GDPR Compliance Statement

Last Updated: September 29, 2026

Controller Information

Storm-reach acts as the data controller for personal information collected through this website and during the provision of photography services.

Contact details:
Storm-reach
47 Clerkenwell Road
London EC1M 5RS
United Kingdom
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases as defined by the General Data Protection Regulation:

• Contractual necessity: Processing is necessary to perform photography services you have requested or to take steps prior to entering into a service agreement
• Legitimate interests: Processing is necessary for our legitimate business interests, such as responding to inquiries, maintaining business records, and improving service quality
• Legal obligation: Processing is required to comply with legal and regulatory requirements, including tax reporting and business record retention
• Consent: Where required, we obtain explicit consent before processing personal data for specific purposes

Data Categories and Processing Activities

Contact and Inquiry Data

We collect names, email addresses, and project details submitted through consultation forms. This data is processed to respond to inquiries and prepare service proposals.

Client Project Data

For active projects, we maintain records including contact information, project addresses, scheduling details, contractual agreements, and payment information. This data is processed to deliver photography services and maintain business records.

Technical Data

Website server logs automatically collect IP addresses, browser information, and page access patterns. This data is processed for security monitoring and website performance optimization.

Data Retention

Personal data is retained only as long as necessary for the purposes outlined above:

• Inquiry data without resulting engagement: retained for 12 months
• Client project records: retained for 7 years following project completion
• Technical logs: retained for 90 days
• Financial records: retained for 7 years to comply with tax legislation

Your Rights Under GDPR

Right of Access

You have the right to request confirmation of whether we process your personal data and to receive a copy of that data along with information about how it is processed.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete personal data.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to processing. This right is subject to legal retention obligations.

Right to Restriction of Processing

You may request that we restrict processing of your personal data in specific circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You may object to processing of your personal data based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects.

Exercising Your Rights

To exercise any of these rights, submit a request to [email protected]. We will respond within one month of receiving your request. Complex requests may require up to three months, in which case we will inform you of the extension and the reasons for it.

We may request additional information to verify your identity before fulfilling rights requests.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit using TLS protocols
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Secure backup procedures
• Staff training on data protection principles

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR.

International Data Transfers

Personal data is stored and processed within the United Kingdom and European Economic Area. We do not transfer personal data to countries outside these jurisdictions.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection matters:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our data processing activities or legal requirements. Material changes will be communicated through prominent website notification.