This is an example policy. Replace it with your own before you go live. It is written to show the shape of a real one and is not legal advice.
What I collect
The enquiry form asks for your names, an email address, your wedding date and where it is happening, and whatever you choose to tell me about the day. Nothing else is collected, and none of it is required beyond an email address I can reply to.
If you book, I will also hold a postal address for sending prints and an invoice, and the timeline and supplier list you send me.
What I do with it
I use it to answer your enquiry, to photograph your wedding, and to send you the photographs afterwards. It is never sold, never shared with anyone who is not working on your day, and never added to a mailing list without you asking.
If you join the mailing list, you can leave it from the link at the foot of any email, and the record is deleted the same day.
How long I keep it
Enquiries that do not become bookings are deleted after twelve months. Booking paperwork is kept for six years, because tax rules require it.
Your online gallery stays live for two years from the wedding. After that the photographs are moved to offline archive storage, where they are kept indefinitely so that you can ask for a file again in ten years — which people do.
Who else touches it
Three services: the website host, the email provider, and the online gallery service. Each holds only what it needs to do its job, and each is bound by its own agreement not to use it for anything else. No data is transferred outside the country the site is hosted in.
Photographs of you
I would like to show your wedding in my portfolio, on this website and on social media. If you would rather I did not, say so at any point — before, during or years afterwards — and I will take them down. It will not change anything else.
Your rights
You can ask to see what I hold about you, ask for it to be corrected, or ask for it to be deleted. Email me and it will be done within a week, and sooner if it matters.
If you are not happy with how I have handled something, tell me first — and if that does not resolve it, you can complain to the data protection regulator in your country.