Privacy Policy

1.1. We respect your privacy and aim to process personal data responsibly, transparently and only to the extent necessary to operate DreamPhotographer and provide its services.

1.2. DreamPhotographer is operated by Saulius Kutka trading as KUTKA, based in the United Kingdom. Saulius Kutka trading as KUTKA is the data controller for personal data processed through the Portal and determines the purposes and means of that processing.

1.3. This Privacy Policy applies to visitors, registered visitors and Photographers who use DreamPhotographer or its services.

1.4. This Privacy Policy explains what personal data we process, why we process it, the lawful bases we rely on, how long data is kept, who it may be shared with and the rights available to individuals.

1.5. This Privacy Policy applies only to personal data processing carried out by DreamPhotographer. It does not apply to third-party websites or services that may be linked from the Portal.

1.6. We process personal data in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR).

1.7. The Terms of Use and other notices published on DreamPhotographer supplement this Privacy Policy where they deal with related matters.

The following terms are used in this Privacy Policy:

Controller – Saulius Kutka trading as KUTKA, the operator of DreamPhotographer and the controller of personal data processed through the Portal.

Portal – the dreamphotographer.uk online platform, which enables Photographers to present their services and Visitors to discover and contact Photographers.

Visitor – a person who uses the Portal without creating an account.

Registered Visitor – a person who has created a visitor account and can use features available to registered visitors.

Photographer – a person who uses a photographer account and publicly presents their professional activity, services and work on the Portal.

User – a general term which, depending on context, may refer to a Visitor, Registered Visitor or Photographer.

Personal data – any information relating to an identified or identifiable living individual.

Data subject – the individual whose personal data is processed.

Processing – any operation performed on personal data, including collection, recording, storage, use, alteration, disclosure, restriction, anonymisation or deletion.

Other capitalised terms have the meanings given in the Terms of Use unless this Privacy Policy states otherwise.

3.1. We process only personal data that is necessary to operate the Portal, provide services, maintain security, comply with legal obligations, or that a User chooses to provide. The data processed depends on how the User uses DreamPhotographer.

3.2. For registration, account administration and authentication we may process:

• name and surname;
• email address;
• phone number, where provided;
• account or profile image;
• account identifiers, status and settings;
• authentication and account-security information;
• account identification data received from an external authentication provider such as Google or Facebook;
• information required for account recovery and identity verification.

3.3. When a Photographer creates or manages a Profile, Portfolio, Offers or other public content, we may process:

• profile and professional information;
• contact details;
• postcode and location information used to establish a Photographer's base location;
• Service Areas;
• services and Offers;
• Portfolio images and other visual material uploaded to the Portal;
• pricing and other service information;
• frequently asked questions;
• website and social-media links;
• other information voluntarily provided by the Photographer.

3.4. When Users use communication and content features, we may process:

• enquiries and conversation data;
• reviews, comments and ratings;
• for Fan Gifts, the displayed name, anonymity preference and message to the Photographer;
• other information voluntarily submitted or created through interactions between Users.

3.5. When Users purchase paid services, Credits or Fan Gifts, we may process:

• details of Portal services purchased or activated;
• payment amount, currency, date and status;
• billing details required for invoices, including name or business name, address, town or city, postcode, country, email address and phone number;
• invoice, credit-note and payment history;
• payment-provider transaction and session identifiers;
• information about Credits purchased, received and used;
• Premium and Boost activation and validity information;
• Fan Gift amount, recipient, Credits granted, status and other information required to administer the gift.

DreamPhotographer does not store full payment-card numbers or complete card details. These are processed by the relevant payment service provider in its own environment.

3.6. To operate, secure, analyse and improve the Portal, we may process technical and usage data including:

• IP address;
• browser and device information;
• login and session information;
• information about Portal usage and actions performed;
• traffic and page-view statistics;
• security logs, technical errors and other technical information needed to operate and protect the Portal.

3.7. Some personal data is required to provide particular Portal functions or to comply with legal obligations. If required information is not provided, the relevant feature or service may not be available.

3.8. DreamPhotographer does not ask Users to provide special category data, such as health information, political opinions, religious or philosophical beliefs, trade-union membership, genetic data or biometric data. Users should not submit such information in free-text fields unless it is genuinely necessary and lawful to do so.

4.1. We primarily obtain personal data directly from Users when they register, manage an account or Profile, publish Content, submit enquiries, make payments, use Portal features or contact us.

4.2. Some information is collected automatically when the Portal is used, through cookies or similar technologies, server logs and other technical measures. This may include device, browser, IP address, login, session and usage information.

4.3. We may receive personal data from third-party service providers used for authentication, payments, email delivery, hosting or other Portal functions. This may include account identifiers, email addresses, payment status, transaction identifiers and other information necessary to provide the relevant feature.

4.4. We may also receive information about a person from another User, for example where someone sends an enquiry, submits a review or Fan Gift, or provides information relating to another User.

4.5. If a User provides personal data about another person, that User must ensure they are entitled to provide it and that doing so does not infringe the other person's rights or applicable law.

5.1. We process personal data only for lawful, specific and legitimate purposes.

5.2. Personal data may be processed to:

• create and administer accounts, authenticate Users, verify identity where necessary, restore account access and protect account security;
• enable Photographers to create, manage and publicly present Profiles, services, Portfolios, Offers and other Content;
• enable Users to communicate, submit enquiries, reviews, comments and ratings, and use other interaction features;
• process and administer payments, Credit purchases, Premium, Boost and Fan Gifts, and issue or manage invoices, credit notes and refunds;
• record the receipt, validity and use of Credits and activation of paid Portal features;
• send account, security, payment and service-related communications;
• provide support and respond to enquiries;
• operate, secure and maintain the Portal and detect or prevent fraud, misuse, unauthorised access and other security incidents;
• moderate Content and enforce the Terms of Use;
• analyse Portal usage, produce internal statistics and improve functionality;
• comply with legal obligations, maintain business and tax records, resolve disputes and establish, exercise or defend legal claims.

5.3. We do not currently make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on Users, except where such processing is permitted or required by law.

5.4. We do not use personal data for purposes that are incompatible with those described in this Privacy Policy unless there is an appropriate lawful basis and, where required, consent.

6.1. We process personal data only where a lawful basis under applicable UK data protection law applies.

6.2. Contract. We process data where necessary to enter into or perform a contract with a User, including creating and administering accounts, providing Portal services, activating paid features and administering payments.

6.3. Consent. We rely on consent where required, for example for certain non-essential storage and access technologies. Consent can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6.4. Legal obligation. We process data where necessary to comply with legal duties, including accounting, tax, record-keeping and other statutory requirements.

6.5. Legitimate interests. We may process data where necessary for our or a third party's legitimate interests, for example to keep the Portal secure and reliable, prevent fraud or misuse, moderate Content, understand and improve Portal use, resolve disputes and protect legal rights, provided those interests are not overridden by the individual's rights and freedoms.

6.6. Different lawful bases may apply to different processing purposes. The same data may also be processed under different lawful bases where it is used for separate lawful purposes.

7.1. We do not sell or rent personal data. We share it only where necessary for the purposes described in this Privacy Policy, where the User has chosen to make information public, or where disclosure is permitted or required by law.

7.2. We may share personal data with service providers that support the Portal, including:

• payment service providers;
• email delivery providers;
• authentication and identity providers;
• hosting, infrastructure and technical-support providers where access to personal data is necessary to provide their services;
• other providers needed to deliver a particular Portal feature.

7.3. Where a provider acts as our processor, it may process personal data only on our documented instructions, within the agreed scope and subject to appropriate contractual, technical and organisational safeguards.

7.4. We may disclose personal data to HM Revenue & Customs (HMRC), law-enforcement bodies, regulators, courts or other competent authorities where disclosure is required by law or a valid and lawful request.

7.5. Information intended to be public through the Portal, such as a Photographer Profile, Portfolio, Offers or public reviews, may be visible to Portal visitors according to the nature of the Content, the Portal's functionality and any applicable User settings.

7.6. Where a third-party provider processes personal data as an independent controller, its own privacy information and legal obligations apply to that processing.

7.7. We aim to share only the personal data reasonably necessary for the relevant purpose or service.

8.1. We aim to keep personal data within the United Kingdom or other jurisdictions that provide an appropriate level of protection where reasonably practicable.

8.2. Some authentication, payment, infrastructure or other service providers may process personal data outside the United Kingdom.

8.3. Where we are responsible for a restricted transfer of personal data outside the UK, we use a transfer mechanism permitted by UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard, together with any additional measures required in the circumstances.

8.4. Where a third-party provider acts as an independent controller and transfers data internationally, its own privacy information and applicable legal obligations govern that processing.

9.1. We keep personal data only for as long as reasonably necessary for the purpose for which it was collected or otherwise processed, and for any additional period required by law.

9.2. Retention periods vary according to the data, processing purpose, legal obligations, security requirements and legitimate interests.

9.3. If a User requests deletion of their account, the account becomes inactive immediately and, where applicable, is no longer publicly visible. It enters a deletion-pending state and is removed from active Portal systems within 30 days unless restored before that period ends.

9.4. Where account access is restricted for Terms of Use, security or other justified reasons, the account may first be suspended. If it is not restored within 30 days, it may be blocked and, after a further 30 days, moved to deletion pending. Once in deletion pending, it may remain recoverable for a further 30 days before final removal.

9.5. During suspension, blocking or deletion pending, access to Portal functions is restricted and public Content linked to the account is hidden. If the account is restored, access and visibility are restored according to the account and Content status at that time.

9.6. Our usual retention periods are:

9.7. If a Registered Visitor deletes their account, conversation data may remain visible in a Photographer's conversation history where the conversation is not otherwise deleted. If a Photographer deletes their account, conversations and messages associated with that Photographer account are removed when the account is finally deleted.

9.8. When a retention period expires or the purpose for processing ends, personal data is deleted or anonymised unless a longer period is required by law or necessary to establish, exercise or defend legal claims.

9.9. Personal data in backups is used only for business continuity, restoration and security. Backup data is not used for ordinary Portal operations and is deleted as the relevant backup expires.

9.10. Where different retention periods apply to the same data for different purposes, we may keep the data for the longest lawful period that applies, but we stop using it for purposes whose retention period has ended.

10.1. DreamPhotographer uses cookies and similar storage and access technologies to operate the Portal, maintain security, remember settings and, where permitted, understand how the Portal is used.

10.2. The Portal uses the following categories:

• Strictly necessary technologies, required for core Portal operation, authentication sessions and security.
• Functional technologies, used to remember settings explicitly selected by the User.
• Performance and analytics technologies, used to collect internal traffic statistics and improve the Portal.

10.3. Strictly necessary technologies may be used without consent where an applicable PECR exception applies. Functional technologies may be used where they are necessary to provide a setting or feature requested by the User. Performance and analytics technologies are used only where we have the consent or another applicable PECR exception permits their use.

10.4. Where available, Users can manage their choices through the Portal's cookie controls. Browser settings may also be used to remove or block cookies, but blocking strictly necessary technologies may prevent features such as account sign-in from working correctly.

10.5. DreamPhotographer currently uses the following cookies or local storage technologies:

10.6. The fv_uid analytics cookie is created only where the required permission has been given and is used for more detailed internal traffic statistics. Independently of analytics-cookie choices, the Portal may keep limited server-side technical logs needed to measure basic traffic, operate the service and protect security. These logs are not used for personalised advertising or behavioural profiling.

10.7. Third-party features, such as sign-in through Google or Facebook, may use their own cookies or similar technologies on domains or interfaces they control. Their use of those technologies is governed by their own privacy and cookie information.

11.1. We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing.

11.2. We review and, where appropriate, update safeguards taking account of the nature and volume of data, processing purposes and likely risks.

11.3. Access to personal data is limited to people and service providers who need it for their role or contractual duties, following need-to-know and least-privilege principles.

11.4. No internet transmission or electronic storage system can be guaranteed to be completely secure, so absolute security cannot be guaranteed.

11.5. If a personal data breach occurs, we take appropriate steps to contain and investigate it, reduce potential harm and prevent recurrence. Where required by law, we notify the Information Commissioner's Office (ICO) and affected individuals.

11.6. Security measures may include authentication, access controls, session management, encrypted transport, activity logging, backups and other safeguards appropriate to the Portal.

12.1. You have the right to request access to your personal data and information about how it is processed.

12.2. You have the right to ask us to correct inaccurate personal data and complete incomplete data.

12.3. You may ask us to erase personal data where the legal conditions for erasure are met, subject to information we are required or entitled to retain.

12.4. You may ask us to restrict processing in circumstances provided by applicable data protection law.

12.5. Where the right applies, you may receive personal data you provided to us in a structured, commonly used and machine-readable format and ask for it to be transmitted to another controller.

12.6. You may object to processing based on legitimate interests. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.

12.7. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

12.8. We aim to make it straightforward to exercise your rights. Where an action cannot be completed directly through the Portal, you can contact us using the details in section 14. We may request information reasonably necessary to verify your identity before acting on a request.

12.9. If you are concerned about how we use your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection supervisory authority.

12.10. We normally respond to valid rights requests within one month. Where permitted by law, that period may be extended for complex or numerous requests, in which case we will explain the extension.

13.1. We may amend or update this Privacy Policy to reflect changes to Portal functionality, legal requirements, service providers or our processing practices.

13.2. Each version has an effective date shown at the beginning of the document.

13.3. The current Privacy Policy is published on dreamphotographer.uk and takes effect from the date stated in it unless otherwise specified.

13.4. Where the law requires us to notify Users about a change, we will do so. We may also provide additional notice through the Portal, by email or through another appropriate communication channel where a material change could affect Users' rights or how their personal data is used.

13.5. Users are encouraged to review the current version of this Privacy Policy from time to time.

14.1. For questions about this Privacy Policy, our processing of personal data, or to exercise a data protection right, contact the controller:

• Controller: Saulius Kutka trading as KUTKA
• Address: 120 Park Lane, Darlington, DL1 5AG, United Kingdom
• Email: info@dreamphotographer.uk

14.2. We handle requests, enquiries and complaints in accordance with applicable data protection law.

14.3. If you believe your personal data has been processed unlawfully, you have the right to complain to the Information Commissioner's Office (ICO). Information about making a complaint is available on the ICO website.