Privacy Policy

Last updated: 07.08.26

This policy explains how Kyle O’Donnell ("I", "me", "my") collects, uses and protects personal data when you visit www.kyle-odonnell.co.uk, make an enquiry, purchase from me, or engage me for film and photography work.

I am the data controller for the personal data described in this policy.

Contact details

  • Email: info@kyle-odonnell.co.uk

  • Postal address: 38 Lynwood Avenue, IP119HS

  • ICO registration number:  00014807724

1. The personal data I collect

When you contact me or make an enquiry Your name, email address, telephone number, and any information you choose to include in your message — typically details about a project, budget, timescale or location.

When you engage me for a project Contact and billing details, project briefs and correspondence, contract and invoicing records, call sheets, location details, and details of other people involved in a production where you supply them.

When you buy from my online shop Your name, email address, billing and delivery address, order history, and the items purchased. Card payments are processed directly by my payment provider — I do not receive or store full card numbers.

When you subscribe to my mailing list Your name and email address, plus records of whether emails were opened or links clicked, which helps me judge whether the content is worth sending.

When you visit the website IP address, browser and device type, referring page, pages viewed and time spent. This is collected through cookies and similar technologies. See section 8.

Photographic and video material Images and footage may show identifiable individuals. Where a person can be recognised, that material is personal data and is treated as such under this policy. Where I photograph or film someone for commercial use, I will normally ask for a signed release, and I will explain at the time how the material is intended to be used.

Special category data I do not seek to collect data revealing health, ethnicity, religion, political opinions, sex life or sexual orientation, or trade union membership. Occasionally an image or a project brief may imply such information. Where this happens I rely on your explicit consent, obtained separately, and I limit use of the material to what has been agreed.

2. Why I use it, and my lawful basis

PurposeLawful basisResponding to enquiriesLegitimate interests — replying to someone who has contacted meDelivering a commissioned projectPerformance of a contractProcessing and fulfilling ordersPerformance of a contractAccounting, tax and statutory recordsLegal obligationSending marketing emailsConsent, or the soft opt-in for existing customersDisplaying work in my portfolioConsent, or legitimate interests where agreed in the contractWebsite analytics and performanceConsent, given through the cookie bannerDefending or bringing legal claimsLegitimate interests

Where I rely on legitimate interests, I have considered whether my interest is overridden by your rights, and I have concluded it is not. You can object to this processing at any time — see section 7.

3. Portfolio and promotional use

Showing completed work is central to how I win new business. Unless we have agreed otherwise in writing, I may display work I have produced on my website, showreel, social media accounts and in pitch materials.

If you would prefer that a project or your image is not shown publicly, tell me and I will honour that. Where a commission involves confidential material, an unreleased product, or images of children, I will not publish anything without written agreement.

4. Who I share data with

I share personal data only where necessary, and only with organisations that process it on my instructions:

  • Website hosting and e-commerce: [Squarespace / other]

  • Payment processing: [Stripe / PayPal / other]

  • Email and file storage: [Google Workspace / Microsoft 365 / other]

  • Email marketing: [provider]

  • Analytics: [Google Analytics / Squarespace Analytics / other]

  • Accounting: my accountant and, where required, HMRC

  • Production crew: where a project requires second shooters, editors, retouchers or assistants, they receive only the information needed to do the work

I do not sell personal data, and I do not share it for third-party advertising.

5. International transfers

Some of the providers above are based outside the UK, principally in the United States. Where personal data is transferred internationally, it is protected by an approved safeguard — usually the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.

6. How long I keep it

DataRetention periodEnquiries that do not become projects12 monthsClient contracts, correspondence and invoices7 years from the end of the tax year, to meet HMRC requirementsModel and location releasesFor as long as the material remains in use, plus 6 yearsProject footage and image archives[STATE YOUR PERIOD — e.g. 3 years, unless a licence requires longer]Mailing list dataUntil you unsubscribe, or after 24 months of no engagementWebsite analytics[PERIOD — commonly 14 or 26 months]

7. Your rights

Under UK data protection law you have the right to:

  • Access the personal data I hold about you

  • Rectify data that is inaccurate or incomplete

  • Erase your data, where there is no overriding reason for me to keep it

  • Restrict how I use it while a concern is being resolved

  • Object to processing based on legitimate interests, including direct marketing

  • Portability — receive data you provided in a machine-readable format

  • Withdraw consent at any time, where consent is the basis for processing

To exercise any of these, email me at [EMAIL ADDRESS]. I will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Note that erasure is not absolute. Where I am required to keep financial records, or where material forms part of a licensed body of work, I may need to retain some data and will explain why.

8. Cookies

The site uses cookies that are strictly necessary for it to function — these do not require consent. It also uses [analytics / marketing] cookies, which are only set once you accept them through the banner shown on your first visit.

You can change or withdraw your cookie preferences at any time via [LINK TO COOKIE SETTINGS], and you can block or delete cookies through your browser settings, though some parts of the site may then not work correctly.

9. Security

I take reasonable technical and organisational measures to protect personal data, including encrypted storage, access controls on devices and accounts, multi-factor authentication where available, and secure transfer for large media files. No system is completely secure, but I will notify you and the ICO of any breach that poses a risk to your rights, within 72 hours of becoming aware of it.

10. Children

My services are not directed at children. Where a commission involves photographing or filming anyone under 18, I obtain written consent from a parent or guardian before the shoot, and I do not publish such material without separate, specific agreement.

11. Changes to this policy

I may update this policy from time to time. The current version will always be available at this address, with the date of the last revision shown at the top.

12. Complaints

If you are unhappy with how I have handled your personal data, please contact me first so I can try to put it right.

You also have the right to complain to the Information Commissioner's Office:

  • Website: ico.org.uk

  • Helpline: 0303 123 1113

  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF