Privacy Policy
This policy explains how NMR Studios handles personal data submitted through the website, especially through the enquiry form and related follow-up workflow.
It is written to match the current site behaviour as of 28 June 2026, including enquiry validation, internal email notification, database storage and spam protection. It does not create a booking or confirm availability.
Who we are
NMR Studios is a wedding film and photography website for South Asian celebrations. The current public route for data requests or privacy-related contact is the enquiry page.
This page does not invent a registered company name, company number, VAT number or public address. Verified public contact details can be added later once they are confirmed for launch.
Why we use data
- Respond to enquiries
- Understand wedding and event requirements
- Prepare relevant coverage discussions
- Send internal notification to the NMR Studios team
- Store enquiries for review and follow-up
- Reduce spam, abuse and misuse
- Maintain website and enquiry security
What data we collect
- Full name
- Partner name, if provided
- Email address
- Phone number, if provided
- Preferred contact method
- Event date and date flexibility
- Venue, location and city or area details
- Number of events and event types
- Coverage interest and events to cover
- Guest count estimate
- Family priorities, privacy expectations, must-have moments and inspiration notes
- Consent to be contacted
- Source page and submission timing data used within the enquiry flow
- Technical metadata such as user agent and a hashed request identity where used for rate limiting and security
What we do not intentionally store
- Honeypot values used for spam detection
- Raw IP addresses in stored enquiry records
- Raw provider error bodies
- Payment information
- Passwords or user accounts
- Analytics or marketing cookies, because the current site does not intentionally use them
- Booking confirmation records, because the website does not provide a booking workflow
Lawful basis
- Consent, where a person asks to be contacted through the enquiry form.
- Legitimate interests, for operating the website, handling business enquiries, storing relevant records and reducing misuse.
- Pre-contract steps, where an enquiry may lead to a booking discussion or coverage proposal.
Where data is processed
The public website is hosted on Vercel. When enquiry storage is configured, records are stored in MongoDB using the configured database provider, which may be MongoDB Atlas or another MongoDB deployment.
When internal notification is configured, enquiry emails are sent through Resend. These providers may process data through their own infrastructure and under their own policies.
How long we keep data
- Enquiry records should be kept only as long as they are needed for enquiry management, follow-up, business administration and any legal or accounting requirements.
- A practical internal review window for general enquiry records is up to 24 months unless a booking, dispute or legal reason requires longer retention.
- Rate-limit and security records should be kept only for as long as they are useful for abuse prevention.
- This page does not promise automatic deletion, because that workflow is not currently automated in the site code.
Sharing data
- Within NMR Studios where enquiry review or follow-up is needed.
- With service providers needed to host the site, process enquiries, send internal notifications or store enquiry records.
- With legal or regulatory authorities where required by law or to protect legitimate rights and safety.
- NMR Studios does not sell enquiry data and does not publish enquiry details publicly.
Media and privacy expectations
Submitting the enquiry form does not grant permission to publish wedding photographs or films.
Portfolio use, public sharing or social posting of media requires separate permission or agreement. Enquiry consent and media-publication permission are treated as separate matters.
Your rights
- Ask for access to the personal data held about you.
- Ask for inaccurate data to be corrected.
- Ask for deletion where there is no overriding reason to keep the data.
- Ask for processing to be restricted in some situations.
- Object to processing based on legitimate interests.
- Withdraw consent where consent is the relevant basis.
- Complain to the Information Commissioner's Office (ICO) if you believe your data has been handled unfairly.
Until verified public contact details are published, requests about privacy rights can be started through the enquiry route.
Cookies and analytics
The current site does not intentionally use analytics or marketing cookies.
Hosting and security providers may still process standard technical logs needed to run and protect the website. If analytics or marketing tools are added later, this policy should be updated.
Changes to this policy
This policy may be updated as the website, enquiry flow, providers or legal requirements change.
The current effective date is 28 June 2026.