What we do with your information.

Who this is about

MR M-RGAN LTD, trading as M-RGAN, company number 16494950, registered at Suite E Ground Floor Profile West, 950 Great West Road, Brentford, Greater London, TW8 9ES. We decide what happens to the information described here, which in data protection language makes us the controller.

For anything in this notice, write to info@m-rgan.com.

There is no tracking on this site

No analytics, no advertising pixels, no third party tracking of any kind. We do not know who you are when you read these pages and we are not trying to find out.

One exception, and it is a narrow one. An event gallery counts how many times it was opened, how many of those came from a QR code, and how many photographs were downloaded. Those are tallies and nothing else: no address, no device, no identifier, and nothing that could be traced back to you. They are never joined to the names people type into a gallery, so a download is a number on a page and not something attached to a person.

We count it because a client who paid for a gallery asks how it did, and the honest answer should be a real number rather than a guess.

Two cookies exist and both are strictly necessary. One keeps Thomas signed in to the private admin area. The other remembers that you have given your name on an event gallery, so you are not asked again every time you open it. Neither follows you anywhere else and neither needs your consent, because without them the thing you asked for does not work.

When you get in touch

The enquiry form takes your name, your email, optionally your company and phone number, what the enquiry is about, and your message. We also record the IP address the form was sent from, which is there to spot abuse of the form and nothing else.

We use this to answer you and, if the work goes ahead, to run the job. The basis is our legitimate interest in replying to people who contact us, and then performing a contract once there is one.

Enquiries that do not turn into work are kept for two years, because people come back. Enquiries that do become work are kept with the job.

When you subscribe

The mailing list takes your email and optionally your name. You confirm by clicking a link, so nobody can add you to it but you. The basis is your consent, and every email carries a one click unsubscribe.

Unsubscribing removes you from the sending list. We keep a record that you unsubscribed, because the only way to be sure we never email you again is to remember that you asked us not to.

When you are in a photograph

Most of our work is commissioned, and at an event the organiser decides that a photographer is there. We photograph what happens. The basis is our legitimate interest, and the client's, in recording and promoting an event, balanced against your interest in not being photographed.

That balance is a real one, not a formality. If you are in a picture and you would rather not be, say so and we will take it down. You do not have to give a reason.

When you open an event gallery

Some galleries ask for your name and email before showing you anything. Where they do, the page tells you before you type.

That information goes to us and to the client who put the event on, so they can send you those pictures. That is all it is used for.

There is a separate tick for hearing about future events. It is not ticked for you and the pictures do not depend on it. Leave it alone and nobody markets at you; tick it and the client may tell you about their next one. We keep the two apart because being shown a photograph of yourself is not permission to advertise to you, and a consent bundled into the thing you actually came for is not a consent worth having.

The basis is your consent, given by filling the form in, and separately by that tick. Either can be taken back. It is never sold. Ask us and we will delete it.

Galleries are unlisted and not indexed by search engines. Many are set to go quiet on a date, after which the link stops showing anything.

The gallery also counts opens and downloads, as described above. Those tallies are not connected to your name, even where you have given it.

Clients and invoices

For people we work with we hold the ordinary business record: contact details, what was agreed, what was delivered, invoices and payments. We keep these for seven years because HMRC requires it, which is also the basis for keeping them.

Email

Our inbox is sorted with the help of an automated system. The subject, sender and text of incoming messages are sent to Anthropic, our AI provider, which classifies them and sometimes writes a suggested reply. No reply is ever sent without Thomas reading it first.

We mention this because it means the content of an email you send us is processed by a third party. Anthropic does not use this material to train its models. If you would rather your correspondence was not handled this way, say so in your first line and we will take it out of the automated sort.

Who else sees any of this

Only the companies that run the plumbing, each under contract and only for that purpose:

• Vercel, which hosts the website
• Neon, which runs the database
• Cloudflare R2, which stores the photographs
• Google, for our own email and file storage
• Resend, which delivers email we send
• Stripe, which takes card payments. Card details go straight to Stripe and never reach us
• Anthropic, as described above
• Our accountant, for the financial records
• The client who commissioned an event, for the guest list from their own event gallery where one was collected

Where it is kept

In the United Kingdom and the European Economic Area where we can choose, and in the United States for some of the providers above. Where information goes to the United States it is covered by the UK addendum to the EU standard contractual clauses or the equivalent, which is the arrangement the law provides for exactly this.

What you can ask for

A copy of what we hold about you. A correction. Deletion. A pause on using it while something is sorted out. An objection to us using it on the basis of legitimate interest. Where you gave consent, you can take it back at any time, which does not undo what was done before you did.

Ask at info@m-rgan.com. We will answer within one month and it costs nothing.

If you are not happy with the answer you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but it is your right either way.