Legal
Privacy Policy
TinyTangent Studios · Kiran Chhina · Version 1.7 — Last updated: June 2026
This policy explains how TinyTangent Studios collects, uses, stores, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
TinyTangent Studios is a sole trader photography and videography business operated by Kiran Chhina, based in West Yorkshire.
- Data controller: Kiran Chhina trading as TinyTangent Studios
- Email: kiran@tinytangentstudios.co.uk
- Website: tinytangentstudios.co.uk
- Phone: 07716 694 983
As a sole trader processing personal data for commercial purposes, TinyTangent Studios is required to register with the Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018, unless a specific exemption applies. A Data Protection Officer is not required at our scale of operation.
2. What Personal Data We Collect
2.1 Data you provide directly
- Name and email address when submitting an enquiry or booking form
- Phone number if provided voluntarily
- Property or event address provided as part of a booking
- Any additional information included in message or notes fields
- Payment records (payment method and transaction reference — no card data stored)
- Recordings of meetings (online or in person), processed in accordance with our Terms & Conditions and our legitimate interests in accurate record-keeping
2.2 Data collected automatically
- GitHub Pages may log basic server-side request data (IP address, browser type, page requested) for security and operational purposes. This data is processed by GitHub, Inc. and is not accessible to TinyTangent Studios in identifiable form
2.3 Data we do not collect
- Payment card details — all payments are made via bank transfer or cash
- Special category data (as defined under UK GDPR Article 9) — we do not request or intentionally process sensitive personal data such as health, race, religion, or biometric data
- Personal data from individuals under the age of 18 — we do not knowingly collect such data
3. How We Use Your Data
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|
| Responding to enquiries | Name, email, message | Legitimate interests |
| Confirming and fulfilling bookings | Name, email, phone, address, package | Contract performance |
| Delivering photos/videos | Email, name | Contract performance |
| Maintaining business records | Name, contact details, invoice data | Legal obligation (HMRC) |
| Portfolio and promotional use (website, social media, paid ads, pitch materials) | Images (no personal identifiers) | Legitimate interests |
| Recording of meetings | Audio/video recording | Legitimate interests (Art. 6(1)(f)) |
We do not use your data for direct marketing without your explicit consent. We never sell personal data to third parties.
4. Data Retention
- Enquiry data where no booking is made: deleted within 6 months
- Booking and client data: retained for 6 years (HMRC requirements)
- Photos and videos: accessible via shared link for approximately 3 months after delivery. Clients are responsible for downloading their own copies. We do not guarantee storage beyond this period
- GitHub Pages server logs: retained by GitHub, Inc. per their data retention policy (typically up to 90 days). TinyTangent Studios does not hold this data independently
- Meeting recordings: retained for a maximum of 12 months unless required for longer by ongoing legal proceedings
5. Who We Share Your Data With
We use the following trusted third-party services as data processors. Where required by UK GDPR Article 28, data processing agreements (DPAs) are in place with each processor:
- Google LLC (Drive, Gmail, Calendar, Workspace) — file storage, email, scheduling. Data may be processed in the UK, EEA, or US. Google participates in the UK-US Data Bridge and the EU-US Data Privacy Framework.
- GitHub, Inc. (GitHub Pages) — website hosting. Data processed in the US. GitHub participates in the UK-US Data Bridge, providing appropriate safeguards for UK data transfers.
- Formspree, Inc. — contact and booking form submissions. Data processed in the US under standard contractual clauses.
International transfers: Some processors above are based in the US. UK-to-US transfers are covered by the UK-US Data Bridge (where the processor participates) or standard contractual clauses approved under UK GDPR Article 46. No transfers are made to countries without appropriate safeguards.
6. Your Rights Under UK GDPR
You have the following rights, exercisable by contacting kiran@tinytangentstudios.co.uk:
- Right of access (Article 15) — request a copy of the personal data we hold
- Right to rectification (Article 16) — ask us to correct inaccurate data
- Right to erasure (Article 17) — ask us to delete your data in certain circumstances
- Right to restrict processing (Article 18) — ask us to limit how we use your data
- Right to data portability (Article 20) — request your data in a portable format where processing is based on contract performance or consent (this right does not apply to data processed under legitimate interests or legal obligation)
- Right to object (Article 21) — object to processing based on legitimate interests
- Right to withdraw consent — we do not currently process your data on the basis of consent. If we do so in future (e.g. for marketing), you may withdraw consent at any time without affecting the lawfulness of prior processing
- Rights re automated decision-making (Article 22) — we do not carry out automated profiling
We will respond to all requests within one calendar month at no charge.
7. Cookies
Our website is hosted on GitHub Pages and does not currently use analytics cookies or tracking cookies. We store a single preference cookie for dark mode display purposes (tts-theme), which is a functional cookie requiring no consent. If we introduce analytics cookies in future, this policy will be updated and a consent notice will be displayed.
8. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including use of secure cloud services and access controls.
In the event of a data breach likely to affect your rights, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Articles 33–34.
9. Children's Data
Our services are directed at businesses and adult consumers. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data to us, please contact kiran@tinytangentstudios.co.uk and we will delete it promptly.
10. Complaints
If you are unhappy with how we have handled your data, contact us first at kiran@tinytangentstudios.co.uk. You also have the right to complain to the ICO:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Changes to This Policy
We may update this policy from time to time. The current version will always be available at tinytangentstudios.co.uk/privacy. Material changes will be communicated to active clients by email with at least 14 days' notice.