Privacy and cookies

Draft, to be reviewed by Really Real. Last updated November 2026.

Who we are

This portal is run by Really Real Ltd, a UK company that provides out of home campaign photography and video. Really Real Ltd is the controller of the personal data described here. Questions or requests: theo@reallyreal.co.uk.

What we collect and why

• Account details. Your name, email address, company and role, so we can set up your access and know who is booking. Our lawful basis is performing our contract with you or your company, and our legitimate interest in running the service securely.
• Bookings and files. Campaign names, markets, dates, briefs, site lists, artwork and the photos and video we deliver. We use them to carry out the work. Photographers working on a shoot see only what they need for that shoot.
• Sign-in and security. Your password (stored hashed, never readable by us), sign-in time, and security codes. Used to protect your account.
• Service records. A record of what is booked, confirmed, changed and downloaded, so we can run the service, resolve queries and keep it working well.
• Emails. We email you about your bookings and sign-in codes. We do not send marketing emails from the portal.

Cookies

We use only cookies that are strictly necessary to run the portal. These keep you signed in and protect your account, for example your sign-in session and the check that you have completed two step verification. They do not track you across other sites and they are not used for advertising. Because they are essential, there is nothing to accept or decline, but you can block cookies in your browser settings, in which case you will not be able to sign in.

The small note that hides this notice once you have seen it is saved in your browser storage, not in a cookie. If we ever add anything beyond essential cookies, such as usage statistics, we will say so here first and give you a simple way to turn it off.

Who else handles your data

We use trusted services to run the portal: Supabase (database, sign-in and file storage), Vercel (hosting), Resend (sending email) and, for larger files, Cloudflare. They process data only on our instructions and under their own data protection terms. We do not sell your data.

How long we keep it

Account and booking records are kept while your company is a customer and for as long afterwards as we need them for accounting and legal reasons. Delivered media is kept for 12 months, then archived and restorable on request. You can ask us to delete or return your data at any time, subject to those obligations.

Your rights

You can ask to see the data we hold about you, correct it, have it deleted, restrict or object to how we use it, or receive a copy. Email theo@reallyreal.co.uk. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.