Privacy policy

Who is responsible

Josh Entwistle, trading as Josh Entwistle Photography, is the seller and the person responsible for the personal information described in our privacy policy.

Email: joshentwistlephotography@outlook.com

Business and returns address: see business details.

Josh is the data controller for the shop’s customer information. This notice covers browsing this website, enquiries, print orders, delivery, customer service and order-confirmation emails. Where checkout is unavailable, you can still browse and prepare an enquiry.

Information we use

• Browsing: hosting and security services process technical information such as IP address, browser/device details, requested pages and connection times to deliver and protect the website.
• Your selection: the basket is saved in your browser. The enquiry form creates a draft file on your device; it does not submit your name, email or message to Josh. Josh receives it only if you send it separately.
• Checkout: your email, selected prints, quantities, prices, order references and payment status are recorded when you start checkout. Stripe collects payment and delivery details and returns the information needed to record and fulfil an order, including recipient name and delivery address. An unfinished or failed checkout can therefore leave a record even if you do not buy anything.
• Order emails: we keep the confirmation content, including order and delivery details and the terms supplied, together with sending attempts, provider references and any error or acceptance status needed to manage the confirmation.
• Contact: emails, quotation requests, returns, complaints and other correspondence you send us, and information needed to resolve them.

Information comes from you, Stripe and the email service’s responses. A buyer may supply another recipient’s name and address for a gift; please share this notice with that person. We remain responsible for giving recipients the privacy information required by law.

Full card numbers and card security codes are entered with Stripe and are not stored in the shop’s order database. Contact, payment and delivery information is needed to process an order; without it we cannot complete the purchase or delivery. You can browse without ordering. Please do not email card details or unnecessary sensitive information.

Why we use it

• Contract and steps you request before a contract: providing quotations, taking payment, supplying prints, arranging delivery, sending order information and handling contractual returns.
• Legal obligations: keeping required tax/accounting records and complying with consumer and data-protection law, including supplying purchase and cancellation information.
• Legitimate interests: operating and protecting the website, reconciling payments, investigating failed checkouts or email failures, managing customer service, delivering gifts to recipients named by buyers, and establishing or defending legal claims. We balance these interests against your rights.

We do not use order details or abandoned checkouts to sign you up for marketing. There is no newsletter or advertising-tracking integration in the shop. We do not sell customer information. If optional marketing or tracking is introduced, we will explain it and obtain any required consent first.

Who receives information

• Stripe: payments, fraud prevention, payment records and receipts. Stripe also processes some data for its own legal and payment-service purposes.
• Inkthreadable and delivery carriers: our selected print partner receives the recipient’s name, delivery address and the order details needed to produce and deliver the print directly to the customer. Contact details may also be shared where needed for delivery updates or resolving a delivery problem. Card details are not shared with print suppliers.
• Resend: sends order-confirmation emails on our behalf. It receives the customer’s email address and the message content, which includes order details and the recipient’s delivery address, and processes sending records. Replies are directed to Josh’s Outlook.com contact mailbox.
• Website and email services: OpenAI Sites and Cloudflare provide hosting, storage and security. Microsoft Outlook.com provides Josh’s customer-contact mailbox and processes correspondence sent to or from that address. Google Fonts supplies the website’s typefaces through a connection from your browser to Google.
• Other necessary recipients: professional advisers assisting with accounts or a dispute, and authorities where disclosure is legally required.

We share information needed for the relevant purpose. We may use a different printing or framing partner for a future order after checking its product specification and data-handling arrangements. Josh remains your contact for orders, returns and privacy questions.

More information is available in the notices from Microsoft, Stripe, Inkthreadable, Resend, OpenAI, Cloudflare and Google. Those notices do not replace Josh’s responsibilities. Stripe checkout and any ChatGPT sign-in also have their own privacy and browser-storage information.

Cookies and browser storage

The shop uses local storage to remember your basket on this device until it is cleared or removed. When checkout is available, session storage holds a checkout attempt, email/selection information and a confirmation-access token to prevent duplicate attempts and show your order securely. Session storage normally ends when the browser tab or session closes. Browser restore features may retain it longer.

You can clear website data through your browser settings. This removes the saved basket and may prevent that browser from displaying a previous order confirmation. Contact Josh if you need help retrieving order information.

Essential hosting, security, sign-in and payment services may use their own cookies or similar technologies. We have not added advertising pixels or optional analytics to the shop code. Optional tracking would require a separate assessment and any legally required consent before activation.

How long information is kept

Retention depends on what a record is needed for; the same period does not apply to every piece of information.

• Orders and accounting: records needed for Josh’s self-employed tax return are normally retained for at least five years after the 31 January submission deadline for the relevant tax year. Records may need to be kept longer for a late return, HMRC enquiry, unresolved dispute or legal claim. This does not mean every duplicate email or delivery detail has to be kept for that entire period.
• Enquiries and quotations: kept while we answer you and while a quotation, requested follow-up or related complaint remains active. If an enquiry becomes an order, the information necessary for that purchase becomes part of the order record.
• Incomplete checkouts and technical sending records: kept for payment reconciliation, resolving support or delivery-of-email problems, and investigating suspected misuse. Once those needs have ended, they are reviewed for deletion; an unpaid basket is not treated as a completed sale for tax-record retention.
• Confirmations, returns and complaints: the relevant correspondence and terms are kept for as long as needed to administer the purchase, demonstrate what was agreed, meet legal duties or deal with a claim. Unnecessary copies are removed.

When reviewing retention, we consider whether payment has settled, whether a customer issue is closed, applicable record-keeping and legal-claim time limits, and any ongoing dispute or investigation. Information no longer needed is deleted or anonymised. Providers may retain their own records for their separate legal and security obligations, as explained in their notices. You can ask Josh about a particular record or request deletion; we will explain if there is a lawful reason to retain it.

International processing

Some providers process information outside the UK, including in the United States. We do not promise that all information stays in the UK or Ireland.

• Resend: our sending domain uses its Ireland region, but Resend states that account data, including email metadata, logs and API records, is stored in the United States. Its data-processing addendum includes standard contractual clauses with the UK Addendum for relevant UK transfers.
• Stripe: processes payment information internationally, including in the United States. Its data-processing agreement and data-transfer addendum explain the applicable transfer mechanisms.
• Hosting, fonts and email: the providers operate international services. OpenAI’s published notice describes adequacy decisions and standard contractual clauses with the UK Addendum. Cloudflare describes the UK Extension to the EU–US Data Privacy Framework and contractual safeguards for other relevant transfers. The provider notices linked above explain their international processing; the precise arrangements depend on the service and destination.

Where a transfer is subject to UK transfer rules, it must be covered by an applicable adequacy arrangement or appropriate safeguards, such as approved contractual clauses with the UK Addendum. Contact joshentwistlephotography@outlook.com for information about a transfer affecting you or a copy of the relevant safeguards, with confidential commercial information removed where necessary.

Your rights

Depending on the circumstances, you can ask to access or correct your information, have it erased, restrict its use, or receive a portable copy. Some records must be retained to meet legal obligations or resolve claims. If we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

You can object to processing based on legitimate interests. You can also object to direct marketing at any time.

Contact joshentwistlephotography@outlook.com to exercise a right. We may need to verify your identity. We normally respond within one month; if a lawful extension or other timing rule applies, we will explain it.

The shop does not use customer data for solely automated decisions with legal or similarly significant effects. Stripe may carry out its own automated fraud and payment checks, which can affect whether a payment proceeds; its privacy notice explains its processing and your rights. Contact Josh if a payment issue needs review.

Privacy questions and complaints

Email joshentwistlephotography@outlook.com or write to the business address if you are unhappy with how we have handled your information. Explain what happened and what you would like us to look into; no special form is required.

Josh will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. This does not replace the separate time limits for information-rights requests.

You may also complain to the Information Commissioner’s Office. If you live in the Republic of Ireland, you can contact the Data Protection Commission, or another competent data-protection authority where applicable.

Changes to this notice

We update this page when the website or the way information is used changes. The review date is shown above. Material changes will be brought to your attention where required.