This policy applies to people in Finland and the European Economic Area who use sujanstudio.com, request a quote, book a shoot, appear in work we produce, or apply to join our photographer network. It is written to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Finnish Data Protection Act (Tietosuojalaki 1050/2018). Cookies and similar technologies are covered separately in our Cookie Policy.
Sujan Studio is established in Australia. Australia is not the subject of a European Commission adequacy decision, which means personal data reaching us is transferred to a third country. Section 6 sets out honestly where that stands rather than asserting that it is solved.
1. Who is responsible for your data
The controller of the personal data described in this policy is Sujan Studio (ABN 13 680 271 434), trading as Sujan Studio, of 135 Pirie Street, Adelaide SA 5000, Australia. You can reach us at support@sujanstudio.com or +61 3 6163 3896.
A. Representative in the European Union
Because we are established outside the EEA and offer services to people in the EEA, Article 27 of the GDPR may require us to designate a representative in the Union. We have not yet designated one. Until we do, you can exercise every right described in this policy by contacting us directly at support@sujanstudio.com, and you may also complain to your own supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
B. Data Protection Officer
We have not appointed a Data Protection Officer. Privacy enquiries are handled by our team and reach a person, not a queue: write to support@sujanstudio.com and we will respond.
2. What we collect, and when
We collect what the service actually needs and we have listed it specifically rather than in general terms.
2.1. When you request an estimate or contact us
Your first and last name, email address and phone number; the occasion and service you are asking about; the date and start and end time of the event; the address of the event, including street, city, region, postcode and country, and its approximate coordinates; your timezone and language; any referral or discount code you enter; and anything you choose to write in the free-text message field.
The event address is personal data in its own right. Where a shoot takes place at a home, the address identifies the household living there, and we treat it accordingly.
2.2. When a booking goes ahead
The details above, plus the brief and any notes or must-have shots you give us, correspondence about the booking, and the record of what was delivered. Card details are handled by our payment provider and are not stored by us.
2.3. Photographs and video
Images and video of identifiable people, and the technical metadata attached to those files, including the time and, where the camera records it, the place they were taken. This is the substance of what we do, and it is the most sensitive category of data we hold.
2.4. If you apply to photograph for us
Identity and business details, portfolio work, insurance evidence, payment details for fees, and the records needed to verify that you are entitled to do the work.
2.5. Technical and usage data
Where analytics is switched on with your consent, we record the pages you view, the actions you take in the quote form, and diagnostic information about errors. We record the suburb or city and the month of an enquiry for planning purposes; the exact street address, phone number and exact date are deliberately kept out of analytics and stay in the booking system.
We also store a short record in your browser of how you arrived at the site — the channel, any referral code, the time and the page URL — which expires after 30 days, and a record for the current browser tab of which pages you looked at before enquiring, which is sent to us only if you actually submit an enquiry. Neither is strictly necessary for the site to work and, in the EEA, neither is stored unless you have consented. Our Cookie Policy lists every item individually.
2.6. Address lookup and location
The address field in our quote form is powered by Google Maps and Places. As you type an address, what you type is sent to Google to return suggestions, and Google receives your IP address. That means the event address reaches Google as well as us. If you separately allow your browser to share your location, we use it to show relevant local results and we keep it only for the current browser tab.
2.7. What we do not do
We do not buy personal data from data brokers, we do not sell or rent your personal data, and we do not use automated decision-making producing legal or similarly significant effects about you within the meaning of Article 22.
3. Why we process it, and our lawful basis
Article 6 of the GDPR requires a lawful basis for each purpose. Ours are set out per purpose rather than as a single list, so you can see which applies to you.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to a quote request and preparing an estimate | Contact details, occasion, date and time, event location, message | Article 6(1)(b) — steps taken at your request before entering a contract |
| Matching your request to a photographer and running the booking | Booking details, event address, brief, correspondence | Article 6(1)(b) — performance of our contract with you |
| Capturing, editing and delivering photographs and video | Images, video, file metadata, gallery access records | Article 6(1)(b) for the person who books the shoot |
| Photographing other people present at an event we were engaged to cover | Images and video of attendees | Article 6(1)(f) — our and the customer's legitimate interest in producing a record of the event, balanced against attendees' rights. You can object under Article 21 — see section 7 |
| Using work in our own marketing, portfolio or on social media | Selected images and video | Article 6(1)(a) — your consent, given specifically for that use and withdrawable |
| Sending marketing email or SMS | Name, email address, phone number | Article 6(1)(a) — your consent, in line with the Finnish Act on Electronic Communications Services |
| Website analytics and product measurement | Page views, funnel steps, coarse location, error diagnostics | Article 6(1)(a) — your consent, given through the cookie banner and withdrawable at any time |
| Keeping the site and accounts secure and preventing fraud and abuse | Technical logs, request data | Article 6(1)(f) — our legitimate interest in a service that is not abused |
| Handling complaints, disputes and claims | Booking record, correspondence, delivery evidence | Article 6(1)(f) — our legitimate interest in defending and resolving claims |
| Keeping accounting and tax records | Transaction and invoice records | Article 6(1)(c) — a legal obligation to which we are subject |
Where we rely on legitimate interests, the GDPR requires us to weigh that interest against your rights. We are documenting those assessments now and will share the reasoning for any of them if you ask at support@sujanstudio.com.
We do not seek to process special categories of personal data under Article 9. If you tell us something falling into those categories in a free-text field — for example about health or beliefs relevant to an event — we process it only so far as needed to run the booking, and you may ask us to remove it.
4. How long we keep it
We keep personal data only as long as the purpose it was collected for requires, and then delete or de-identify it. Holding onto data indefinitely is itself a failure, so each category has a period rather than a general assurance.
| Category | Retention period |
|---|---|
| Quote requests that never became a booking | Kept while you are in contact with us and for 12 months after our last exchange, then deleted. |
| Booking records and correspondence | Kept for the life of the booking and for 3 years after the shoot, which is the period in which a claim about it could still realistically be brought against either of us. |
| Delivered photographs and video | Delivered files stay available for download for 12 months, after which they are deleted from active storage. |
| Accounting and invoice records | Kept for the period the applicable bookkeeping and tax law requires — under the Finnish Accounting Act, a minimum of six years from the end of the accounting year. |
| Photographer application and verification records | Applicant records are kept while an application is active; unsuccessful applications are deleted once the decision is made. |
| Support and dispute correspondence | Kept for as long as needed to resolve the matter and for 12 months afterwards. |
| Marketing consent records | Kept while we rely on the consent and for 3 years after it is withdrawn or last used, so that we can show what you agreed to and when. The record is of the consent itself, not of any wider profile. |
| Analytics data | Analytics data is retained for 12 months from collection. |
Where a period is required by law, that period governs. Where a claim or investigation is live, we keep what is relevant to it until it is resolved. Deletion at the end of these periods is currently carried out as a review rather than by a fully automated job, so it may happen slightly after the period ends rather than on the day; you can ask us to delete your data sooner and we will.
5. Who we share it with
We share personal data only where it is needed to deliver the service. Article 28 of the GDPR requires a written processing agreement with each of them. Where a provider's standard data processing terms apply to our account, those terms are in place; we are completing that paperwork across the remaining providers and will confirm the position for any individual provider on request.
5.1. The photographer assigned to your booking
The photographer who accepts your booking receives what they need to turn up and do the work: your name, contact details, the event address, the time and the brief. They do not receive your quote history, your payment details or anything about other bookings. The full event address is released to the photographer who has accepted the booking, not to every photographer considered for it.
5.2. Service providers acting on our instructions
Hosting and content delivery, file and video storage, maps and address lookup, payment processing, email delivery, and product analytics and error tracking. Each is listed below with what it can access and where it processes data.
| Service | Purpose | Data it can access | Processing location |
|---|---|---|---|
| PostHog | Error tracking and product analytics | Error traces, page events, account ID, IP address | United States. Requests are routed through our own domain, ph.sujanstudio.com |
| Cloudflare | Website hosting, content delivery, image and video delivery | Every request to this site: IP address, browser and device information, requested page. Images and video in transit and cached at edge nodes | Global edge network, including nodes inside and outside the EEA. Traffic is served from the node nearest you |
| Google (Maps and Places) | Showing maps and suggesting an address as you type it into the quote form | Your IP address and the characters you type into the address field, including the event address. Where you allow it, the location your browser reports | Google's global infrastructure, including the United States |
| Amazon S3 (Amazon Web Services) | Image and file storage | Client images, galleries, file metadata | Sydney, Australia (ap-southeast-2). Private storage, reached only through time-limited signed links |
| Stripe | Payments and payouts | Name, email, billing address, transaction records. Card numbers go directly to Stripe — we never hold them | United States |
| Ventra IP | Transactional and marketing email | Recipient name and email address, message contents, gallery links, subscription status, open and click events | Australia |
This is the full list of providers who can access personal data on our behalf. If we add one, this table changes before the provider is switched on. Ask us at support@sujanstudio.com if you want to know more about any of them.
5.3. Others
We disclose personal data to authorities, courts or advisers where we are legally required to, or where it is necessary to establish or defend a legal claim. If the business were sold or restructured, personal data could pass to the acquirer, subject to confidentiality and to this policy continuing to apply.
6. Transfers outside the EEA
This section matters more than any other for people in Finland, so we have not softened it.
Sujan Studio operates from Australia. The European Commission has not adopted an adequacy decision for Australia under Article 45. Personal data you give us therefore leaves the EEA and goes to a country the Commission has not found to offer an equivalent level of protection.
For a transfer of that kind the GDPR requires appropriate safeguards under Article 46 — normally the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supported by an assessment of whether the law and practice of the destination country undermines them, and by supplementary technical measures where it does.
We will not tell you those safeguards are in place when they are not. As at the date at the top of this page, we have not completed Standard Contractual Clauses covering the transfer of your data from the EEA to Sujan Studio in Australia, and we have not completed a documented transfer impact assessment. That work is under way. We are telling you this rather than leaving you to assume it is settled, because it affects your decision about whether to give us your data at all.
What we do have in place in the meantime are the technical measures described in section 9: private storage for image files with time-limited access links, access controls, and encryption in transit. Those reduce the risk but they are not a substitute for an Article 46 mechanism, and we are not presenting them as one.
Separately from our own transfer, some of the providers listed in section 5 process data outside the EEA on our behalf, as that table shows. We will tell you the current position at any time, and provide a copy of whatever safeguards are then in place, on request at support@sujanstudio.com or at the address in section 11. This section is updated as that changes.
7. Your rights
If you are in the EEA, the GDPR gives you the following rights over your personal data. You do not have to give a reason for exercising most of them, and exercising them is free.
- Access (Article 15). You can ask what personal data we hold about you, why, who we share it with and how long we keep it, and receive a copy.
- Rectification (Article 16). You can have inaccurate data corrected and incomplete data completed.
- Erasure (Article 17). You can have your data deleted where it is no longer needed, where you withdraw the consent it rested on, or where you successfully object. This includes asking us to remove a photograph of you. Erasure does not override records we are legally required to keep, such as accounting records.
- Restriction (Article 18). You can require us to stop using data, while keeping it, for example while we check a claim that it is inaccurate.
- Portability (Article 20). Where we process data on the basis of your consent or a contract, and by automated means, you can receive it in a structured, commonly used, machine-readable format and have it sent to another provider where technically feasible.
- Objection (Article 21). You can object to processing we base on legitimate interests, including being photographed as an attendee at an event we are covering, and we must stop unless we can show compelling legitimate grounds that override your interests. Where you object to direct marketing, we stop, with no balancing test.
- Withdrawing consent (Article 7(3)). Where we rely on your consent — marketing, analytics cookies, use of your images in our own promotion — you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of what we did before.
- Complaint to a supervisory authority (Article 77). You can complain to the data protection authority in the country where you live or work, or where the issue arose. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), whose website is tietosuoja.fi. You do not have to raise it with us first, though we would prefer the chance to fix it.
7.1. How to exercise them, and how quickly we respond
Contact us using the details in section 11. We acknowledge requests on the day we receive them and answer within one month, as Article 12(3) requires. If a request is complex, or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do and why. We may ask for enough information to be confident who you are, and no more.
7.2. If you appear in a photograph but did not book the shoot
You have the same rights. Tell us where and when the photograph was taken and enough to identify yourself in it, and we will locate it and act on your request. Requests concerning a child are handled by the child's parent or guardian and are treated as a priority.
8. Children
Our services are directed at adults arranging photography, not at children.
Where we rely on consent to offer an information society service directly to a child, the Finnish Data Protection Act sets the age at which a child can consent for themselves at 13. Below that age, consent must come from the holder of parental responsibility.
Photographing a child is different from a child using a website. Where a shoot involves children, we require the consent of a parent or guardian, and we do not use images of children in our own marketing without specific, separate consent for that use. A parent or guardian can ask us to remove a child's image at any time and we act on that without argument.
9. Security and data breaches
We use technical and organisational measures appropriate to the risk, including access controls that keep each party to a booking from seeing the other's data beyond what the booking requires, private storage for image files with time-limited access links, and encryption in transit. No system is beyond compromise, and we do not claim otherwise.
If a personal data breach occurs, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as Article 33 requires. Where the breach is likely to result in a high risk to your rights and freedoms, we tell you directly without undue delay under Article 34. We keep a record of every breach, including those we conclude are not notifiable, and of the reasoning.
10. Cookies and similar technologies
Storage on your device — cookies, local storage and similar technologies — is only used with your prior consent, except where it is strictly necessary to deliver the service you asked for. Our Cookie Policy sets out exactly what is used, by whom, for how long, and how to change or withdraw your choice.
11. Contact and changes to this policy
For any question about this policy, to exercise a right, or to complain about how we have handled your data, contact:
: Sujan Studio (ABN 13 680 271 434)
: 135 Pirie Street, Adelaide SA 5000, Australia
Email: support@sujanstudio.com
Phone: +61 3 6163 3896
EU representative: not yet designated. Contact us directly at support@sujanstudio.com for any request under this policy.
If you are not satisfied with our response, you may complain to the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi, or to the supervisory authority of the EEA country where you live or work.
We update this policy when what we do changes. The revision date is shown at the top of the page. Where a change materially affects how we use your data, we tell you before it takes effect rather than relying on you to re-read the page.