacher. My privacy policy complies with GDPR, the UK Data Protection Act 2018, and relevant laws. I can be contacted via email on heather@lightninginabottle.co.uk

Legal basis for data collection

As a solo freelancer, I process personal data in line with the UK GDPR. The legal grounds for processing your data are:

  • Consent: When you provide consent, such as by leaving comments, accepting cookies, or subscribing to updates.
  • Contract: When processing is necessary to fulfill a contract with you, for example, if you hire us for photography or video services.
  • Legitimate Interest: We may process your data when it is in our legitimate interest to do so, such as improving our website or services.
  • Legal Obligation: We may also process personal data when required to comply with legal obligations.

Why do I collect your data?

I collect your data for the following reasons:

  • To respond to comments and inquiries: When you leave a comment or reach out to me, I use your data to respond and provide support.
  • To improve my services: I may use cookies or analytics tools to understand how visitors use my website, helping me to enhance user experience.
  • For security or spam detection: I process data to protect my site from spam and ensure it runs securely.
  • For marketing purposes: If you’ve expressly opted in, I collect your email address using Kit (formerly ConvertKit) and a CRM to notify you of new blog posts, upcoming workshops, photowalks, or other services I offer. You can unsubscribe from these notifications at any time.

Data sharing with third parties

I may share your data with trusted third-party services to help improve your experience and provide my services. These third parties are GDPR-compliant and only process your data for the necessary purposes. Here’s how your data may be shared:

  • Gravatar: If you leave a comment, an anonymized string (hash) created from your email address may be sent to Gravatar to check if you have a profile image. The Gravatar privacy policy can be found here.
  • Spam Detection Services: Visitor comments may be checked through automated spam detection services to keep the site secure.
  • Google Analytics: I use Google Analytics to track website traffic and usage patterns. This helps me improve my website by understanding how visitors interact with it. Google Analytics’ privacy policy can be found here.
  • Social Media Plugins: My website may include embedded social media content or plugins (e.g., Facebook, Instagram). These platforms may collect data about your interactions when you engage with the content or share posts.
  • Email Marketing Tools: I use Kit (formerly ConvertKit) and a CRM to manage email lists and send marketing communications if you’ve opted in to receive them. These tools store and process your email data securely.
  • Payment Providers (if applicable): If you book a service or purchase through my site, payment data may be processed through a third-party provider such as PayPal or Stripe. They process your payment data securely and in line with GDPR requirements.

I do not sell or share your personal data with any third parties for their own marketing purposes. All data shared with these services is done to provide and improve my services while maintaining full compliance with GDPR.

International data transfers

Some of your data may be transferred outside the UK or European Economic Area (EEA). For example, if my hosting provider, SiteGround, or any other third-party services are located outside Europe, your data could be stored or processed there.

To protect your data, I ensure that any transfers comply with GDPR by using safeguards like Standard Contractual Clauses. These measures help ensure your data is treated with the same level of protection as required in the UK and EEA.

Cookies and tracking technologies

My website uses cookies and similar technologies to enhance your experience. Here’s how I use them:

  • Essential Cookies: These cookies are necessary for the website to function properly. Without them, you wouldn’t be able to use certain features.
  • Analytics Cookies: I use cookies, such as those from Google Analytics, to track how visitors use the site. This helps me understand performance and improve the website over time.
  • Marketing Cookies: If applicable, these cookies help me provide you with relevant content and advertisements.

You have the option to manage your cookie preferences. When you first visit my site, you will see a cookie consent banner that allows you to accept or decline cookies. You can change your preferences at any time.

For more detailed information, you can refer to my dedicated cookie policy.

How long do I retain your data for?

I take data retention seriously and only keep your personal data for as long as necessary. Here’s how long I retain different types of data:

  • Contact Form Data: Information collected through contact forms via my Studio Ninja CRM will be retained for as long as I need to respond to your inquiries or manage our business relationship. Typically, this data is kept for a minimum of three years unless you request deletion.
  • User Profiles: If I create temporary user profiles for troubleshooting or repairs, those profiles will be deleted after the issue is resolved or within three months, whichever comes first.
  • Analytics Data: Data collected through analytics tools, such as Google Analytics, is retained in accordance with their policies. Generally, this data is kept for 26 months before being automatically deleted.
  • Email Marketing Data: For data collected through Kit (ConvertKit), I will retain your information for as long as you remain subscribed to my communications. You can unsubscribe at any time, and your data will be deleted shortly after.

If you have any questions about data retention or wish to request deletion of your data, please feel free to contact me.

User rights under GDPR

You have certain rights regarding your personal data under GDPR:

  • Right to Access: You can ask to see what personal data I hold about you.
  • Right to Rectification: If you find any incorrect information, you can request to correct it.
  • Right to Erasure: You can ask me to delete your personal data.
  • Right to Restrict Processing: You can request that I limit how I use your data.
  • Right to Object: You can object to certain uses of your data, like for marketing purposes.
  • Right to Data Portability: You can ask for a copy of your data in a format that is easy to use.
  • Right to Withdraw Consent: If I rely on your consent for processing, you can withdraw it at any time.

If you want to exercise any of these rights, please contact me.

Data security

I take the security of your personal data seriously. I use various measures to protect it, including:

  • Encryption: Your data is encrypted to keep it safe.
  • Secure Servers: I store data on secure servers to prevent unauthorized access.
  • Access Controls: Only authorized personnel have access to your data.

Contact information for concerns or complaints

If you have any questions or concerns about your privacy, you can reach me at heather@lightninginabottle.co.uk

If you believe your data rights have been violated, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Changes to the Privacy Policy

This privacy policy may be updated from time to time. I encourage you to review it periodically to stay informed about how I protect your data.

If there are significant changes, I will notify you by posting updates on my website or sending you an email.

Consent for Minors (Children’s Privacy)

If my website may attract visitors under the age of 16, I require consent from a parent or guardian before collecting their personal data. If you are a parent or guardian and believe I may have collected data from your child, please contact me.