Privacy Policy

Last updated: 1st September 2026

Candid Studio is run by Rebecca Lloyd. I'm a graphic designer, web designer and brand photographer working with small businesses across South Wales.

This policy explains what personal information I collect, why I collect it, what I do with it and what rights you have over it. I've tried to write it in plain English rather than legalese, because a privacy policy nobody can read isn't much use to anyone.

For the purposes of UK data protection law, the data controller is: Rebecca Lloyd, Candid Studio, 14, CF382HQ, hello@candidstudio.co.uk

The short version

I collect your details when you get in touch, become a client, or sign up to my newsletter.
I don't sell your data. Ever. To anyone.
I use a small number of trusted services (Mailchimp, Google Analytics, my hosting) to run the business, and they process some of your data on my behalf.
You can unsubscribe, ask what I hold about you, or ask me to delete it, at any time.

What I collect and why

If you get in touch

When you email me, fill in a contact form or book a call, I collect your name, email address, and whatever else you choose to tell me about your business and your project.

Why: to reply to you and work out whether I'm the right fit for what you need.

Lawful basis: legitimate interests (responding to an enquiry you made), and where things progress, taking steps to enter into a contract with you.

How long I keep it: enquiries that don't become projects are deleted after [12 months].

If you become a client

I'll collect your contact details, business details, billing information, and any content you send me for the project — copy, images, logins, brand materials.

Why: to deliver the work, invoice you and keep proper business records.

Lawful basis: performance of a contract, and legal obligation for anything I'm required to keep for tax purposes.

How long I keep it: financial records for six years after the end of the tax year they relate to, as HMRC requires. Project files and working artwork for [2 years] after a project ends, unless you ask me to remove them sooner.

If I photograph you or your business

Brand photography means I'll hold images of you, your team, your premises and your products.

Why: to deliver the shoot, and — where you've agreed to it — to show the work in my portfolio, on social media and in marketing materials.

Lawful basis: performance of a contract for the shoot itself. For portfolio and marketing use, consent, which you give in your shoot agreement and can withdraw at any time by emailing me.

How long I keep it: edited images indefinitely as part of my portfolio archive unless you withdraw consent. Raw unedited files for [12 months] after delivery.

If you subscribe to my newsletter

Covered in full in the next section, because it's the one people ask about most.

When you visit the website

My site uses cookies and analytics to understand how people find and use it. See Cookies and analytics below.

Newsletter and email marketing

When you subscribe, I collect your first name and email address, and I record your consent to receive the newsletter.

Alongside that, Mailchimp automatically records the date and time you signed up, the IP address you signed up from, and a snapshot of the form as you completed it. That's not me being nosy — UK data protection law requires me to be able to demonstrate that you actually consented, and that record is the proof.

Why I collect it

To send you my newsletter: occasional emails about branding, design, websites and running a small business. That's the only thing I use it for. I won't add you to anything else, and I won't pass your details to anyone for their own marketing.

Lawful basis

Consent. You ticked a box that wasn't ticked for you, and you can untick it — permanently — whenever you like.

New subscribers also go through double opt-in, which means you'll get an email asking you to confirm before anything else is sent. If you don't confirm, you don't get added.

Mailchimp

I use Mailchimp (operated by The Rocket Science Group LLC, part of Intuit Inc.) to store my subscriber list and send my emails. Mailchimp is a data processor acting on my instructions — I remain responsible for your data.

Mailchimp is based in the United States, so subscribing means your name and email address are transferred outside the UK. That transfer is covered by Mailchimp's certification under the UK Extension to the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses in place as a fallback in its Data Processing Addendum.

You can read Mailchimp's privacy practices and their terms on their site.

Email tracking

My emails contain a small tracking pixel that tells me whether an email was opened, and links that record whether they were clicked. I use this to work out which topics are actually worth writing about and to stop emailing people who clearly aren't interested.

If you'd rather not be tracked, most email clients let you block remote images, which stops the pixel loading.

How long I keep it

Until you unsubscribe.

When you unsubscribe, Mailchimp keeps a record of your email address on a suppression list. That sounds counterintuitive, but it's what stops you being accidentally re-added if you ever end up on another list of mine. If you'd rather be erased entirely, email me and I'll do it.

Getting off the list

Every email has an unsubscribe link in the footer. One click, done, no hard feelings. Or email me at hello@candidstudio.co.uk and I'll take care of it.

Withdrawing consent doesn't affect anything I sent before you withdrew it.

Cookies and analytics

My website uses cookies — small files stored on your device — for two purposes:

Essential cookies keep the site working. These don't need your consent.

Analytics cookies tell me how many people visit, which pages they read and roughly where they came from. I use [Google Analytics 4 via Google Tag Manager] for this. These only load if you agree to them via the cookie banner.

You can change your mind at any time through [the cookie settings link in the footer / your browser settings].

My site is built and hosted on Framer, which processes limited technical data such as your IP address in order to serve the site to you.

Who else sees your data

I keep the list of third parties deliberately short. Currently:

Mailchimp (Intuit)
Newsletter delivery and subscriber list US — UK Extension to the EU-U.S. Data Privacy Framework.

Framer
Website hosting [US / EU]

Google (Analytics, Tag Manager)
Website analytics US — UK Extension to the EU-U.S. Data Privacy Framework.

Monzo
Invoicing and financial records – UK

Google Drive, Blackblaze, external hard drives
Storing client files – US & UK

Pixieset
Storing client photography and footage

My accountant
Preparing accounts and tax returns – UK

I may also share information where I'm legally required to — for example if HMRC, a court or the police requests it.

I don't sell your personal data, and I don't share it with anyone for their own marketing purposes.

Transfers outside the UK

Some of the services above are based in the United States. Where that's the case, transfers are protected either by the UK Extension to the EU-U.S. Data Privacy Framework — a partial adequacy decision that lets UK organisations transfer data to certified US businesses — or by the International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

Keeping it safe

I use reputable providers with their own security measures, keep devices and accounts protected with strong passwords and two-factor authentication, and only collect what I actually need.

No system is completely secure, and I won't pretend otherwise. But if there's ever a breach that puts your rights at risk, I'll tell you and the ICO, as I'm required to.

Your rights

Under UK data protection law you have the right to:

Be informed about how your data is used — that's what this document is for.
Access a copy of the personal data I hold about you.
Rectification — have anything inaccurate corrected.
Erasure — ask me to delete your data, in most circumstances.
Restrict processing — ask me to pause using it while something is sorted out.
Data portability — receive your data in a portable format.
Object to processing based on legitimate interests.
Object to direct marketing at any time. This one is absolute — if you object, I stop, no questions and no balancing exercise.
Withdraw consent at any time, where consent is what I'm relying on.

To exercise any of these, email me at hello@candidstudio.co.uk. I'll respond within one month. It's free unless a request is clearly excessive or unfounded.

Complaints

If you're unhappy with how I've handled your data, please tell me first — I'd genuinely rather fix it.

If that doesn't resolve it, you can complain to the Information Commissioner's Office:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint

Children

My services are aimed at businesses, and I don't knowingly collect data from anyone under 16. If you think a child has given me their details, email me and I'll delete them.

Changes to this policy

I'll update this page when the way I work changes. The date at the top tells you when it was last revised. If I make a change that materially affects how I use your data, I'll let subscribers know by email.