Privacy & cookies | Retro Capture

1. Who we are

Retro Capture hires out retro camcorders and screen-free cameras for weddings, parties and events. We trade from 10 York Road, London SE1 7ND and post UK-wide. We are not a limited company, so there is no company number to give, and we are the data controller for everything described on this page.

Email [email protected] for anything here — a copy of your data, a correction, a deletion, or write to us at the address above if you would rather do it that way. One person reads that inbox and you will get a real reply.

2. What we collect, and the reason we are allowed to

When you book. Your name, email address, phone number and a delivery address. The payment page takes your email and payment, and offers a box for the address and phone number (and where to collect from, if that is somewhere else) that you can leave blank; the page you land on straight after paying asks for whatever is still missing, and if you skip it there too, your confirmation email links back to it. The payment form on that page is Stripe’s, shown inside our page, and Stripe sets its own cookies there to prevent fraud (section 5). We need the address to post the kit, the phone number so the courier can reach you, and the email to send your booking and your gallery. The legal basis is performing our contract with you. Payment card details go straight to Stripe and never reach us. If you have accepted advertising cookies, a scrambled copy of your email, name and phone number also goes to Meta with the purchase, and a scrambled copy of your email and name to OpenAI — section 3 sets out exactly what is sent.

When you send an enquiry. The same applies to the enquiry form. If you have accepted advertising cookies, we tell Meta that an enquiry happened and send a scrambled copy of your email address and name with it, so Meta can tell us which advert produced it. OpenAI’s pixel, if you have accepted, is told only that an enquiry happened. If you have not accepted, we send Meta and OpenAI nothing at all. The legal basis is your consent.

When you save a quote (“Save my date”). Your email address or your mobile number — whichever you give — the date, the pack and the price we quoted, and the page you were on. We use it to send you that quote, to remind you about your date about three months and six weeks before, and to fill in your email on the payment page if you book from the link. For a mobile number, Brandon sends the quote and the reminders on WhatsApp himself. No name, no card. The legal basis is taking steps you asked for before a contract: you asked for the quote. To stop: every email has a stop link that ends the reminders and removes your contact details from the quote straight away, and on WhatsApp you reply STOP (or just tell us) and Brandon does the same. Every saved quote is deleted the day after the date it was for.

When you ask for a discount code. Your email address, and nothing else — no name, no phone number. We use it to send you the code, to remind you a few days before that code runs out, and to email you occasionally about Retro Capture after that. The legal basis is your consent, which you give by typing your address into that form, and you can take it back at any time: every one of those emails carries an unsubscribe link that works in one click and needs no reply from us. We also record which advert or link brought you, so we know which advertising produces signups. If you have accepted advertising cookies, we tell Meta that a signup happened and send a scrambled copy of your email address with it; if you have not, we send Meta nothing at all — and you still get your code. Declining cookies never costs you the discount. We keep your address until you unsubscribe.

When you enquire. Your name, email, the date you are asking about, what you are interested in, anything you write in the message, and — if you tell us — how you heard about us. We use it to answer you. The legal basis is our legitimate interest in replying to someone who has asked us a question.

Your photos and footage. Covered in our hire terms: they are yours, we store your private gallery for 12 months from the day it goes live, and we do not share or publish anyone’s images without permission.

When someone opens a gallery. A private gallery is not open to the internet, so we have to know who is at the door. If your address is on the list for a gallery, we email you a six-digit code and keep that code — scrambled, never in plain text — for the fifteen minutes it is valid. If you arrive on a share link instead, we ask for your name and email address and record them against that gallery. Either way we keep the first time you opened it, the last time, and how many times — which is what lets the people who booked see that Aunt Jo has been in and the best man has not. They can see that list for their own gallery; nobody else can, and it is never used to advertise anything to you. The legal basis is our legitimate interest, and theirs, in keeping a private gallery private and letting them share it with the people they choose. If you would rather not be on the list, say so and we will take you off — the address in section 1 reaches a person.

Counting visitors. We count page views, which page you arrived on, and which site or ad brought you, using a cookieless analytics tool. On the public site it also records how the site is used, so we can see what works and what gets in people’s way: which buttons and links are pressed and where on the page they are, which parts of a page come into view, how far down you scroll and roughly how long you spend, whether the highlights film is played, whether a form is started and which field it stopped at, the answer our calendar gave for a date you checked, and errors the site runs into. It never records what you type — no names, email addresses, phone numbers, messages or codes — and anything that looks like one is removed before it is sent. Each visit is recorded under a random visit number worked out from your browser and internet address; it is not stored on your device, it changes every month, and we do not join it to your name, your email or your bookings. It sets nothing on your device and does not follow you to other websites. It runs inside private galleries as well as on the public site. In a gallery it counts the pages, which photographs are opened, which clips and films are played and whether to the end, the camera filter, downloads, how many invitations were sent (never to whom), sign-ins (whether a code went out and whether it worked, never the code or the address) and the offer of edited highlights: whether it was seen, pressed and paid for. The key in a share link is stripped out before anything is recorded, so it cannot be used to reach a gallery. When a booking is paid or an enquiry reaches us, and for a gallery’s sign-ins, downloads and highlights bought, our own server also notes it in the same tool — which pack, the amount and the campaign tag you arrived with, or what kind of file and from which camera, never your name or contact details — so that a closed tab or a blocked script does not leave it uncounted. That note is not joined to your visit. The legal basis is our legitimate interest in knowing which pages work — and, for a gallery, whether the people it was shared with actually opened it and took their copies. You can turn it off in section 5, and turning it off there turns it off inside galleries too, and stops the server’s note for anything you book, send or download from that browser — except a payment link we send you directly, which goes straight to the payment page and never sees the setting.

Which advert brought you. If you arrive from an advert, the link carries a campaign tag and a click reference. We read those from the address of the page you land on and file them with your order — or with your enquiry, if you send one — so we know which advert produced a booking. Our legitimate interest in knowing what our advertising achieves. Unless you accept cookies, this is not stored on your device at all.

Analytics and advertising cookies. Only if you press “Accept cookies”. The legal basis is your consent, and you can withdraw it at any time.

Keeping the forms usable. Our enquiry form uses hCaptcha to block automated abuse. Our legitimate interest in not being flooded with spam.

The advert you arrived from. If you reach us by clicking an advert, the link carries a reference the advertising network puts there — Google calls it a gclid (or a gbraid or wbraid when you come from one of its iPhone apps), Meta an fbclid, OpenAI (for adverts in ChatGPT) an oppref. We read it, and if you go on to book, or send us an enquiry or a question about a date, we store it against your order or with your enquiry, together with whether you accepted cookies, so we can tell which advert paid for itself. This one is not part of the cookie question and happens whatever you answer, because it is the address of the page you asked for rather than anything placed on your device. If you decline cookies we cannot save it on your device, so instead we add it to the links between our own pages — that is what an rc_a in the address bar is. It never leaves this website: no advertising network is told anything about you unless you accepted. The legal basis is our legitimate interest in knowing which of our own adverts works, and you can object using the contact details in section 9.

3. Who we share it with

We do not sell your data and we do not share it with anyone not listed here.

Stripe — takes the payment and holds the order record.
Cloudflare — serves this website and stores our booking diary.
Resend — sends our emails: your saved quote and its reminders, and your discount code.
Web3Forms and hCaptcha — deliver the enquiry form and screen it for abuse.
GoHere — the cookieless visitor counting in section 2, on the public site and inside private galleries. It is our own installation on our own server, not a third-party advertising product. That server is in South Africa. It receives no names, email addresses or contact details — only the visit records described in section 2, and our server’s notes described there.
Google (Google Analytics and Google Ads) — only if you accept cookies. Google Analytics counts what happens on the site; Google Ads is told when an enquiry or a booking happens, so it can tell us which advert produced it. Both are the same Google tag and both are silent until you accept.
DPD — delivers and collects the kit. They get your name, delivery address and phone number, so the parcel reaches you and comes back to us afterwards.
Meta (Facebook and Instagram) — only if you accept cookies. If you accept and then send an enquiry, we send Meta a record of the enquiry containing your email address and name in a scrambled (hashed) form, your IP address and browser, and the advert reference you arrived with. If you accept and then buy, we send Meta a record of the purchase so it can tell us which advert produced it. That record includes your email address and name in a scrambled (hashed) form, the country on your billing or delivery address, what you bought and what you paid, your IP address and browser, and the advert reference you arrived with. If you accept, we also tell Meta when you press to contact us on WhatsApp, by email or by phone, and when you check whether a date is free — that it happened, and nothing more: not the date, and nothing you typed. Meta uses this for its own purposes as well as ours.
OpenAI (adverts in ChatGPT) — only if you accept cookies. OpenAI’s pixel sets two cookies: one holds the reference of the ChatGPT advert you clicked, the other identifies your browser. If you accept and then send an enquiry, the pixel is told that an enquiry happened. If you accept and then buy, we send OpenAI a record of the purchase so it can tell us which advert produced it. That record includes your email address and name in a scrambled (hashed) form, the country on your billing or delivery address, what you bought and what you paid, your IP address and browser, and the advert reference you arrived with. We do not send OpenAI your phone number. OpenAI also uses this to measure and improve the adverts it shows.

Some of these companies are American, or move data to the United States. Sending personal data out of the UK is only allowed on one of a set of approved footings, and here is the one each of them stands on.

Google and Stripe are certified under the UK Extension to the EU–US Data Privacy Framework, which the UK government recognises as giving your data protection equivalent to the protection it has here.
Cloudflare relies on the same Framework, and on the Information Commissioner’s standard international data transfer addendum where the Framework does not apply. Our booking records are held in Cloudflare’s Western Europe region rather than in the United States.
Meta receives the purchase record as Meta Platforms Ireland Limited, in Dublin, under the terms that govern its advertising tools. So that data goes to Ireland, not to the United States, and the UK recognises Ireland as offering equivalent protection. What Meta then does between its own companies is on Meta’s own footing rather than ours.
OpenAI receives the purchase record as OpenAI OpCo, LLC, in the United States, under the terms that govern its advertising tools. OpenAI states that it moves personal data out of the UK on the UK’s adequacy regulations or on the Standard Contractual Clauses with the UK International Data Transfer Addendum.

4. How long we keep it

Your gallery: 12 months from the day it goes live, then deleted.
Who opened a gallery — the name and email address on the list, and when they last looked: kept with that gallery and deleted with it.
Gallery sign-in codes: fifteen minutes, then gone, whether they were used or not.
Order and payment records: six years, because tax law requires it.
Enquiries that do not become bookings: up to two years, so we recognise you if you come back.
Saved quotes: until the day after the date they are for. Press stop in any of the emails, or reply STOP on WhatsApp, and your contact details go at once.
Cookieless visit records: kept visit by visit, under the random visit number in section 2 and never joined to your name or contact details, for three years — long enough to compare a wedding season with the two before it — then deleted.

5. Cookies, and how to change your mind

We use three kinds of storage on your device, and only one of them happens without asking.

Remembering your choices — your cookie answer, and light or dark mode. Needed for the site to behave the way you asked, so we do not ask separately.
Analytics and advertising — Google Analytics, Google Ads, the Meta pixel and the OpenAI pixel. Only after you press “Accept cookies”. These identify your browser and let Meta, OpenAI and Google recognise it. Until you accept, Google’s tag is not loaded at all and Google is sent nothing — not even an anonymous signal.
Nothing at all for our visitor counting, which is why it is on by default.

To withdraw consent, press “Withdraw cookie consent” in the footer of any page, beside the link that brought you here. It deletes the cookies Google, Meta and OpenAI set, forgets your answer, and asks again. It is as easy as giving consent was, and it takes effect immediately.

To object to the cookieless visitor counting, press the button below. It is free, it takes effect straight away on this browser, and nothing else on the site changes.

6. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to us relying on legitimate interests. You can also ask for your data in a portable form. Email [email protected] and we will reply within one month. There is no charge.

Where we rely on your consent, withdrawing it does not undo what we did while it was in force.

If you think we have got this wrong, please tell us first — but you have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We are not required to register with the Information Commissioner’s Office, and pay no data protection fee. That does not change any of your rights above, or our duty to answer you.

7. Children

This site is not directed at children, and we do not knowingly collect their data. Hires are made by adults paying by card.

8. Changes

If we change what we collect or who we share it with, we will update this page and, where the change widens what your consent covers, ask you again rather than assume the old answer still applies.

9. Get in touch

Retro Capture · 10 York Road, London SE1 7ND · [email protected]