Privacy Policy

Meg McCoy Media ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal data when you visit our website at megmccoymedia.com or engage our photography and videography services. We are based in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

The data controller responsible for your personal data is Meg McCoy, trading as Meg McCoy Media. If you have any questions about this policy or how your data is handled, please contact us at megmccoymedia@gmail.com.

What Personal Data We Collect

We may collect the following personal data:

• Contact form submissions: Your name, email address, phone number (optional), and message content when you use the contact form on our website.
• Client account data: Your name, email address, and a securely hashed password when we create a client gallery account for you.
• Session and booking information: Details you provide when arranging a photography session, including names, locations, dates, and any specific requirements.
• Photographs and video: Images and video footage captured during sessions, which may contain identifiable individuals, horses, and locations.
• Technical data: Your IP address and browser information may be logged by our web server for security and rate-limiting purposes. We do not use analytics tracking or advertising cookies.

How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries: To reply to messages submitted through our contact form.
• Providing our services: To plan, carry out, and deliver photography and videography sessions, and to provide access to your private client gallery.
• Portfolio and marketing: With your explicit consent, we may use selected images from your session in our portfolio, website, and social media. You can withdraw this consent at any time.
• Security: To protect our website from abuse, including rate-limiting contact form submissions and login attempts.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you submit the contact form or agree to the use of your images in our portfolio.
• Contract: When processing is necessary to fulfil a photography booking or provide access to your client gallery.
• Legitimate interest: For website security, including server logging and rate limiting.

How We Store and Protect Your Data

• Website data: Contact form submissions and client account data are stored in a secure database on our hosting server. Passwords are stored using bcrypt hashing and are never stored in plain text.
• Client galleries: Your photographs are stored securely via Google Drive using a service account with restricted access. Gallery links are private and require authentication.
• Email communications: Enquiries and booking correspondence are handled via email and retained for as long as necessary to fulfil the purpose of the communication.
• Security measures: Our website uses HTTPS encryption, secure authentication tokens, and rate limiting to protect your data in transit and at rest.

Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. Your data may be processed by the following service providers who act as data processors on our behalf:

• Hosting provider: Our web hosting provider stores website data on servers secured under their own data protection policies.
• Google Drive: Client gallery images are stored via Google's cloud infrastructure, subject to Google's data processing terms.
• Email provider: Contact form notifications and client communications are sent via SMTP email services.

Data Retention

• Contact form data: Retained for up to 12 months after the enquiry is resolved, then deleted.
• Client gallery accounts: Retained for the duration of our working relationship. You may request deletion of your account at any time.
• Photographs: Retained in accordance with our client agreement. Typically, galleries are kept available for a minimum of 12 months following delivery.
• Server logs: IP addresses in rate-limiting logs are automatically purged and are not retained beyond their temporary security purpose.

Cookies

Our website does not use analytics cookies, advertising cookies, or third-party tracking. We use browser local storage to maintain your login session if you are an authenticated client. This is a strictly necessary function and does not require consent under the Privacy and Electronic Communications Regulations (PECR). No cookie consent banner is required for our current use.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data, subject to any legal obligations we may have to retain it.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at megmccoymedia@gmail.com.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

Last updated: April 2026