Privacy Policy
Last updated 2 August 2026
We’re a two-person wedding photography studio. The only personal information we hold about you is what you choose to tell us when you get in touch.
Who we are
Duffymog Studios is the data controller for the information described here.
You can reach us about anything on this page at GDPR@duffymogstudios.ie. It comes straight to us, and I’m happy to oblige deletion requests (or at the very least anonymise data if necessary for tax/accounting records).
What we collect
When you use an enquiry form, we receive what you type into it. Depending on which form you use, that’s your name, email address, wedding/event date, message, and optionally your phone number and venue location .
When you simply browse the site, our hosting provider processes technical information needed to serve the pages: your IP address, browser type, and which pages were requested. This is ordinary web server logging, used to keep the site online and defend it against attacks.
Why we use it, and our legal basis
| What | Why | Legal basis |
|---|---|---|
| Enquiry form details | To reply to you, answer questions, check availability, and quote for your day | Article 6(1)(b): steps taken at your request before entering into a contract |
| Server and security logs | To keep the site available and protect it from abuse | Article 6(1)(f): our legitimate interest in a working, secure website |
We don’t use your details for marketing. We won’t add you to a mailing list, and we don’t sell, rent or share your information with anyone for their own purposes.
How long we keep it
If you enquire and we don’t end up working together, we delete your enquiry within one year.
If you book with us, your details become part of our client records, which we keep for as long as needed to deliver your photography and then for around six years to meet Irish tax and accounting requirements.
You can ask us to delete your enquiry sooner at any time, and we will (booking info, payments etc have to be stored but can be anonymised).
Who else is involved
As much as I would love to self-host everything it’s not really feasible and generally not a good idea to try to run your own email server. So we do have a few suppliers who handle your information on our behalf. Here is each of them, and what that means for where your details end up.
| Supplier | What they do | Where |
|---|---|---|
| Cloudflare | Hosts and serves this website, and passes your enquiry to us | Global network, certified under the EU-US Data Privacy Framework |
| Scaleway | Delivers your enquiry to our inbox as an email | France, processed entirely within the EU |
| MXRoute | Hosts the mailbox your enquiry arrives in | United States |
Cloudflare and Scaleway both work for us under data processing agreements. Cloudflare’s certification under the EU-US Data Privacy Framework covers the transfers it makes, and Scaleway processes nothing outside the EU at all.
Our email host, MXRoute, is different, they are based in the United States and do not offer a data processing agreement. They do have a commitment to collecting only what running an account requires, never selling or sharing customer data. We have read that policy and we are satisfied it reflects how they operate, but it is not the same as a DPA.
If even a single client reads this privacy policy and asks for us to migrate to a full EU stack we will do it.
In practice this means the email containing your enquiry sits on a mailbox hosted in the United States for up to a year. If you would rather it did not, say so and we will delete it, or reply to us some other way and skip the form entirely.
Your enquiry is not stored in a form provider’s database. It’s checked, turned into an email, and delivered. The only lasting copy is the one sitting in our own inbox.
Cookies and tracking
This site sets no cookies. That’s why you’ve never seen a cookie banner here, there’s nothing to accept or reject.
We do measure how the site is used, with Cloudflare Web Analytics. It counts page views and records the page you arrived from, your rough location (country), and your browser and device type. It does this without cookies and without any identifier that persists between visits, so it cannot follow you from one visit to the next, and it cannot follow you to any other website. Cloudflare processes this on our behalf as a data processor and does not use it to build advertising profiles.
There are no advertising pixels and no social media trackers of any kind. Nothing on this site reports your visit to Meta, Google Ads, or anyone else. The fonts are served from our own domain rather than Google’s, so loading a page doesn’t hand your IP address to a third party either.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Erase your data (“the right to be forgotten”)
- Restrict or object to how we use it
- Portability: receive your data in a transferable format
To exercise any of these, email GDPR@duffymogstudios.ie.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first. We’d genuinely like the chance to put it right.
You also have the right to complain to the Irish supervisory authority, the Data Protection Commission. Their current contact details and complaint form are at dataprotection.ie.
Changes to this policy
If we change how we handle your information, we’ll update this page and change the “last updated” date at the top. Any significant change will be reflected here before it takes effect.