Privacy Policy

Effective Date: July 3, 2026

1. Introduction and Company Information

This Privacy Policy explains how Northlight Portrait Studio collects, uses, discloses, stores, and protects personal information in the course of operating a photo-studio business in Canada. We are committed to handling personal information in a manner that complies with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy legislation.

Northlight Portrait Studio is the organization responsible for the collection and processing of personal information described in this Privacy Policy.

Business Address: 214 Queen Street West, Toronto, ON M5V 2A5, Canada
Email: [email protected]
Phone: +1 (416) 782-5946

This Privacy Policy applies to personal information collected through our studio, website, booking channels, email communications, phone communications, in-person consultations, photography sessions, and related services.

2. Data Collection and Processing

Northlight Portrait Studio may collect personal information directly from you, automatically through our website or digital tools, and from third parties where permitted by law or with your consent.

The types of personal information we may collect include:

• Identification information, such as your name, preferred name, and contact details;
• Booking and appointment information, including session dates, service preferences, and communication history;
• Billing and payment information, such as invoice details and payment confirmation records;
• Photographic images, video, and related creative content captured during sessions;
• Client preferences, styling notes, and session instructions;
• Information you provide in forms, emails, surveys, reviews, or consultations;
• Technical information, such as IP address, browser type, device identifiers, and website usage data;
• Consent records and communication preferences;
• Any other information you choose to share with us in connection with our services.

We limit collection to what is reasonably necessary for the purposes identified in this Privacy Policy or as otherwise permitted by law.

3. Purpose of Data Processing

Northlight Portrait Studio processes personal information for the following purposes:

• To provide photography and related studio services;
• To schedule, confirm, reschedule, and manage appointments;
• To communicate with clients regarding inquiries, bookings, deliverables, and customer support;
• To create, edit, store, and deliver photographic products and services;
• To process payments, issue invoices, and maintain financial records;
• To personalize sessions and improve the client experience;
• To maintain internal records and business operations;
• To operate, secure, and improve our website and digital systems;
• To comply with legal, tax, accounting, and regulatory obligations;
• To protect our rights, property, staff, clients, and studio premises;
• To send marketing communications where permitted by law and, where required, with consent;
• To manage disputes, claims, and investigations.

4. Legal Basis for Processing

Under Canadian privacy law, we process personal information only where we have a lawful and appropriate basis to do so. Depending on the circumstances, Northlight Portrait Studio may rely on one or more of the following grounds:

• Consent: You have given express or implied consent for a specific purpose;
• Contractual necessity: Processing is necessary to provide requested services or fulfill an agreement with you;
• Legitimate business purposes: Processing is necessary for reasonable business purposes, provided your interests and rights are appropriately protected;
• Legal obligation: Processing is required to comply with applicable laws, regulations, court orders, or lawful requests;
• Protection of interests: Processing is necessary to protect the safety, security, or legal interests of individuals or the studio.

Where consent is the basis for processing, you may withdraw that consent at any time, subject to legal or contractual restrictions and reasonable notice.

5. Data Sharing and Third Parties

Northlight Portrait Studio does not sell personal information. We may share personal information with trusted third parties only as necessary for the purposes described in this Privacy Policy, including:

• Payment processors and financial institutions;
• Cloud storage, file delivery, and backup service providers;
• Website hosting, analytics, and IT support providers;
• Scheduling, customer relationship management, and email service providers;
• Professional advisors, such as accountants, lawyers, and insurers;
• Government authorities, regulators, or law enforcement where required by law;
• Subcontractors or collaborators involved in delivering a photography project, where necessary and appropriate;
• Other third parties with your consent or as otherwise permitted by law.

We require third parties that process personal information on our behalf to protect it using appropriate contractual, technical, and organizational safeguards.

6. Data Transfer to Third Countries

Some of our service providers may store or process personal information outside Canada, including in the United States or other jurisdictions. As a result, your personal information may be subject to the laws of those jurisdictions and may be accessible to courts, law enforcement, or regulatory authorities in those countries.

When personal information is transferred outside Canada, Northlight Portrait Studio takes reasonable steps to ensure that it is protected by appropriate safeguards and that the transfer complies with applicable Canadian privacy requirements.

7. Storage Duration

Northlight Portrait Studio retains personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and accounting obligations, to resolve disputes, and to enforce agreements.

Retention periods may vary depending on the type of information and the purpose for which it is used. For example:

• Client and booking records are retained for the duration of the business relationship and for a reasonable period thereafter;
• Financial and tax records are retained for the period required by applicable law;
• Photographs and creative files may be retained for the period necessary to deliver services, maintain archives, or support reorders, unless you request deletion and we are not required to retain them;
• Marketing preferences are retained until you unsubscribe or otherwise withdraw consent, subject to legal requirements.

When personal information is no longer required, we will securely delete, anonymize, or destroy it in accordance with our retention practices.

8. User Rights

Subject to applicable law, you may have the following rights regarding your personal information held by Northlight Portrait Studio:

• Access: You may request confirmation of whether we hold personal information about you and request access to it;
• Rectification: You may request correction of inaccurate, incomplete, or outdated personal information;
• Erasure: You may request deletion of personal information in certain circumstances, subject to legal and contractual retention obligations;
• Restriction: You may request that we limit the use of your personal information in certain situations;
• Data portability: Where applicable, you may request a copy of certain personal information in a structured, commonly used format;
• Objection: You may object to certain processing activities, including some forms of direct marketing where applicable.

To exercise any of these rights, please contact us using the details in Section 12. We may need to verify your identity before responding to your request. We will respond within a reasonable time and in accordance with applicable legal requirements.

9. Withdrawal of Consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time by contacting Northlight Portrait Studio. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Please note that if you withdraw consent for certain information or uses, we may no longer be able to provide some services, deliver products, or maintain certain communications. We will explain any consequences of withdrawal where relevant.

10. Right to Complain

If you have concerns about how Northlight Portrait Studio handles your personal information, we encourage you to contact us first so we can try to resolve the matter promptly.

You may also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or with the applicable provincial privacy authority, depending on the circumstances and the applicable law.

We will cooperate with any lawful complaint investigation and take appropriate steps to address substantiated concerns.

11. Data Security

Northlight Portrait Studio uses reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification.

These measures may include:

• Access controls and role-based permissions;
• Secure storage and password protection;
• Encryption or other security technologies where appropriate;
• Staff confidentiality obligations and privacy training;
• Regular review of systems and security practices;
• Secure disposal of records when no longer needed.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Contact Information

If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact:

Northlight Portrait Studio
214 Queen Street West, Toronto, ON M5V 2A5, Canada
Email: [email protected]
Phone: +1 (416) 782-5946

13. Changes to Privacy Policy

Northlight Portrait Studio may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will take reasonable steps to notify you, such as by posting the updated policy on our website or by other appropriate communication methods.

The revised Privacy Policy will become effective on the date indicated at the top of the document unless otherwise stated. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.