Last updated:
Who is responsible for your data
Lxkey Photography is the trading name of Luke Hammill, a sole trader based in the United Kingdom.
Postal address: 141 Lawefield Lane, Wakefield, WF2 8SX.
Email: LxkeyPhotography@gmail.com.
Not registered for VAT. Prices shown are the total price payable and no VAT is charged or reclaimable on them.
For anything to do with your personal data, including the requests described further down this page, email LxkeyPhotography@gmail.com.
The short version
This site collects as little as it can. There is no advertising, no profiling, no data sold or shared for marketing, and no tracking cookies unless you actively agree to them.
Four things can happen here that involve data: you send a message through the contact form, you buy a print, you subscribe to the newsletter, or you consent to anonymous site analytics. Each is covered below.
If you use the contact form
The form collects your name, email address, chosen subject and message. It creates a private conversation in the site's secured admin inbox so I can read, answer, archive and delete the enquiry. It is not visible to other visitors.
The legal basis is legitimate interests — you have asked me a question and I need to answer it. Resend delivers a notification to me and any reply I send from the admin inbox to your email address.
Your IP address is held very briefly, in memory only, to limit how many messages can be submitted from one place in a short period. It is not written to disk, not logged against your message, and is discarded automatically.
The form also contains a hidden field that people never see. If it is filled in, the submission is treated as automated and discarded. This is a spam measure and collects nothing about you.
If you buy a print
Checkout is handled by Stripe. Your name, email address and delivery address are collected on Stripe's own payment page so I can fulfil and dispatch your order.
Your card details are entered on Stripe's page and are never seen by, transmitted through, or stored on this site. I never have access to your full card number.
After payment, Stripe notifies this site of the completed order. I receive your name, email address, delivery address and what you ordered — everything needed to make and post it, and nothing more.
The legal basis is performance of a contract: I cannot make and send you a print without knowing what to make and where to send it.
Your order details are kept in my Stripe account, in the order confirmation emails, and in the private order-management database used to print, dispatch and support your order.
If you subscribe to the newsletter
The newsletter form collects your email address only. It is stored with Resend, the same provider that delivers order and contact email for this site — no separate marketing company is involved, and your address is not passed to anyone else.
It is used solely to send occasional updates about new prints and airshow dates. It is never used for anything else, and never sold or shared.
The legal basis is consent. Every email carries a working unsubscribe link, and you can also withdraw consent by emailing me. Unsubscribing takes effect immediately and affects nothing else.
Cookies and browser storage
This site sets no advertising or tracking cookies, and nothing analytical loads unless you agree to it via the banner. Declining is a single click and leaves the site fully working.
The site stores the contents of your basket, your answer to the cookie banner so you are not asked repeatedly, and a note that you have already seen the opening animation this visit in your browser. They are not used to identify you. Basket details are sent to this site and Stripe only when you choose to check out.
If you choose Allow analytics, this site records aggregate page views, daily visitor and session counts, popular and landing-page paths, broad referral sources, broad device type (desktop, mobile or tablet), and totals for actions such as opening a photograph, adding a print to the basket, starting checkout, sending a message or joining the newsletter. It does not store your IP address, raw user agent, full referring URL, email address or any persistent visitor identifier in analytics.
A short-lived first-party cookie containing only the current date prevents repeat page views from inflating the daily visitor total. Session-only browser flags prevent session and engagement events being counted repeatedly; they disappear when the browser session ends.
You can clear all of them at any time through your browser settings.
Analytics are processed by this site and stored as anonymous daily totals in Supabase. They start only after you agree and stop if you clear or change your consent choice.
Who else handles your data
I use a small number of established providers to run the site. They handle data under their own terms and data-protection commitments when providing the relevant service.
Stripe — payment processing and order records. Card data is handled entirely by Stripe.
Resend — delivery of contact notifications and replies, order confirmations and dispatch notices, and storage of the newsletter mailing list.
Vercel — hosting. Standard server logs, which may include IP addresses, are generated as part of serving any website.
Supabase — stores the photograph catalogue, private contact conversations, private order-management records and anonymous aggregate analytics. Contact and order tables are accessible only through the secured admin server.
Data may be processed outside the UK by these providers. Where that happens, they operate under the safeguards required by UK data protection law, such as approved contractual clauses.
How long it is kept
Order records are kept for six years after the end of the tax year they relate to. That is a legal requirement for business records, not a choice.
Anonymous aggregate analytics contain no persistent visitor identifier or contact details and are currently kept for 365 days. The owner can shorten or extend that period within the admin panel, up to two years.
Contact form messages and replies are kept in the private admin inbox, and notification copies may remain in my email, while they are relevant to answering you or providing follow-up support. They can be archived or permanently deleted from the admin inbox when no longer needed.
Newsletter subscriptions are kept until you unsubscribe.
Your rights
Under UK data protection law you can ask for a copy of the personal data I hold about you; ask me to correct anything inaccurate; ask me to delete it, where I am not required to keep it; object to processing based on legitimate interests; ask me to restrict processing while a query is resolved; and withdraw consent at any time where consent is the basis.
To exercise any of these, email LxkeyPhotography@gmail.com. I will respond within one month.
If you are not satisfied with how I have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. I would rather you came to me first so I can put it right.