Privacy Policy

Last updated: 9 October 2026

1. About this policy

This Privacy Policy explains how I collect, use, store and protect personal information when you visit www.federicoperale.com, contact me about photography services, book a photoshoot or event, or receive photographs from me.

I am committed to handling personal information responsibly and in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable privacy and electronic communications rules.

Data controller: Federico Perale
Contact email: studio@federicoperale.com
Business address: 30 Kensington Park Gardens - W112QS London

2. Personal information I collect

Depending on how you interact with me, I may collect:

  • Contact details: your name, email address, telephone number and other details you provide.

  • Enquiry and booking information: your message, photography requirements, event details, dates, location, correspondence, quotations and contractual information.

  • Payment and invoicing information: information needed to manage payments, invoices and accounting. Payment card details may be handled directly by a payment provider rather than stored by me.

  • Photographs and related information: images of you or other individuals, together with relevant captions, event details or other information supplied for a photography assignment.

  • Website usage information: information about how visitors use the website, such as page views, referral sources and device or browser information, depending on the analytics features enabled.

  • Technical information: information that may be recorded by the website platform or its service providers when the site is accessed.

Please avoid sending sensitive personal information unless it is necessary for the photography service.

3. How I collect information

I collect information when you:

  • Submit a contact or enquiry form on my website.

  • Contact me by email or telephone.

  • Request a quotation, make a booking or enter into a contract.

  • Participate in a photoshoot or event I photograph.

  • Receive photographs through an online gallery or cloud-based delivery service.

  • Browse my website, subject to the applicable cookie and analytics settings.

Some information may also be processed automatically by Squarespace and other service providers supporting the website.

4. How and why I use your information

I use personal information where necessary to:

  • Respond to enquiries and discuss your photography requirements.

  • Prepare quotations, arrange bookings and perform photography services.

  • Communicate about assignments, schedules, image delivery and follow-up questions.

  • Deliver, store and manage photographs.

  • Prepare invoices, maintain business records and meet legal obligations.

  • Operate, secure and improve my website.

  • Understand website traffic and performance through analytics.

  • Establish, exercise or defend legal claims where necessary.

I do not currently send marketing emails or use the contact details you provide for a marketing mailing list.

5. Legal bases for processing

Where UK GDPR applies, I rely on the appropriate legal basis for each purpose. This may include:

  • Contract: where processing is necessary to provide a photography service or take steps you request before entering into a contract.

  • Legitimate interests: where necessary for legitimate business activities, such as managing client relationships, maintaining business records, protecting my business or improving my website, provided those interests do not override your rights.

  • Legal obligation: where I need to retain or disclose information to comply with applicable laws, including accounting and tax requirements.

  • Consent: where consent is legally required, such as for certain non-essential cookies or similar tracking technologies.

Where processing relies on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Photography, image delivery and portfolio use

Photographs are central to my business. I may process images containing identifiable individuals when carrying out an assignment and delivering the agreed photographs to the client.

Photographs may be delivered through an online gallery or cloud-based service. The providers I currently use is Google via their Google Drive service, as well as Pixieset. Those providers may process personal information as necessary to host, store or deliver the images.

Using photographs for my own portfolio, website, social media, promotional material or publications is a separate matter from delivering them to a client. I will consider the applicable legal basis, any contractual restrictions, permissions and the circumstances of the assignment before using identifiable images for these purposes.

If you have a concern about a photograph appearing in my portfolio or promotional material, please contact me using the details below. I will assess your request in light of the applicable law, contractual arrangements and any relevant rights.

7. Website analytics, cookies and Google services

My website is hosted on Squarespace. I use Squarespace Analytics to understand website traffic and performance, subject to the features enabled on my site.

My Squarespace website is also connected to Google Search Console. This service provides information about how the website appears in Google Search. Its connection does not, by itself, establish that Google Analytics 4 is installed.

I have not confirmed that Google Analytics 4 or other third-party advertising tracking tools are installed, so I do not identify them here as active services.

My website displays a cookie banner with Accept and Decline options. Cookies and similar technologies may be used to operate the website, remember preferences, understand website usage or support other functions, depending on the technologies enabled.

Non-essential cookies and similar technologies will be handled in accordance with applicable consent requirements. I am reviewing the configuration to verify how analytics technologies respond to visitors' choices. The presence of a cookie banner alone does not establish that all technologies are correctly blocked before consent.

For more information about the cookies and technologies used on this website, please refer to the cookie information provided through the website and its consent controls.

8. Who I share information with

I do not sell personal information.

I may share information with service providers where reasonably necessary to operate my business and deliver photography services. These may include:

  • Squarespace, which hosts my website and provides website-related services and analytics.

  • Google Search Console, which provides search-performance information for my website.

  • Google via their service Google Drive, which hosts or delivers photographs.

  • Pixieset via its own payment partners, where needed to process payments.

  • Accountants, insurers, legal advisers or other professional advisers where appropriate.

  • Public authorities or other parties where disclosure is required by law or necessary to establish, exercise or defend legal claims.

The providers involved depend on the services used for a particular assignment. Their own privacy policies explain how they process information within their services.

9. International transfers

Some service providers may process or store personal information outside the United Kingdom. Where personal information is transferred internationally and UK data protection law requires safeguards, I will ensure that an appropriate transfer mechanism or other lawful safeguard is in place.

The relevant providers, locations and safeguards should be confirmed against the services actually used.

10. How long I keep information

I keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing services, maintaining business records, meeting legal obligations and resolving disputes.

My retention periods are as follows:

    • Enquiries that do not result in a booking: I generally retain enquiry records for up to 12 months after the last meaningful contact, unless I need them for a longer period to deal with an ongoing matter.

    • Client, booking and contractual records: I generally retain relevant records for up to 6 years after the end of the relevant contract or client relationship where necessary for business administration and potential legal claims.

    • Invoices and financial records: I retain these for the period required by applicable tax and accounting rules. Where the HMRC rules for self-employed records apply, this is generally at least 5 years after the 31 January submission deadline for the relevant tax year.

    • Photographs, original files and delivered images: I generally retain working files and delivered images for up to 12 months after final delivery. Longer retention may be agreed with a client or justified where necessary for an ongoing assignment, legal claim or other applicable purpose. I do not guarantee that photographs will be available indefinitely.

  • Website analytics information: according to the applicable analytics settings and provider retention controls.

Retention may vary depending on the assignment, contractual terms, legal requirements and whether a dispute arises. Where information is no longer needed, I will delete it or securely dispose of it where appropriate.

11. How I protect personal information

I take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No website, online service or method of electronic storage can be guaranteed to be completely secure. Access to information is limited where reasonably appropriate, and service providers may apply their own security measures.

12. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

  • Request access to personal information I hold about you.

  • Request correction of inaccurate or incomplete information.

  • Request deletion of your information.

  • Request restriction of processing.

  • Object to certain processing, including processing based on legitimate interests.

  • Request a copy of certain information in a portable format.

  • Withdraw consent where processing is based on consent.

  • Complain to the Information Commissioner's Office (ICO).

These rights are subject to legal conditions and exceptions. For example, I may need to retain certain records to comply with legal obligations.

To exercise your rights, contact me at studio@federicoperale.com. I may need to verify your identity before responding.

You can find information about making a complaint at ico.org.uk. You can also contact the ICO if you are concerned about how your personal information has been handled.

13. Third-party websites and services

My website or communications may contain links to external websites or services. I am not responsible for the privacy practices of third-party websites that I do not control. I recommend reviewing their privacy information before providing personal information to them.

14. Children's information

My services are not specifically directed at children through this website. Where an assignment involves photographing children, I will consider the circumstances, applicable law, client arrangements and any permissions or safeguards that are appropriate.

15. Changes to this policy

I may update this Privacy Policy when my business practices, website technologies or legal obligations change. The latest version will be published on this page, with the updated date shown at the top.

16. Contact

For questions about this Privacy Policy or the handling of personal information, contact:

Federico Perale
Email: studio@federicoperale.com
Address: 30 Kensington Park Gardens, W112QS London.