Privacy Policy

Schehar Yar Khan is the data controller for the personal data described here, operating from London, United Kingdom. If you have a question about this policy or how your data is handled, use the contact details in the final section.

Only what is needed to answer an enquiry and deliver commissioned work:

• Enquiry details — your name, email address, optional phone number, the service you are interested in, event date, location, budget range and the message you write.
• Project material — briefs, shot lists, contracts, invoices and the photographs or footage produced for you.
• Technical data — anonymous page and performance measurements, plus a cookie recording your consent choices. Analytics only run if you allow them.

No special category data is requested, and this site is not directed at children under 13.

• To reply to your enquiry and quote for work — legitimate interests, and steps taken at your request prior to entering a contract.
• To deliver a booked commission — performance of a contract.
• To keep tax and accounting records — legal obligation.
• To measure how the site performs — consent, which you may withdraw at any time.
• To show completed work publicly — legitimate interests for commercial projects, and consent where you are identifiable in a private commission such as a wedding. You can decline portfolio use without affecting your booking.

Your data is never sold. It is shared only with service providers who process it on instruction, under contract, and only as far as their role requires — hosting and deployment, database and file storage, email delivery, calendar booking, and accounting. Some of these providers operate outside the UK, in which case transfers rely on UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.

• Enquiries that do not become bookings — up to 24 months, then deleted.
• Contracts and financial records — six full financial years, as UK tax law requires.
• Delivered photographs and footage — archived for the period set out in your commission agreement, so that reprints and re-edits remain possible.
• Consent records — 12 months from the date you set them.

Under UK GDPR you may request access to your data, correction of anything inaccurate, deletion, restriction of processing, or a portable copy. You may object to processing based on legitimate interests, and withdraw consent at any time — including analytics consent, via the cookie settings link in the footer.

Requests are answered within one month and cost nothing. If you are unhappy with the outcome, you can complain to the Information Commissioner's Office at ico.org.uk, though raising it directly first is usually quicker.

Data is held on access-controlled, encrypted infrastructure, transmitted over HTTPS, and limited to the people who need it to do the work. No system is completely secure, so if a breach ever affects your rights or freedoms you will be told, and the ICO notified, within the statutory 72 hours.

Essential cookies keep the site working and cannot be switched off. Analytics cookies only load after you allow them. The Cookie Policy lists each one and what it does.

If this policy changes materially, the date above is updated and — where the change affects how your data is used — you will be told directly before it takes effect.

For any data protection request, write to the address published in the site footer. Please say what you are asking for so it can be dealt with properly.