About this policy.

This policy explains how I collect and use personal information through this website, the enquiry form, and related correspondence. It covers Tales by Varun Ltd — a private limited company registered in England & Wales, company number 14252548. References to "I", "me", and "my" mean Tales by Varun Ltd.

What I collect.

When you fill out the enquiry form or email me, I collect your name, email, phone number, and the details you share about your shoot. If you become a client, I collect any further information needed to deliver your session.

The site also collects basic technical data automatically — IP address, browser type, pages visited — used for analytics and security. If you arrived via a Facebook ad, I receive attribution data so I can measure ad performance.

If you opt in, I may occasionally send emails about new sessions, location availability, or related updates. You can unsubscribe at any time using the link in any email, or by emailing me directly.

I rely on legitimate interest, contract, consent, and legal obligation as my lawful bases under UK GDPR.

Who I share it with.

I share information only where necessary to run my business: with Squarespace (website hosting and form processing), Meta (Facebook ad attribution), my email service provider, and HMRC and my accountant when legally required.

I never sell your data. No marketing partners, no data brokers, no exceptions.

Cookies.

This site uses essential cookies (required for the site to function), analytics cookies (anonymous usage data), and advertising cookies (Meta Pixel for ad measurement). You can refuse non-essential cookies at any time via your browser settings, or through the cookie controls on this site if shown.

Storage and retention.

Some service providers — Squarespace, Meta — are based in the United States. When data leaves the UK, I rely on UK government-approved safeguards including the UK-US Data Bridge, the UK International Data Transfer Agreement (IDTA), and adequacy decisions where they apply.

Enquiries that don't lead to a booking are deleted within 12 months. Client records are kept for 7 years to meet HMRC requirements. Image files are kept as part of my portfolio archive unless you ask me to delete them.

Your rights.

Under UK GDPR, you can ask me to:

Access — request a copy of the data I hold.
Correct — fix anything inaccurate or incomplete.
Erase — request deletion, subject to legal retention.
Restrict or object — limit or refuse certain processing.
Port — receive your data in a portable format.
Withdraw consent — at any time.

To exercise any of these rights, email me at hello@talesbyvarun.com. I'll respond within one calendar month.

Contact and complaints.

If you have a concern about how I've handled your data, please email me first at hello@talesbyvarun.com — I'd rather resolve it directly.

You also have the right to complain to the Information Commissioner's Office, the UK data protection authority. Visit ico.org.uk or call 0303 123 1113.