Data Policy - Lightscape creations

Data Policy

Isabelle McInally wants you to be confident about how your personal information is used.

Lightscape Creations Data privacy policy abides by the latest European General Protection Law, which came into effect on 25th May 2018, and you will find below details of the type of personal information that might collect from you and how it might be used and stored.

By using this website and / or purchasing any products and / or services, you agree that you have read and understood this Privacy Policy and that you are confident about the way we use your personal information.

This Policy may be modified or supplemented at any time to ensure it is up-to-date. Therefore, it is recommended that you check it from time to time and keep track of the latest updates. The date and subject of the last update is displayed below.

If after reading the information included in this page you still have any questions about Lightscape Creations Data Policy, please contact Isabelle McInally in the first instance.


* In case of conflict with Smugmug’s own Data Policy

Parts of Smugmug’s own Data Policy relevant to you have been translated here for your convenience and are deemed as accurate as possibly can be at the time of writing. However, in case of any conflict with Smugmug’s own Data Policy or in case of a potential error, then Smugmug’s own Data Policy will prevail assuming it is not in conflict with applicable European laws. The same applies to Mr Site’s own Data Policy.


* In case part of this Data Policy is deemed invalid or unenforceable or conflicting

If any part of this Data Policy is found to be invalid or unenforceable or conflicting, it will be modified. The other parts of the Data Policy that are valid and non conflicting will remain in full force.


* In case Smugmug’s Data Policy conflicts with the applicable law

Any action or claim against Smugmug will be ruled by the laws of the State of California, the USA and any applicable International Laws. Smugmug will decide which is best applicable.

Accessing or using the website from the European Union might default disputes against Smugmug to English or Scottish law, as Lightscape Creations is based in Scotland.

Should a court deem any part of Smugmug's Data Policy to be unenforceable, the parts will be limited to the minimum extent necessary or eradicated so as to not affect the full force and effect of Smugmug Data Policy.


Author & Updates by:     Isabelle McInally

2nd July 2018   -  Updated Layout and font sizes for easier reading + Introduction

25th May 2018  -  Lightscape's Initial Data Policy written


1 Lightscape Creations Is A Secure Online Space For You To Use

Isabelle McInally had a vision of creating a business that would enable clients to browse and buy in confidence high quality products from her creative photography. She wanted the best service, the best quality, award winning products and an online space as secure as possibly can be.

Today, Lightscape Creations combines some of the best online providers who share the same high standards and commitment to quality and security, with a 100% product warranty, backed with a truly caring service.

Together, Lightscape Creations and its associated partner services strive to provide a secure end-to-end space for you to browse and buy in total confidence.

1.1 The Lightscape Creations Website

Information about the website service provider is given in the T&Cs.

I have used this provider for my online e-commerce presence since 2013 as they offer a secure HTTPS security encryption for all data transfer, as explained below.

1.1.1 How Your Information Is Protected

Smugmug use commercially reasonable security measures and generally accepted industry standards to protect the Lightscape Creations account and content, including orders information, stored on their secure servers and to protect personal information from unauthorised access or disclosure, including in transfers.

Protection includes the use of Secure Socket Layer (SSL) transmission technology for all sensitive information exchanges where personal information is encrypted to avoid malicious interception while in transit to the Smugmug’s secure HTTPS servers.

Having said that, there are no method of transmission over the Internet, or method of electronic storage, that are known to be 100% secure.

Therefore, while Smugmug strives to use commercially acceptable means to protect your personal information, they cannot and do not guarantee absolute security or promise that their security measures will prevent third party “hackers” from illegally accessing personal data stored on their secure servers. For example, disclosure of data could still happen during an unexpected error in transmission, an unauthorized third party access or other acts of third parties, or other acts or omissions not yet known to be possible.

However, in order to minimise risk, we only ask for personal information pertinent to processing your specific enquiry, order or booking and we advise that you do not volunteer any other personal information.

1.1.2 The Lightscape Creations Website & How Do We Know It Is Secure?

With the Lightscape Creations website displayed, if you look at the top left of your screen, you will see the URL line with the online address of the page you are on at the time.

With the Lightscape Creations website displayed, if you look at the top left of your screen, you will see the URL line with the online address of the page you are on at the time.

You will notice that the URL is preceded by HTTPS. This stands for Hypertext Transfer Protocol Secure. This means that a separate protocol called SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are used on the website to send encrypted information between you and the secure web server (HTTP would only use plain text).

In addition, you will notice that in front of HTTPS is a small green padlock symbol and an information button, an “i” inside a circle. This ensures the site is secure and you can safely enter personal data.

The URL Line

If you click on the information button, a window opens to confirm that the URL operates over a “secure connection”.

There is also another section called “Permissions” which would list any permissions you might have given the website.

Website Secure Connection

If you click on the arrow on the right of our URL, you will open the Site Security window showing that Let’s Encrypt verified the site security.

Website Verified by...

Finally, the “More Information” link at the bottom of the window will display the following window, from which you will be able to manage your permissions on the Lightscape Creations website.

Website Security Information

1.1.3 The Lightscape Creations Email & How Do We Know It Is Secure?

Information about the email service provider is given in the T&Cs.

I have used this provider for my business email since 2007 as they offer the same secure HTTPS security encryption as my website provider, verified by Starfield Technologies, Inc. as shown below.

Email Provider Verified by...

I have included the “More Information” window below for transparency.

Email Provider Security Information

All emails are kept off site, on MrSite’s secure servers and accessed there via a tool which works in the browser. No emails are downloaded permanently to the PC I use to access them, however, as a standard process with all pages you view online, they are temporarily transferred to the PC’s temporary memory for viewing.

In addition, they have notified me that on Tuesday, 29th May 2018, they merged with another of their brands, Tsohost, a fully GDPR compliant hosting service.

Although my email is secure, I have no control over yours and if you have concerns about any of the content in our communications, then you should check that your email is also secure, as shown above in the section “Lightscape Creations Is A Secure Online Space For You To Use”.

The Lightscape Creations Contact Page is linked to Isabelle McInally’s MrSite email. So, when you use the Lightscape Creations’ Contact Page, Smugmug securely forwards an email to Isabelle McInally’s secure mail box with the details you have entered, offering a secure end-to-end information Transfer environment.

Here is an example of query Isabelle McInally receives from Lightscape Creations Contact Form:

2 - Lightscape Creations’ Personal Data Policy

The new law requires that, as a business,

• I offer transparency about what personal information I ask for, why I need it, how I use it, if and where it transits or is stored and when it gets deleted, if it gets deleted.

• I keep track of the permissions you give me about the personal information you share with me, whether in print or in digital file formats, and for a legal length of time.

The way the secure system is implemented means that no personal information is stored on the PC and no-one has access to the business passwords, except for Isabelle McInally.

In order to further minimise risk, you will only ever be asked to provide the personal information that is needed for processing your specific enquiry, order or booking.

2.1 So What Information Do We Collect From You, When And Why?

2.1.1 - Contacting Lightscape Creations

Where Lightscape Creations requires your consent to use your personal data, you will be always be asked to give it. However, there are two situations where this will be impossible. First Contact Reasonable Assumption of Consent

When you use Lightscape Creations’ Contact Form for the first time, you have to provide your email address, which falls under personal information. Without it, Isabelle McInally cannot reply to you.

However, the Contact Form has no means of asking you such permission as it would require an opt-in button, which Smugmug said would take time to sort out in details and make sure everything is perfect before a release.

The same applies to a first email sent by you as you are unlikely to remember yourself to explicitly give me permission to use your email.

Therefore, it will be reasonably assumed that by using the Contact Form or by emailing me, you explicitly authorise Isabelle McInally to use your email address as many times as necessary in order to, and only to, reply to your query, a process which might require more personal information from you, as explained further down. Withdrawal of Consent

You may cancel the consent to use your email and /or any or your private information at any time in writing and your emails with personal information and email address will be deleted immediately and permanently. Deletion of Emails

If you don’t cancel the consent, your emails and email address will be kept under a relevant folder in my secure mail box and only get deleted once we both agree that the query has been satisfied, unless you have expressly asked me in writing to:

• Retain your email and / or any personal data you provided in the query, giving the reason why and the length of time you want me to retain this information for, or

• Prompted further action, such as a service or product which require some offline management, in which case I will keep your emails and other personal information you provided until all further action has been completed and you have confirmed that you are happy with the products and services.

In certain circumstances, I may have to keep copies of emails for my records in order to:

• Use the information included to improve my documentation, services and / or products, in which case the relevant parts of the email are copied onto a file on my PC with only the first name for reference while no other personal data is kept. This file maybe kept indefinitely to keep track of changes to the business.

• Keep track of any complaints, kept in my secure online email box for a duration of three months after successful resolution or lack of contact from you since the date of your last email, after which you will not be able to pursue any more. The emails are then deleted and the complaint is deemed satisfactorily completed. Direct Online Purchased

We may never have exchanged an email before, but if you have purchased a product directly online (not bespoke and not a service which are paid by downloads), then, as part of my after-sale service, it will be reasonably assumed that by placing the order, you explicitly give me permission to use your email at once in order to finish the order.

This means that I will send you an email with the header “Lightscape Creations After Sale Service” to:

• Thank you for your custom, and

• Ask you if you are satisfied with the product or service you received, and

• If you would like to “Like and Follow” my Facebook page, and / or

• Give a review the product or service, with a link to the review location.

I will not contact you again and delete the email as soon as sent, unless you reply to me with different instructions.

2.1.2 - Purchasing Online Standard Personal Data Required For Payments

Anything you purchase online is added to the cart. When you go to the cart and click on “Begin Checkout”, you will be asked to provide the following personal information.

• Shipping information, i.e. the destination of the purchase:

◦ Recipient’s Name

◦ Recipient’s Address

◦ Recipient’s Telephone (a requirement from the delivery company)

• Billing information, i.e. the person who is paying:

◦ Card Holder’s Name ◦ Card Holder’s Address

◦ Card Holder’s Telephone

◦ Card Holder’s Email Address

• Credit Card details or PayPal Payment details This information is needed in order to process your payment and complete the order. Other Personal Information Required To Provide You Our Services And / Or Services Products and Bespoke Products

Data required is standard payment information. Services

• DATA required for Product Photography in addition to standard payment information: email contact name, preferred location, target date and time, and the number of photographs and angles required for each item.

• DATA required for Building (exteriors and interiors) Photographyin addition to standard payment information: email contact name, preferred location, target date and time, and the number of photographs and angles required for each item.

• DATA required for Private events in addition to standard payment information: address of the event, time, duration and the number of people expected to attend.

• DATA required for Public events in addition to the payment information: address of the event, time, duration, type of photographs required and the number of people expected to attend.

• For each of the above, you will be asked to fill in a release form which will have your name, address and signature, to allow / not allow Lightscape Creations to use some or all the photographs for advertising, marketing and portfolio. Weddings

• DATA required for Weddings photographed on the wedding day, in addition to payment information:

      ◦ the name, address, postcode, telephone number and email address of the bride and groom,

     ◦ details of the wedding day plan relevant to when the photography is to happen,

     ◦ the wedding official name and contact number,

     ◦ the key relatives in attendance and bridesmaids and bestman on a first name basis,

     ◦ date and time of the wedding coverage,

     ◦ location,

     ◦ duration,

      ◦ any special request, although no guarantees can be given,

      ◦ the address after the wedding and

      ◦ the number of people expected to attend.

• DATA required for wedding photography happening before or after the wedding in addition to payment information:

     ◦ the name, address, postcode, telephone number and email address of the bride and groom,

    ◦ the key relatives in attendance and bridesmaids and bestman on a first name basis, ◦ date and time of the photography coverage,

    ◦ location,

    ◦ any special request

    ◦ the number of people expected to attend.

   • This will form the wedding photography contract which is in print form and may be kept indefinitely in a locked cabinet, but not updated, as it also allows / does not allow Lightscape Creations to use some or all the photographs by Lightscape Creations for advertising, marketing and portfolio. Complaints

• All emails relating to complaints will be kept for a duration of three months after successful resolution or lack of contact from the date of your last email, after which you will not be able to pursue any more.

2.2 Where Is Your Personal Information Stored

Smugmug is an American corporation based in and operating from Mountain View in California. Accordingly, information collected by Smugmug is stored and processed on their secure servers in the United States. If you are accessing the Website from outside of the United States, you acknowledge and agree that your personal information will be stored within the United States and used by Smugmug, its third party service providers and Lightscape Creations to process your order.

2.3 Who Has Access To My stored Personal Data And Why?

Smumug uses this information to provide you with their winning customer service and may also need to contact you in relation to your order, for example, to check:

• in case of a change in product type or size, or

• a discontinued product, or

• an error somewhere along the line of fulfilling your order,

• or to chase you for valid payment information,

• or a last minute increase in price,

• or to process a refund…

The UK government requires that this information be kept for at least 22 months after end of the tax year return and the USA government requires 3 years from tax filing day.

SmugMug sends me an email, with your name and email address, to announce the sale and link to the order online. Through my online account, I have access to all the information your provided, but not the payment details. SmugMug also sends me a VAT Invoice for tax purpose with no personal information.

Smugmug sends an email to my chosen Professional Printer company near Glasgow in Scotland, to notify the order with a link to the shipping information online, the photograph to be used, payment and an invoice for tax purpose without personal information, all needed to process your order. The company is well-established, specialise in products and services for professional photographer and are fully GDPR compliant – awaiting reply from them to confirm details.

2.4 Other Non-personal Information Collected

It is common practice these days to use means of collection non-personal information about browsing and other online activities. These happen in the background and most of us are not conscious about it but, nonetheless, happen.

2.4.1 Smugmug and Third Party Providers Bespoke Analytical Tools

Smugmug may also collect some non-personal information such as the IP address, operating system, browser software, Internet Domain, Host Names and Activity on the website.

Third party providers might be contracted by Smugmug to provide analytic tools and reporting technologies which may also collect some non-personal information via cookies, web beacons or other types of tracking pixels.

All non-personal information collected helps Smugmug to optimize the website, process the orders and protect you against fraudulent transactions.

2.4.2 Cookies

Almost all e-commerce websites use cookies these days. Cookies are little bits of information stored on your computer by your web browser.

Cookies are used on the Lightscape Creations website to provide you with a more personalised user experience. They do not collect any private information but track your use of the website, including your activity, such as pages visited, links clicked and so on.

Cookies also help set the website up automatically when you visit it, ready for use, allowing you to take advantage of some features and services, such as adding items to your cart, proceed to checkout, or use any services that require you to sign in.

Therefore, it is recommended that you leave them turned on and your browser is likely defaulted to accept cookies.

However, you have the right to NOT to accept cookies and the Help portion of the toolbar on your browser will tell you how to prevent your browser from accepting new cookies, how to be notified when you receive a new cookie and how to disable them altogether.

You can also delete cookies you might have already collected without knowing by accessing the Privacy and Security settings of your browser settings to “Remove Individual Cookies”.

You can also disable or delete similar data used by browser add-ons, such as Flash cookies, by changing the add-ons settings.

2.5 Personal Data Policy

As a rule, Smugmug, MrSite and Lightscape Creations do not share, rent, sell, trade or use your personal information with any other company for marketing purpose without your consent.

2.5.1 Exceptions When Your Personal Data Might Be Used Without You Express Written Consent Replying to you

If you contact Lightscape Creations by any means, providing your email address, it will be reasonably assumed that you explicitly authorise Lightscape Creations to reply to you using the email address you provided and as many times as necessary in order to, and only to, reply to your query or until such authorisation is explicitly removed in writing.

The same applies to all contacts with Smugmug. Processing your orders and payments

Once you complete an order, it will be reasonable assumed that you authorise Smugmug to:

• process your orders and payments using the personal information you provided in the cart,

• store it as legally required, and

• share pertinent information required by Smugmug’s associated partner services so that they can manage their part of the service you ordered, i.e. Smugmug customer service, printers, delivery companies...

Anything else would be with your knowledge and consent. Exceptions

In certain circumstances, it might be legally required that Lightscape Creations or Smugmug disclose personal and non-personal information:

• to any successor-in-interest of their businesses, or

• where required by law, or

• when there is a good-faith belief that such action is necessary to comply with a judicial proceeding, a court order or a legal process.

2.5.2 Third Party Disclaimer

Lightscape Creations will not be held liable and will not tolerate if you receive unsolicited contacts from Smugmug or MrSite or their associated partner services. Should this happen and you have good reason to believe this is related to your visit to the Lightscape Creations website, then please contact so that appropriate investigation / action can be taken.

2.6 Your Rights About Your Personal Information

2.6.1 You have the right to...

• access the personal information we hold about you

• correct the personal information

• have your personal information deleted, where not held for any legal reason

• withdraw consent to use individual pieces of personal information

• receive your personal information in a portable format

• object to us processing your private information

2.6.2 Who to Contact to apply your rights about your personal data

Please contact for all data pertinent to :

• online order processing,

• customer service,

• payments and refund,

• complaints relating to online purchases and website functionality.

Please contact for all data pertinent to:

• bespoke products and services order processing and customer service,

• photographs releases for use by Lightscape Creations,

• wedding contracts,

• general correspondence,

• complaints relating to website contents and services.

Please note that since all reasonable precautions are taken to prevent unauthorised access to such personal information, you will be asked to provide some form of identity before any action is taken.

Powered by SmugMug Log In