Skip to Content

Privacy Policy

Last updated: 4 November 2026

1. Who we are

Lux Photo is a trading name of Pro Technologies Limited, registered in England and Wales (No. 08184949), registered office 35 Wild Rose House, 3 Firwood Lane, Romford RM3 0FQ. Pro Technologies Limited is the controller of personal data collected through lux-photo.co.uk. ICO registration number: ZC265493.

Contact for privacy questions: privacy@lux-photo.co.uk.

2. What we collect

  • When you fill in a form on this website: your name, email address, phone number if you give it, and what you write in the form.
  • Emails, WhatsApp messages and other messages you send us, and our replies.
  • When you order: your name, email, phone, billing and delivery address, and what you ordered. We do not see or store your card details — payments are made through PayPal, by bank transfer, in cash on delivery or in cryptocurrency.
  • If you create an account: your login details and your order history.
  • Technical data: your IP address and browser details in our hosting provider’s server logs.

3. How we use it and why

  • To answer your enquiry and prepare a quote — our legitimate interest in answering enquiries, and steps before a contract.
  • To provide what you ordered, and to keep you informed about it — performance of our contract with you.
  • To keep accounting records — legal obligation.
  • To protect our website, forms and systems from abuse and automated requests (technical logs, Cloudflare Turnstile) — our legitimate interest in security.

We do not send marketing emails unless you ask to receive them, and you can unsubscribe at any time.

Your photographs. Photographs we take for you are used only for your order. Finished photos are available to download for 30 days after delivery, unless agreed otherwise; original files are kept for 90 days after the shoot. After these periods we delete them. Photos you have agreed we may use in our portfolio are kept separately, for that purpose only. We publish a photograph in our portfolio only with your consent.

Chat. The first replies in our website chat are written by an AI assistant. Your chat messages are sent to OpenAI to produce those replies. Please do not share passwords, card numbers or health information in the chat. Conversations are kept in our system (Odoo) and can be read by our team.

AI tools used by our team. Our team uses AI assistants — Claude (made by Anthropic) and ChatGPT (made by OpenAI) — to work with our records and prepare replies, for example to find an order or draft an answer to your message. They receive only the information needed for the task. A member of our team checks and approves anything that is sent to you or changed in your records.

4. Cookies and similar technologies

This website uses only the cookies it needs to work: a session cookie (sign-in), a cookie that remembers your language, and one that remembers your time zone. We do not use Google Analytics, advertising cookies or tracking pixels.

We do not collect statistics of visits to our pages. The technical data in our hosting provider’s server logs (section 2) is used only to keep the website working and secure.

Our pages load fonts from Google Fonts; to deliver them, Google receives your IP address.

You can delete or block cookies in your browser settings; if you block the cookies above, signing in and your language choice will not work.

5. Who we share it with

  • Odoo S.A., which hosts our website and business database (Odoo Online) in Europe.
  • Our own mail server, which we run on a server rented from IONOS in the UK, to send and receive emails.
  • OpenAI, which produces the AI assistant’s replies in our website chat and provides ChatGPT, which our team uses to work with our records and prepare replies.
  • Anthropic, which provides Claude, which our team uses to work with our records and prepare replies.
  • Meta (WhatsApp), only if you choose to contact us on WhatsApp.
  • PayPal, when you pay with PayPal, and our bank, when you pay by bank transfer.
  • Cloudflare, which protects our forms from automated requests (Turnstile). When a page with a form loads, Turnstile checks technical signals from your browser and device, such as your IP address and browser characteristics; it does not receive what you type into the form. See Cloudflare’s Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
  • Professional advisers and authorities where the law requires it.

These providers receive only the data they need to provide their service. We do not sell personal data. Where a provider processes data outside the UK, the transfer is protected by the safeguards required by UK data protection law.

6. How long we keep it

  • Enquiries that do not lead to an order: 24 months after our last contact, then deleted.
  • Orders, invoices and payments: 6 years after the end of the financial year they relate to, as required by HMRC and the Companies Act.
  • Photographs: Finished photos are available to download for 30 days after delivery, unless agreed otherwise; original files are kept for 90 days after the shoot. After these periods we delete them. Photos you have agreed we may use in our portfolio are kept separately, for that purpose only.
  • Chat conversations: 12 months, then deleted.
  • After deletion from our live system, data may remain in Odoo’s secure backups for up to 12 months, until those backups are automatically destroyed.
  • Technical logs: on our mail server, system and service logs, mailbox and control-panel sign-ins are kept for up to 90 days, and server sign-in records for up to 3 months; in our business system (Odoo Online), Odoo keeps server and security logs for up to 12 months.

7. Your rights

Under UK data protection law you can ask for access to your data, correction, deletion, restriction or portability, and you can object to our use of it. Write to privacy@lux-photo.co.uk. You can also complain to the Information Commissioner’s Office: ico.org.uk.

8. Security

We protect personal data with appropriate technical and organisational measures, and access to it is limited to the people who need it.

9. Changes

We may update this policy; the date at the top shows the latest version.