Privacy Policy – In Lexi Studio

Last Updated: 4 March 2026

1. Introduction

This Privacy Policy explains how In Lexi Studio collects, uses, stores, and protects your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as the EU General Data Protection Regulation (EU GDPR) for clients based in EU member states.

2. Data Controller

Data Controller: Alex Leszczyński, trading as In Lexi Studio

Address: 2 Haughview Terrace, G5 0LN, Glasgow, Scotland, United Kingdom
Email: info@inlexistudio.com
Phone: +44 79 6651 6199
Website: www.inlexistudio.com

3. Data We Collect

We collect personal data in the following categories:

Contact Information: Name, email address, phone number, and business details when you contact us or book a session.
Booking & Session Details: Event date, location, session type, preferences, and special requirements.
Payment Information: Billing address and payment method (processed securely via third-party providers; we do not store full card details).
Photographic Content: Images captured during sessions, including identifiable individuals.
Communication Records: Emails and messages related to your booking.
Website Usage Data: Cookies, IP address, browser type, and pages visited via analytics.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contractual Necessity: Processing required to fulfil your photography contract or booking.
Legitimate Interest: Marketing communications, analytics, and service improvement.
Consent: Where you have explicitly consented to specific processing activities.
Legal Obligation: Compliance with UK tax, accounting, and employment law.

5. How We Use Your Data

We use your personal data to:

Conduct photography sessions and deliver edited images.
Manage bookings, payments, and communications.
Create invoices and maintain financial records.
Send confirmation emails, updates, and service-related communications.
Improve our services based on feedback and website analytics.
With your consent, feature images in our portfolio or marketing materials.
Comply with legal and tax obligations.

6. Photography Rights & Image Usage

Your images remain your property. However:

Portfolio Usage: We may use select images in our portfolio, website, or social media unless you explicitly opt out.
Client Consent: For weddings and events involving multiple people, we obtain written consent from all identifiable individuals before using images in marketing.
Commercial Usage: Any use beyond the agreed scope requires additional written consent.

7. Data Sharing & Third Parties

We do not sell your data. We share personal data only with:

Payment Processors: Secure third-party payment gateways (PCI-DSS compliant).
Cloud Storage Providers: For secure backup and delivery of edited images.
Email Service Providers: For transactional and marketing communications.
Accountants & Legal Advisors: As required for business compliance.
Law Enforcement: If legally required by UK authorities.

All third parties are contractually bound to protect your data according to GDPR and UK law.

8. Data Retention

We retain personal data for the following periods:

Session & Booking Data: 3 years after the session date.
Financial Records: 7 years (UK tax requirement).
Email Communications: Until you unsubscribe.
Photographic Content: Indefinitely unless deletion is requested, with usage limited to the agreed scope.
Website Analytics: Up to 26 months.

9. Your Rights

Under UK GDPR and EU GDPR, you have the right to:

Access: Request a copy of your personal data.
Correction: Request that inaccurate or incomplete data be corrected.
Erasure: Request deletion of your data, subject to legal obligations.
Portability: Request your data in a portable, structured format.
Restrict Processing: Limit how we use your data while a dispute is resolved.
Withdraw Consent: Withdraw previously given consent at any time.
Object to Processing: Object to marketing or specific processing activities.

To exercise any of these rights, contact us at info@inlexistudio.com.

10. Data Security

We implement the following security measures:

SSL/TLS encryption for website and email communications.
Secure, password-protected access to client files and databases.
Regular backups to prevent data loss.
Restricted data access to authorised staff only.

11. International Data Transfer

If you are based in the EU and your data is transferred to UK servers, we comply with UK GDPR requirements. Appropriate safeguards (e.g., Standard Contractual Clauses) are in place where required.

12. Cookies & Tracking

Our website uses cookies for:

Essential Cookies: Site functionality and security.
Analytics Cookies: Visitor behaviour to improve services.
Marketing Cookies: Personalised content (only with consent).

You can manage cookie preferences in your browser settings.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Updates will be posted here with a revised "Last Updated" date.

14. Complaints

You have the right to lodge a complaint with:

UK: Information Commissioner's Office (ICO) – www.ico.org.uk
EU: Your national Data Protection Authority.

15. Contact Us

For privacy enquiries or to exercise your rights:

Email: info@inlexistudio.com
Phone: +44 79 6651 6199
Address: 2 Haughview Terrace, G5 0LN, Glasgow, Scotland, United Kingdom

We will respond to your request within 30 calendar days.