Privacy Policy

Who is responsible

Nhihad Hassan Photography is a Toronto photography business operated by Nhihad Hassan. Questions, access or correction requests, consent withdrawals, and privacy complaints can be sent to hello@nhihadhassan.ca. The business is accountable for personal information under its control, including information processed by service providers.

Information collected

• Contact and inquiry details, including name, email, optional phone number, requested date, location, service, budget, referral source, and message.
• Booking details, addresses where needed for a contract or service, schedules, locations, event contacts, preferences, and communications.
• Agreements, electronic signatures, consent choices, invoices, payment status, and transaction records. The website does not collect payment-card numbers; current invoices direct clients to Interac e-Transfer or cash.
• Photographs and video of identifiable people, gallery access details, downloads, favourites, selections, comments, and collaborator decisions.
• Technical and security information such as IP address, browser and device information, request logs, access attempts, and timestamps.

Why information is used

Information is used to respond to inquiries; prepare quotes, bookings, agreements, invoices, and receipts; schedule and provide photography services; deliver and secure galleries; communicate with clients and approved collaborators; keep accounting and contractual records; prevent abuse; troubleshoot; and meet legal obligations. Optional details are used only when provided and relevant to the inquiry or service.

An inquiry allows the business to respond about that inquiry. It is not unlimited consent for promotional mailing campaigns.

Consent and photography

Consent is requested in a manner appropriate to the information and purpose. Some collection is necessary to answer a request or perform a contract; optional information can be withheld, although that may limit what the business can do. Consent may be withdrawn for future uses, subject to contractual, legal, accounting, evidentiary, and operational limits.

Permission to provide photography services is distinct from permission to use identifiable images publicly for a portfolio, social media, advertising, competitions, or third-party commercial licensing. The applicable signed agreement and recorded choices control. A parent or guardian must provide any consent required for an individually photographed minor.

Service providers and cross-border processing

The site uses Vercel for hosting and privacy-focused web analytics, Supabase for database and authentication services, Cloudflare R2 for image and file storage, and Resend for email delivery. Optional Google Business/Profile, Google Calendar, and Meta Instagram integrations may process information when connected or used. These providers may process information outside Canada, including in the United States, where it may be subject to local law. Providers receive only information reasonably needed for their role.

Client information may also be shared with a photographer, assistant, editor, second shooter, or collaborator when necessary to provide the agreed service and subject to appropriate confidentiality expectations. Information is not sold.

Cookies and browser storage

Vercel Web Analytics is configured without advertising trackers and does not use cookies. Essential authentication and access cookies may be used for signed-in administration or protected collaborator experiences. The contact form saves a limited draft in session storage in the current browser tab and removes it after a successful submission. Theme choice and gallery selections may be stored locally on the device. The concierge may keep a short transcript in session storage. Details and controls are in the Cookie Policy.

Safeguards, links, and retention

Reasonable administrative, technical, and physical safeguards are used based on the sensitivity of the information. Private records use access controls; protected links use hard-to-guess tokens and, where applicable, passwords or expiring access. No system can promise absolute security. Recipients should avoid forwarding private links.

Records are kept only as long as reasonably needed for service delivery, contractual and dispute records, legal and tax obligations, security, or a documented archival purpose. Under the standard service agreement, a delivered gallery stays available for about 1 year from delivery and the business keeps an archive copy for about 1 year after delivery; restoring a gallery after it has expired may incur a rehosting fee. The signed agreement for a specific booking controls its actual figures. Backups and provider logs can persist for a limited period after deletion. A proposed category-by-category schedule is maintained internally and requires owner approval before automated deletion of existing records or photography archives.

Your choices and requests

You may ask what personal information the business holds about you, request access or correction, withdraw consent for future optional uses, or raise a complaint by emailing hello@nhihadhassan.ca. Identity may need to be verified. Access can be limited where required or permitted by law, including to protect another person’s information. If a concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada.

Children, incidents, and changes

The website is not directed to children. Information about minors may be handled as part of a family, event, school, or portrait booking with appropriate involvement of a parent, guardian, organizer, or other authorized person.

Suspected privacy incidents are assessed, contained, documented, and reported or notified where required. This policy may change as services or legal requirements change. Material changes will be posted here with a new date and will not retroactively expand an existing consent.