Privacy, Data Protection, and Cookie Policy

The Data Controller responsible for your personal data is:

Business Name: Manuele Santoro
Address: 15 East street, Reading, Berkshire, England
Email: info@manuelesantoro.com
Website: www.manuelesantoro.com

If you have any questions about this policy or wish to exercise your data rights, please contact us using the email address above.

We collect and process various types of personal data, which we group as follows:

Category of Data	Examples of Data Collected	Source of Collection
Identity/Contact Data	Name, Email Address, Phone Number, WhatsApp Number, Postal Address.	Direct interaction (Contact Form, Email, WhatsApp, Contract)
Transaction Data	Details about services purchased (e.g., package type, date of shoot).	Direct interaction (Contract and Billing)
Correspondence Data	Content of messages, emails, and conversations via WhatsApp or Instagram DMs related to booking or services.	Direct interaction (WhatsApp, Email, Instagram)
Usage Data	Information about how you use our website (pages viewed, time spent, device type, location data (country/city level)).	Automated technologies (Google Analytics, Website Metrics)
Technical Data	IP addresses, browser type, operating system, and unique identifiers.	Automated technologies (Google Analytics)

Under UK GDPR, we must have a lawful basis to process your personal data. We rely on the following:

Processing Activity	Legal Basis
To fulfill a service contract	Contract: Necessary for fulfilling the contract with you (e.g., conducting a photo shoot, delivering images).
To respond to queries and provide quotes	Legitimate Interest: Responding to sales enquiries and managing communication efficiently.
Marketing (if opted in)	Consent: We will only send promotional emails if you have explicitly given us clear, opt-in consent.
Website analytics and cookies	Consent: For non-essential cookies (like Google Analytics), we rely on your explicit consent via our cookie banner.
To keep financial records	Legal Obligation: Necessary to comply with UK accounting and tax laws.

We share your data with the following third-party services that process data on our behalf:

Third-Party Service	Purpose of Data Sharing	Data Processed
Google Analytics	To measure and analyse website traffic, performance, and user behaviour.	Usage Data, Technical Data (anonymised IP where possible).
Meta Platforms (WhatsApp Business & Instagram)	To communicate directly with clients, share drafts, and receive bookings.	Identity/Contact Data, Correspondence Data, associated metadata governed by Meta's privacy policy.
Website Hosting/CMS	To operate the website and store data collected via contact forms.	Identity/Contact Data, Technical Data.
Google Search Console	To monitor and improve our website's performance and visibility in Google Search results.	Note: This tool does not collect personal data from visitors.

What are Cookies?

Cookies are small text files placed on your device (computer, phone, tablet) when you visit our website. They help the website remember your actions and preferences over time. Under the PECR, we must gain your explicit consent for any cookies that are not strictly necessary for the website to function.

Cookies We Use

Cookie Type	Purpose	Provider	Consent Required?
Strictly Necessary	Essential for website security, navigation, and form submission integrity.	Our Website Host	No (but disclosed)
Performance/Analytics	Google Analytics: Collects information about how visitors use our site, which pages they visit, and which links they click to help us improve the site.	Google	Yes

Your Choices Regarding Cookies

When you first visit our site, you will be presented with a cookie banner allowing you to accept or reject non-essential cookies.

• You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the website may become inaccessible or not function properly.
• Google Analytics Opt-Out: You can prevent Google Analytics from recognising you on return visits to this site by installing the official Google Analytics Opt-out Browser Add-on, available here: https://tools.google.com/dlpage/gaoptout.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Client Records (Contracts, Invoices): Held for a minimum of six years after the service is completed, to comply with HMRC (tax) requirements.
• Correspondence/Enquiries (via Email/WhatsApp): Held for up to 24 months after the last interaction, unless it leads to a contract.
• Google Analytics Data: Retained according to the standard data retention settings in Google Analytics (usually 26 or 38 months, set to minimise retention).

Under UK GDPR, you have the following rights regarding your personal data. You can exercise any of these rights by contacting us at info@manuelesantoro.com.

1. The right to be informed: To know what personal data we collect and why (this Policy achieves this).
2. The right of access: To request a copy of the personal data we hold about you.
3. The right to rectification: To have inaccurate or incomplete data corrected.
4. The right to erasure (The right to be forgotten): To ask us to delete your personal data where there is no good reason for us to continue processing it.
5. The right to restrict processing: To block or suppress the processing of your personal data in certain circumstances.
6. The right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format.
7. The right to object: To object to the processing of your personal data where we are relying on a legitimate interest (and there is something about your particular situation which makes you want to object).
8. Rights in relation to automated decision-making and profiling: We do not engage in purely automated decision-making or profiling that produces legal effects concerning you.

If you have any concerns about our use of your personal data, you can make a complaint to us directly.

You also have the right to lodge a complaint with the UK supervisory authority for data protection matters, which is the Information Commissioner's Office (ICO).