Last updated: September 2026
Our Commitment
rain-loft is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We process personal data lawfully, fairly, and transparently.
Data Controller
rain-loft acts as the data controller for personal information collected through this website and during the provision of our photography services. We determine the purposes and means of processing personal data.
Lawful Basis for Processing
We only process personal data where we have a valid lawful basis:
- Consent: When you voluntarily provide information through our contact forms
- Contract: When processing is necessary to fulfil a photography commission
- Legal obligation: When required to comply with applicable laws
- Legitimate interests: For business operations that do not override your fundamental rights
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right to Access
You may request a copy of the personal information we hold about you. We will respond within one month of receiving your request.
Right to Rectification
If personal information we hold is inaccurate or incomplete, you have the right to request correction.
Right to Erasure
In certain circumstances, you may request deletion of your personal data. This applies when data is no longer necessary for its original purpose or when you withdraw consent.
Right to Restrict Processing
You may request that we limit how we use your personal data while concerns are being investigated.
Right to Data Portability
Where technically feasible, you may request your personal data in a structured, commonly used format.
Right to Object
You may object to processing based on legitimate interests or for direct marketing purposes.
Data Protection Measures
We implement appropriate security measures including:
- Secure storage of digital files
- Access controls limiting data to authorised personnel
- Regular review of data processing activities
- Staff awareness of data protection responsibilities
International Transfers
We do not routinely transfer personal data outside the United Kingdom. Should such transfer become necessary, appropriate safeguards will be implemented.
Data Breach Procedures
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.
Supervisory Authority
If you are dissatisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Contact Us
For data protection enquiries or to exercise your rights, please contact us at [email protected]