Privacy Policy
1. Who we are
This policy explains what personal information My Highland Photography collects, why, and your rights over it. We only collect what we need to run the shop, and we never sell your information.
My Highland Photography is run by Patrick (Pat) McElhinney, a sole trader. Pat is the “controller” of your information, which means he decides how it’s used and is responsible for protecting it.
- Address: 74 Kilmallie Road, Caol, Fort William, PH33 7EL, Scotland, United Kingdom
- Email: pat@myhighlandphotography.com
For any question about your information, or to use any of your rights, email us. We aim to reply within 2 working days.
2. What information we collect
We collect information you give us when you buy, sign up or get in touch, plus some information about how you use the website.
- When you order: your name, email address and country. For calendars, also your postal address and phone number for delivery. We keep a record of what you bought, when, and how much you paid.
- Payment details: your card or PayPal details go straight to Stripe or PayPal. We never see or store your full card number.
- If you create an account: your login details, saved addresses and order history.
- If you join our email list: your email address, when and how you signed up, and whether you open or click our emails.
- If you contact us: your name, email address and whatever you tell us.
- When you browse the website: your IP address, device and browser type, pages visited and how you arrived. Some of this comes from cookies and similar tools, which only run if you allow them (section 5).
To place an order you must give your name, email address and country, plus your postal address for calendars, because we can’t supply your order without them. Everything else, including joining our email list, is optional.
3. Why we use it and our legal basis
UK data protection law says we need a lawful reason for each use of your information. These are ours.
| What we do | Information used | Lawful basis |
|---|---|---|
| Process your order, deliver downloads and post calendars | Order and contact details | Contract: we need it to supply what you bought |
| Send order confirmations, download links and delivery updates | Name, email, order details | Contract |
| Take payment and prevent fraud | Order details, IP address, reCAPTCHA signals | Contract and legitimate interests (keeping the shop safe) |
| Keep accounting and tax records | Order and payment records | Legal obligation (HMRC record-keeping) |
| Answer your questions and complaints | Contact details and your message | Legitimate interests (helping customers) |
| Send marketing emails | Email address, signup and email activity | Consent (you can withdraw it at any time) |
| Measure website visits and improve the shop | Browsing information from analytics cookies | Consent, given through the cookie banner |
| Show our adverts on Google, Facebook and Instagram and measure them | Browsing and purchase events from advertising cookies | Consent, given through the cookie banner |
| Keep the website secure and working | IP address, server logs | Legitimate interests (security) |
4. Who we share it with
We only share your information with the services that help us run the shop, and only what each one needs. We never sell your information.
| Service | What they do for us |
|---|---|
| SiteGround | Hosts our website and stores order data |
| WooCommerce (WordPress) | Runs the shop, orders and customer accounts |
| Stripe | Processes card, Apple Pay and Google Pay payments |
| PayPal | Processes PayPal payments, including Pay in 3 |
| Google reCAPTCHA | Checks that checkout visitors are real people, to stop fraud |
| Brevo | Sends our marketing emails and manages our email list |
| Google (Analytics and Ads) | Measures website visits and our Google adverts, if you allow cookies |
| Meta (Facebook and Instagram) | Measures and shows our adverts on Facebook and Instagram, if you allow cookies |
| GR Widget (Google reviews) | Shows our Google reviews on the website. Your browser connects to its servers to load them, which shares your IP address |
| Royal Mail or other couriers | Delivers calendars (name and address only) |
We may also share information if the law requires it, for example with HMRC, or to protect our legal rights.
5. Cookies and tracking
We only use analytics and advertising cookies if you say yes in our cookie banner. Cookies the shop needs to work, such as your basket and login, are always on.
- Always on: cookies that keep your basket, let you log in, and protect checkout with reCAPTCHA.
- Only with your consent: Google Analytics (how people use the site), Google Ads and the Meta pixel (how our adverts perform), and Brevo’s website tracker (which pages email subscribers visit).
- Change your mind at any time: use the cookie settings link on our website, or clear cookies in your browser.
Our Cookie Policy lists each cookie, what it does and how long it lasts.
6. Marketing emails
We only send you news, new releases and offers if you’ve asked for them.
- How you join: by ticking the box at checkout or signing up on our website. We then send an email asking you to confirm, and you’re only added once you click the link.
- What you get: a free Glencoe photograph when you confirm, then occasional emails about new photographs, calendars and subscriber offers.
- Unsubscribe any time: every email has an unsubscribe link, or you can email us. It’s free, and we’ll stop straight away.
- Order emails are separate: you’ll still get emails about your orders, such as confirmations and download links.
7. How long we keep it
We keep information only as long as we need it, then delete it.
| Information | How long we keep it |
|---|---|
| Orders and payment records | 6 years after the end of the tax year, as HMRC requires |
| Customer account | Until you ask us to close it, or after 3 years without an order or login |
| Email list details | Until you unsubscribe. After that we keep only your email address on a “do not email” list |
| Messages you send us | 2 years after we last hear from you |
| Analytics and advertising data | Up to 14 months, set in Google Analytics. Advertising platforms apply their own limits |
| Website security logs | Up to 30 days |
8. Transfers outside the UK and keeping it safe
Some of the services in section 4, including Google, Meta, Stripe, PayPal and Brevo, may store or process information outside the UK, for example in the USA or the EU.
- Protection: when that happens, the transfer is protected by UK-approved safeguards. These include the UK–US “data bridge”, adequacy decisions and standard contract clauses, as UK law requires.
- Security: the website uses an encrypted (https) connection throughout, payments are handled by Stripe and PayPal, and access to order information is password-protected and limited to Pat.
9. Your rights and how to complain
Under UK data protection law you have these rights over your information. To use any of them, email pat@myhighlandphotography.com. It’s free, and we’ll reply within one month.
- See it: ask for a copy of the information we hold about you.
- Correct it: ask us to fix anything that’s wrong or incomplete.
- Delete it: ask us to delete it, unless we must keep it by law, such as order records for HMRC.
- Limit it: ask us to stop using it for a while, for example while we check it’s accurate.
- Take it with you: ask for a copy in a common digital format, or for us to send it to another business.
- Object: object to how we use it for our legitimate interests, and stop marketing at any time.
- Withdraw consent: where we rely on your consent, such as for marketing emails or cookies, you can withdraw it at any time.
We don’t make any decisions about you by automated means alone.
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.
10. Changes to this policy
We may update this policy when our services or the law change. The latest version is always on this page.
Last updated: 30 September 2026