Privacy Policy
Nesta Conaty Photography
Last updated: 15 September 2026
Nesta Conaty Photography respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how I collect, use, store and protect personal information when you visit my website, contact me, enquire about a photography session, book a session, complete a Meta/Facebook lead form, or otherwise use my photography services.
This policy is intended to comply with the General Data Protection Regulation (GDPR) and applicable Irish data protection law.
1. Who I am
Data Controller:
Nesta Conaty Photography
Co. Cavan, Ireland H12A668
Email:
nestaconatyphotography@gmail.com
Nesta Conaty Photography is the data controller responsible for your personal information.
If you have any questions about how your personal data is used, or wish to exercise your data protection rights, you can contact me at:
nestaconatyphotography@gmail.com
2. What personal information I collect
Depending on how you interact with my business, I may collect some or all of the following:
Your name
Email address
Phone number
Information about the photography session you are interested in
Preferred dates and availability
Information provided through enquiry or booking forms
Booking and payment information
Information required to provide your photography service
Information contained in communications between you and Nesta Conaty Photography
Photographs and videos taken during your photography session
Information relating to family members or other people included in a photography session
If you provide information about another person, such as your partner or child, you should only provide information that you are authorised to provide.
3. How I collect your information
I may collect your information when you:
Submit an enquiry through my website
Complete a contact or booking form
Submit a Meta/Facebook or Instagram lead form
Contact me by email, telephone or social media
Book a photography session
Attend a photography session
Make a payment
Communicate with me about your booking or photographs
4. Why I use your information
I use your personal information where necessary to:
Respond to photography enquiries
Provide information about my services and packages
Check availability and arrange bookings
Communicate with you before, during and after your photography session
Provide photography services
Deliver your photographs
Process payments
Provide customer support
Keep appropriate business and financial records
Manage contracts and bookings
Improve my services and customer experience
Protect my business against fraud, misuse or disputes
Comply with legal and accounting obligations
I will only use your personal information for purposes that are compatible with the reason it was collected, unless another lawful basis permits or requires further processing.
5. Legal basis for processing your information
Under GDPR, personal data must have a lawful basis for being processed. The Data Protection Commission identifies several possible lawful bases, including consent, contract, legal obligation and legitimate interests.
Depending on the circumstances, Nesta Conaty Photography may rely on the following:
Contract
I may process your information when it is necessary to provide a photography service you have booked or to take steps at your request before entering into a contract.
For example, this may include using your name, contact details and booking information to arrange your photography session.
Legitimate interests
I may process personal information where it is necessary for my legitimate business interests and those interests are not overridden by your rights and freedoms.
This may include responding to genuine enquiries, managing client relationships, maintaining business records and protecting my business.
Legal obligation
I may process and retain certain information where this is necessary to comply with legal, tax, accounting or other legal requirements.
Consent
Where I rely on consent, I will ask for your consent where appropriate and you can withdraw that consent at any time.
Withdrawing consent does not affect processing that took place lawfully before consent was withdrawn.
6. Photography and photographs
Photographs taken during a photography session are personal data where individuals can be identified.
Your photographs may be processed and stored for the purpose of providing the photography service you have booked.
I may also ask for separate permission to use selected photographs for purposes such as:
My website
Advertising
Portfolio material
Other promotional material
I will not assume that booking a photography session automatically gives me permission to use your photographs for marketing purposes.
Where appropriate, marketing/image-use permission will be requested separately.
If you do not give permission for your photographs to be used for marketing, this will not affect your ability to book or receive my photography services.
7. Children in photographs
Photography sessions may include babies and children.
Photographs of children will only be used for marketing or promotional purposes where the appropriate permission has been obtained from a parent or legal guardian.
8. Special category information
Some information you provide to me may potentially be sensitive personal information.
For example, information relating to pregnancy or health may constitute special category personal data in certain circumstances.
I will only collect or process such information where it is necessary and where an appropriate lawful basis under data protection law applies.
I will not ask for unnecessary medical or health information as part of a normal photography enquiry.
9. Who I may share your information with
I do not sell your personal information.
Where necessary to operate my photography business, personal information may be processed by trusted third-party service providers that I use to provide services to you or operate my business.
These may include providers for:
Website hosting
Online booking
Online photography galleries
Payment processing
Cloud storage
Business administration
Advertising and lead generation, including Meta platforms
These providers may process personal data on my behalf or independently as applicable to their own services.
Where a third party processes personal data on my behalf, I will take appropriate steps to ensure that your information is handled securely and in accordance with applicable data protection requirements.
10. Meta/Facebook and Instagram lead forms
If you submit your details through a Facebook or Instagram lead form, the information you provide may be processed by Meta and provided to Nesta Conaty Photography so that I can respond to your enquiry.
I may use the information you provide to contact you regarding your photography enquiry, availability, packages and booking.
Meta also processes personal data under its own privacy terms and policies.
You should review Meta's privacy information for details of how Meta processes personal data on its platforms.
11. International transfers
Some of the technology and service providers I use may process personal data outside Ireland or the European Economic Area (EEA).
Where personal data is transferred outside the EEA, appropriate safeguards will be used where required under applicable data protection law.
These safeguards may include an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.
12. How I protect your information
I take reasonable technical and organisational measures to protect your personal information against:
Unauthorised access
Accidental loss
Destruction
Misuse
Unauthorised disclosure
Unauthorised alteration
However, no method of electronic storage or transmission can be guaranteed to be completely secure.
The level of security measures required depends on the type and sensitivity of personal data being processed, consistent with the risk-based approach recommended by the Irish Data Protection Commission.
13. How long I keep your information
I will not keep personal information for longer than is necessary for the purpose for which it was collected, unless I am required or permitted by law to retain it for longer.
As a general guide:
Enquiries that do not result in a booking:
I may retain your enquiry information for a reasonable period so that I can manage the enquiry and any reasonable follow-up.
Client and booking information:
I may retain relevant information for as long as necessary to provide services, manage the client relationship and meet legal, accounting or contractual requirements.
Financial and tax records:
Certain records may need to be retained for the period required by Irish tax and accounting legislation.
Photographs:
Client photographs may be retained for the purposes of fulfilling your photography service, providing access to your gallery, resolving queries and protecting my business interests. The actual retention period may vary depending on the service and storage system used.
If you would like to know how long a particular type of information is retained, you can contact me at:
nestaconatyphotography@gmail.com
14. Your GDPR rights
Subject to applicable legal conditions and exemptions, you have rights under GDPR including:
The right to be informed about how your personal data is used
The right to access your personal data
The right to have inaccurate information corrected
The right to request erasure of your personal data
The right to request restriction of processing
The right to object to certain processing
The right to data portability in applicable circumstances
The right to withdraw consent where processing is based on consent
The Data Protection Commission confirms these rights and explains that individuals can contact the organisation responsible for their data to exercise them.
To exercise your rights, contact:
nestaconatyphotography@gmail.com
I may need to verify your identity before fulfilling certain requests.
I will respond to valid data protection requests within the timeframe required by applicable law.
15. Direct marketing
If I send you marketing communications, you can ask me to stop at any time.
You have a strong right to object to direct marketing, and once a valid objection is received, the relevant processing should stop.
You can contact me at:
nestaconatyphotography@gmail.com
16. Cookies
My website may use cookies and similar technologies.
Cookies may be used to help the website function, understand website usage, remember preferences or support advertising and marketing activities.
Where required by law, I will obtain the appropriate consent before using non-essential cookies or similar technologies.
The specific cookies used may change as website functionality and third-party services change.
17. Third-party websites
My website and social media pages may contain links to third-party websites or services.
I am not responsible for the privacy practices, content or security of third-party websites.
You should review the privacy policy of any third-party website you visit.
18. Data breaches
If I become aware of a personal data breach, I will assess the breach and take appropriate action in accordance with applicable data protection law.
Where required, I will notify the Data Protection Commission and/or affected individuals within the applicable legal timeframes.
19. Complaints
If you have a concern about how I have handled your personal information, I encourage you to contact me first so that I can try to resolve the issue.
You also have the right to make a complaint to the Irish Data Protection Commission, which is the supervisory authority responsible for data protection in Ireland.
Data Protection Commission — Ireland
20. Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes to my business, the services I use, or applicable data protection requirements.
The latest version will be published on my website with the date it was last updated.
One important thing before you publish this
I would not copy this onto your website completely unchanged yet.
There are a few details we should make accurate to how your business actually operates, particularly:
Your exact business/legal name and business address
What booking/gallery system you use — for example Pixieset
What payment system you use
Where you store client images and backups
How long you actually keep galleries/images
Whether you use Google Analytics, Meta Pixel, Meta Conversions API or other tracking
Whether you send marketing emails/texts to clients
Whether you use WhatsApp for client communication
Whether you use client photographs for your portfolio/advertising and how you obtain consent
Whether you use any other software that receives client information
Those details matter because the DPC specifically says a privacy notice should reflect the organisation's actual processing activities, including purposes, recipients and retention periods.
For your Meta Lead Form
I would make the privacy-policy link point to a dedicated page on your website called:
Privacy Policy | Nesta Conaty Photography
And your Meta form can then simply refer people to that policy rather than trying to put the entire policy inside the lead form.
If you tell me what you use for Pixieset, payments, email, client galleries, WhatsApp and photo storage, I can turn the above into a much more precise final version for your actual business, including the third-party services and a short Meta Lead Form privacy statement.
Tighten the privacy policy