Trust & Security

We use reasonable safeguards appropriate for a small photography business.

Hicks Photo LLC uses administrative, technical, and organizational safeguards designed to protect client information, galleries, invoices, and business records. Our practices are scaled to a photography studio and reviewed as tools, vendors, and risks change.

Access to client information is limited to people and providers who need it.

Client information is used only for legitimate business purposes such as inquiries, bookings, sessions, editing, galleries, invoices, products, support, accounting, and legal compliance. Access is limited to Hicks Photo LLC personnel and service providers who need the information to perform their role.

Payment card details are handled by secure payment providers, not stored by our website.

Invoices and online payments may be processed by secure third-party payment providers. Hicks Photo LLC does not store full card numbers or card security codes on the website. Payment providers are responsible for their own payment-security controls, and we receive limited transaction details needed to confirm payments, issue refunds, maintain accounting records, and respond to disputes.

The website is designed to use encrypted connections and safe operational practices.

The website is intended to be served over HTTPS. We use reputable hosting, dependency management, access controls, and standard platform protections. We do not ask visitors to enter payment card numbers directly into ordinary website forms.

Private galleries are meant for invited clients and authorized viewers.

Client galleries may be delivered through password-protected or private links depending on the project and platform. Clients are responsible for sharing gallery links and passwords only with people they authorize. No online gallery should be considered a permanent archive unless expressly agreed in writing.

If a security issue affects personal information, we investigate and take appropriate action.

If Hicks Photo LLC becomes aware of a personal-data breach, we will investigate, contain it, and work with relevant providers. Where GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals. We will also notify affected people when the law requires it.