Our policiesOur policies

KD Studios is a photography and content studio in Lincoln. We are responsible for the personal information described here (the “controller” under UK data protection law).

To ask about your information, or to see, change or delete it, email hello@kdstudios.uk.

• Bookings: your name, email address, mobile number, what the session is for, how many people are coming, any notes you add, and the date and time you book.
• Payments: card payments are taken by Stripe. We never see or store your card details; we keep a record of what you paid and any refund.
• Memberships: your name, email address, mobile number, your plan and its payment status.
• Gift cards: the buyer’s name and email address, the recipient’s name, their email address if given, and the message.
• Event enquiries and questions: your name, email address, mobile number, the details of your event or your question, and our replies.
• Mailing list: your email address, only if you sign up.
• Photo galleries: the photos from your shoot, and the ones you pick.
• Using this website: your IP address and browser type are recorded when you book, change or cancel a booking, or take a similar action, so we keep an accurate record and can stop misuse. Our visitor statistics count page views without cookies and without identifying you.

• Your booking: taking your booking and payment, and sending your confirmation, a reminder, your lockbox code and a short thank-you afterwards. This is to carry out our contract with you.
• Replying to you: answering event enquiries and questions, at your request, before you book.
• Our newsletter: only with your consent. Every newsletter has an unsubscribe link.
• Records: keeping our accounts and booking records, as the law requires.
• Security: keeping this website safe and stopping spam and misuse, which is in our legitimate interests.

We don’t use your booking contact details for marketing, and we never sell your information.

We share only what each service needs to do its job for us. They act on our instructions and must keep your information safe.

• Stripe: card payments, refunds and membership billing.
• Brevo: sending our emails and holding the mailing list.
• Vercel: hosting this website, which runs in London.
• Neon: our database, stored in London.
• Cloudflare: storing photo gallery files.
• Google: when the studio’s Google Calendar is connected, each booking (your name, contact details, the time and your notes) is added to the studio’s own calendar.
• OpenStreetMap: the map on our pages loads from OpenStreetMap, which sees your IP address but sets no tracking cookies.

We also share information when the law requires it. Some of these services are based outside the UK, for example in the United States. Where your information is handled there, it is protected by safeguards recognised under UK law.

The studio’s dashboard can connect to the studio’s own Google Calendar. Only KD Studios staff connect it. Customers never sign in with Google, and we never access a customer’s Google account.

• What we access: the connected Google account’s email address, and the events in its main calendar.
• How we use it: we read when events start and end, so times when Kola is busy can’t be booked for a photoshoot, and we add, update and remove calendar events for studio bookings.
• What we keep: the account’s email address, its access token (stored encrypted) and the ID of each calendar event we create. Event titles and details read from the calendar are used only to work out busy times and are not saved.
• What we don’t do: Google user data is never sold, used for advertising or used to train AI models, and is not passed to anyone else unless the law requires it.
• Disconnecting: the studio can disconnect the calendar at any time from the dashboard, or from the Google Account’s third-party connections page. The stored access token is then deleted.

KD Studios’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Photo galleries: deleted automatically 30 days after we create them, or 60 days if we extend them.
• Booking, payment, membership and gift card records: as long as we need them for your bookings and to meet UK tax and accounting rules.
• Event enquiries and questions: as long as we need to deal with them.
• Mailing list: until you unsubscribe.

We use only the cookies this website needs to work. There are no advertising or tracking cookies, so we don’t ask you to accept any.

• Members: keeps you signed in to your membership, for 30 days.
• Photo galleries: remembers that you’ve entered your gallery code, until the gallery closes.
• Studio staff: keeps staff signed in to the studio dashboard.

Stripe’s payment page sets its own cookies to prevent fraud.

This website only works over a secure connection, and card details go straight to Stripe. Passwords and gallery codes are stored only in a form that can’t be read back, the Google Calendar token is encrypted, and only KD Studios staff can open the studio dashboard.

Under UK data protection law you can ask us to:

• Show you the personal information we hold about you.
• Correct anything that’s wrong.
• Delete your information, where the law doesn’t require us to keep it.
• Limit or stop how we use it.
• Give you a copy to take elsewhere.

You can withdraw your consent to our newsletter at any time. Email hello@kdstudios.uk and we’ll reply within one month.

If you’re unhappy with how we handle your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

If we change how we use your information, we’ll update this page and the date at the top.