Last updated: 07 July 2026

This Privacy Policy explains how Iris Art Scotland (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you visit our website, book an iris photography session, purchase artwork, or contact us. We comply with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2026. 

Iris Art Scotland   38 Cow Wynd Falkirk, FK1 1PU United Kingdom Email: info@irisartscotland.co.uk

We may collect the following categories of personal data:

• Identity data — name, email address, phone number
• Booking data — session type, dates, preferences
• Uploaded content — photographs or documents you submit for editing or iris artwork
• Iris photography data — identifiable images of your eye (considered personal data under UK GDPR) 
• Technical data — IP address, browser type, device information, cookies
• Payment data — processed securely by third‑party providers; we do not store card details
• Communication data — enquiries, messages, testimonials, consent forms
• 
  

We use your personal data to:

• Provide iris photography and digital artwork services
• Process bookings, payments, and orders
• Communicate with you about your session or enquiry
• Deliver digital files and physical prints
• Improve our website and customer experience
• Maintain internal records and accounting
• Comply with legal obligations (tax, data protection, contracts)
• We do not sell your personal data.

Under UK GDPR, we rely on one or more of the following lawful bases: 

• Contract — to deliver the services you request
• Consent — for marketing communications or optional features
• Legitimate interests — improving services, preventing fraud, protecting our business
• Legal obligation — accounting, tax, regulatory requirements

For identifiable iris images, we may rely on legitimate interest, consent, or contract, depending on the context. 

Because iris artwork involves identifiable images, UK GDPR applies.    We will inform you how your iris image will be used, stored, and delivered. If children under 13 are clearly identifiable, parental consent is required. data-protection.ed.ac.ukdata-protection.ed.ac.uk. Photography | Data Protection | Data Protection

We may share your data with trusted third parties, including:

• Payment processors
• Professional printing labs
• Delivery couriers
• Website hosting and analytics providers
• Accountants and legal advisors

All third parties are required to keep your data secure and use it only for the purpose of providing their service.

Publishing identifiable images online constitutes an international data transfer and requires safeguards.    We use providers that comply with UK GDPR transfer rules.

We retain personal data only as long as necessary:

• Client records: up to 6 years (legal requirement)
• Iris photographs: retained only with your consent or for ongoing services
• Enquiries: up to 12 months
• Financial records: 6 years
• 
  

Under UK GDPR, you have the right to: 

• Access your personal data
• Request correction or deletion
• Withdraw consent
• Object to processing
• Request data portability
• Lodge a complaint with the ICO

Our website may use cookies for functionality, performance, and analytics. You can manage cookies through your browser settings.

We use appropriate technical and organisational measures to protect your data, including encrypted storage, secure backups, and restricted access.

To ask questions or exercise your rights, contact:

Iris Art Scotland   38 Cow Wynd, Falkirk, FK1 1PU Email: info@irisartscotland.co.uk