Privacy

1. Who I am

Riley Scott is a photographer working as a sole trader from Scottish Borders, United Kingdom. For the purposes of UK data protection law, Riley Scott is the data controller for the personal data described on this page.

The easiest way to reach me about anything on this page is by email: Email me. A postal address is available on request.

2. What this site collects

What you send me

When you use the enquiry form I collect your name, your email address, your company or studio if you give one, the kind of job it is, roughly where and when it is, and whatever you write in the message box. I collect it because you chose to send it, and I use it to answer you and to quote for the work.

What the server records

My hosting provider keeps ordinary web server logs, which include your IP address, the pages requested, the time, and your browser's description of itself. These are produced by the server rather than by me, and are used for security and for finding faults.

The enquiry form separately keeps a short-lived note that a message has been sent from your connection, so that one connection cannot flood the form. It holds a one-way code derived from your address rather than the address itself, and it is discarded after ten minutes. Your IP address is not stored alongside your enquiry.

If you have a client login

Photographs for a commission are shared through a private client area. If you are given access to it I hold your name and email address so I can send you a sign-in link, and a record of sign-in links issued so that one address cannot request an unlimited number of them. A sign-in link works once and expires after thirty minutes. This applies only to clients I have set up; nothing here affects an ordinary visitor.

When you open one of your galleries, the site notes the date and adds one to a count for that gallery, so I can tell that your photographs have reached you. Opening it again within half an hour counts as the same visit. Nothing else about the visit is recorded: not your IP address, not your device, and not which photographs you looked at.

If a client shares a gallery with you

A client can send the link to their gallery to friends or family from the client area. If someone has done that for you, they typed in your email address and the site sent you one email saying who it came from, with replies going to them rather than to me. Your address is used to send that one email and nothing else: it is not saved, it is not added to any list, and I will not write to you again. The only record kept is the time of each email, against the client who sent it, so that one account cannot send an unlimited number; it is discarded after an hour.

When a shared gallery is opened, the site notes the date and adds one to a count of visits through the shared link, in the same way as for the client. It does not record who opened it or anything about their device.

3. Cookies and tracking

The public pages of this site (the galleries, the home page and the contact page) set no cookies. There is no advertising pixel and no social media tracking. The typefaces are served from this website's own server rather than from a third-party font service, so opening a page does not disclose your visit to anyone but my host.

The home page does store one small thing on your device, and it is not a cookie: the name of the series you were last shown, so that the next time you arrive you are shown the other one rather than the same picture twice. It is a single word, it stays in your browser, it is never sent to me or to anyone else, and it says nothing about who you are. Clearing your browser's site data removes it.

The client area is the one exception. Signing in sets a single session cookie so the site can remember that it is you between one page and the next. It holds nothing but a random session identifier, it is marked so that it cannot be read by scripts or sent over an unencrypted connection, and it lasts twelve hours. A cookie that exists purely to keep you signed in is strictly necessary for a service you asked for, so it needs no consent banner. Beyond that cookie and the series name above, nothing is stored on your device.

My visitor counter

I do count visits, using my own counter that runs on this website. It is not Google Analytics or any other third-party service, so your browser never contacts another company in order to be counted. For each page view it records the page you looked at, the site that linked you here if you arrived from one, whether you were on a phone, tablet or desktop computer, the country the visit came from, roughly how many seconds the page was visible (up to about five), and whether you scrolled or tapped. Those last two exist so I can tell a real reader from an automated crawler, not to build a picture of you.

To count one person's visits within a single day without knowing who they are, I turn your IP address and browser description into a short code, mixed with a secret value that is regenerated every day and never saved. Your IP address itself is never written down by the counter. Because yesterday's secret no longer exists, one day's codes cannot be matched to the next day's, or worked back to you.

If your browser sends a Do Not Track signal, no visit is recorded at all.

4. Why I use it, and my lawful basis

What I do	Lawful basis
Reply to your enquiry and quote for the work	Legitimate interests: responding to someone who has approached me about commissioning photography
Photograph a commission, deliver the images and invoice for them	Performance of a contract with you
Run the client area so you can see and download your photographs	Performance of a contract with you
Send a gallery link to someone a client has chosen to share it with	Legitimate interests: letting a client show their photographs to the people they choose, at their request
Note when a client gallery is opened, so I know the photographs have arrived	Legitimate interests: knowing that work I have delivered has been received, using a date and a count rather than anything about the visitor
Count visits to this website, so I know it works and is being found	Legitimate interests: understanding how my own site performs, using information that does not identify you
Keep accounting and tax records	Legal obligation
Protect the website and the enquiry form from abuse	Legitimate interests: keeping the site secure and available

I do not sell your personal data, I do not share it for anyone else's marketing, and I do not use it for automated decision making or profiling.

5. How long I keep it

• Enquiries that do not become work: twelve months, then deleted automatically.
• Correspondence about a commission: twelve months after the job is finished.
• Client and job records, and invoices: six years from the end of the relevant accounting period, which is the period UK tax law requires business records to be kept for.
• Client area accounts: for as long as you have access to a gallery, and removed when that access ends.
• When a client gallery was opened: the date and the count are deleted with the gallery, or after twelve months in which it has not been opened, whichever comes first.
• Addresses a client shares a gallery with: not kept at all. The time of each share email is kept for one hour.
• Web server logs: kept by my hosting provider under its own schedule, not mine.
• Visitor counter: the per-visit records are deleted after ninety days. What remains is daily totals, which contain no identifiers at all.
• Enquiry form abuse records: ten minutes.

6. Who it is shared with

I keep the list of people who can see your data as short as I can. It currently covers:

• My hosting provider, which runs the server this website and its mailbox sit on. It acts as my processor and handles that data only on my instructions.
• Google, because the mailbox this site sends enquiries to is collected into a Gmail account, which is where I read and reply to it. Google therefore holds a copy of your message and your email address.
• My accountant, and HMRC, for invoicing and tax purposes.

I do not otherwise disclose your information unless I am legally required to.

Photographs of a building are not usually personal data, but if you appear in a frame and ask me not to publish it, I will not.

7. Where it is held

Your data is held in the United Kingdom and the European Economic Area, except where a supplier named above transfers it elsewhere under an approved safeguard such as the UK International Data Transfer Addendum or the UK extension to the EU-US Data Privacy Framework.

8. How I protect it

This website is served over HTTPS, and so is the client area. The enquiry form is protected by a hidden trap field that only automated submissions fill in, and a limit on how many messages one connection may send. Enquiry records are held outside the part of the server the web can reach. Signing in to the client area is by a single-use emailed link rather than a password, so there is no password of yours for me to lose.

No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, I will report it to the Information Commissioner's Office within 72 hours and tell you where the law requires it.

9. Your rights

Under UK GDPR you have the right to:

• ask what personal data I hold about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased, where I have no continuing reason to keep it;
• restrict or object to how I use it, including objecting to anything I do under legitimate interests;
• receive data you gave me in a portable, machine-readable form;
• withdraw consent at any time, where I relied on consent.

To exercise any of these, email me at the address in section 1. I will respond within one month, and there is normally no charge.

If you are unhappy with how I have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. I would appreciate the chance to put it right first.

10. Changes to this notice

If this notice changes I will update the date at the top of the page. Where a change materially affects how I use data you have already given me, I will contact you about it.