Privacy Policy

1. Data controller

Brightfox Photography Ltd is the controller for personal data collected through this website. Privacy enquiries: hello@brightfox-it.co.uk.

2. What we collect

• Contact details you submit: name, email, company and message content.
• Correspondence with our sales and support teams.
• Technical data: IP address, browser type, device type, pages viewed and referring source, collected in aggregate.
• Cookie preferences you set through our banner.

We do not intentionally collect special category data through this website, and we ask that you do not include it in enquiry messages.

3. Why we use it

• To answer enquiries and prepare quotations (legitimate interests).
• To deliver and support contracted services (performance of a contract).
• To keep our systems secure and prevent abuse (legitimate interests).
• To meet accounting and legal obligations (legal obligation).
• To measure site performance where you have accepted analytics (consent).

4. Client data we process on your behalf

When delivering IT services we may process personal data held in your systems. In those cases we act as a processor under a written data processing agreement, follow your documented instructions, apply least-privilege access and log engineer activity.

5. Sharing

We share data only with service providers who help us operate — hosting, email, ticketing, accounting — each bound by contract. We do not sell personal data. We may disclose information where required by law.

6. International transfers

Data is held in the European Economic Area wherever possible. If a provider transfers data elsewhere, we rely on applicable adequacy regulations or the International Data Transfer Addendum with appropriate safeguards.

7. Retention

Enquiries are kept for up to twenty-four months from the last contact. Client records and invoices are kept for seven years to meet applicable tax requirements. Technical logs are kept for up to twelve months.

8. Your rights

Under applicable data protection law you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time. Contact us and we will respond within one month. You may also complain to the relevant supervisory authority.

9. Security

We apply multi-factor authentication, encryption in transit and at rest, hardened endpoints, restricted administrative access and regular backups tested through recovery drills.

10. Cookies

Details of the cookies we use and how to change your choice are set out on our cookie policy page.