The short version. We collect only what we need to photograph your family and deliver your photos. Your photos are private unless you tell us in writing that we can share them. We never sell your information. You can ask to see, fix or delete what we hold at any time.

Who we are

Ana Garcia de Dionisio Bellon trading as Studio Tres (ABN 79 572 758 583), a sole trader based in Melbourne, Victoria. In this policy "we", "us" and "Studio Tres" all mean that business. Ana is the photographer. Her partner Aidan looks after the website and booking system.

Studio Tres is a small business. Whether or not the Privacy Act 1988 strictly applies to a business our size, we handle personal information in line with the Australian Privacy Principles, and this policy is written to that standard.

Privacy questions and requests: hello@studiotres.com.au

What we collect

When you send an enquiry

Your name, and your email address or phone number
Your suburb and your message, if you give them
Whether you ticked the box to receive marketing emails

When you book a session

Your name, email address, phone number and home address (so Ana can come to you)
Your children's first names and ages, and the names of other people in the session
Your answers to the pre-session questionnaire, such as parking, pets, access notes, the best rooms for light and the photos you most want
Your signed services agreement and photo release, including your typed or drawn signature, the date and time, and the IP address used to sign
Payment records: what was paid, when and how. Card details go straight to Stripe, our payment provider. We never see or store your card number.
Whether you ticked the box to receive marketing emails

At and after your session

Photographs of you, your children and your home
A photo of a wall in your home, if you'd like to preview prints on it
Which photos you mark as favourites, choose or order
Any review you choose to write
Emails and messages between us

When you use this website

This website does not use advertising cookies, tracking pixels or third-party analytics.
Our hosting provider keeps standard technical logs, such as IP address and browser type, to keep the site secure and running.
To stop spam and password guessing, we keep a scrambled (hashed) record of the IP address used to send an enquiry, make a booking or try a password. We can't read the address back from it, and it is deleted automatically within a few days.

We don't ask for sensitive information such as health details. If you tell us something sensitive so we can plan your session, for example a child's allergy or sensory needs, we use it only for that session.

Children's information

Family photography means we hold information about children: their first names, ages and images. We collect it only from a parent or legal guardian, never from a child directly.

We collect first names and ages only. We don't ask for birth dates, schools or surnames of children.
A parent or guardian decides, in writing at booking, whether any photo can be shared. The options are full sharing, limited sharing (website and portfolio only) or completely private.
Whatever you choose, we never publish surnames, home addresses, school names, or photos showing school uniforms or logos. We use a child's first name only if you tick the box that allows it.
You can withdraw permission at any time, or ask us to remove one particular photo, with no reason needed.

Why we collect it and how we use it

To reply to your enquiry
To book, plan and carry out your session, and to find your home
To take payment, issue invoices and keep the tax records the law requires
To edit and deliver your photos and fulfil print orders
To send you service messages about your booking: confirmation, prep guide, reminders, your gallery
To show our work, only within the permission you gave in your photo release
To ask you once, after your gallery is delivered, whether you'd like to leave a review
To send you marketing emails, only if you ticked the box to receive them, and always with an unsubscribe link

If you don't give us the details we ask for, we may not be able to reply to you or carry out a session. You're welcome to enquire using a first name only.

We don't sell, rent or trade personal information. We don't use your photos to train artificial intelligence systems, and we don't give them to anyone who would.

Marketing messages and how to stop them

The marketing box on our enquiry and booking forms is unticked by default. We only send marketing emails (new dates, offers, a hello when it's been a while, referral thank-yous) if you tick it. Having a session with us does not put you on a list. Every marketing email says who it's from and has an unsubscribe link. You can also opt out any time by replying "unsubscribe" or emailing hello@studiotres.com.au. We act on opt-outs within five business days, and usually straight away.

Messages about a booking you've made, such as reminders and gallery links, are service messages, not marketing, so you'll still receive those. After your gallery is delivered we send one email asking if you'd like to leave a review. It has an unsubscribe link too, and we don't send it if you've unsubscribed.

Who we share it with

Only the service providers we need to run the business, and only what each one needs:

Netlify (website hosting and data storage). Bookings, client records and gallery photos are stored on Netlify's systems.
Stripe (card payments). Stripe receives your payment details directly and handles them under its own privacy policy.
Our email provider, which delivers the emails we send you.
Our print lab, if you order prints. The lab receives the image files and a delivery name and address.
WhatsApp, if you choose to message Ana that way.
Our accountant or the Australian Taxation Office, where the law requires it.

We also disclose information if the law requires us to.

Storage outside Australia

Netlify and Stripe are based in the United States and store data on servers in the United States and other countries. That means your personal information, including your family's photos, is likely to be stored overseas. Those providers are not bound by Australian privacy law in the same way we are, although we choose providers with strong security and privacy commitments. By booking with us you consent to this overseas storage. If that worries you, talk to us before you book.

How we keep it safe

Your gallery has an unguessable web address and its own password, and search engines are told not to index it.
Our booking and client system is password protected, and only Ana and Aidan can log in.
Data is encrypted in transit (HTTPS) between you and our website.
Original photo files are also kept on Ana's computer and backup drives, which are password protected.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner promptly.

How long we keep it

Our system deletes things on a schedule, so this doesn't depend on anyone remembering.

Your online gallery: available to you for 90 days after delivery, or longer if you ask us to extend it.
Your photo files in our online system: kept for 12 months after delivery in case you need them again, then deleted automatically, along with any photo of your wall. We keep them longer only if you've asked us to, if your gallery is still open, or while a photo permission you gave us is still in place.
Ana's own copies: Ana keeps the original files from your session on her computer and backup drives. Ask us at any time and we'll delete those too.
Portfolio photos: for as long as your permission stands. Withdraw it and we stop using them in anything new and take them down from our website and our own social media pages.
Invoices and payment records: at least five years, because tax law requires it. These are never deleted automatically.
Signed agreements and releases: 7 years, in case of a dispute, then deleted. We keep a release longer only while a photo permission in it is still in use.
Enquiries that don't become bookings: deleted automatically 12 months after you sent them. Sooner if you ask.

Seeing, correcting or deleting your information

You can ask us at any time for a copy of the personal information we hold about you and your children, ask us to correct it, or ask us to delete it. Email hello@studiotres.com.au. We may need to check it's really you first. We'll respond within 30 days, and it's free.

If you ask us to delete your information, we'll delete everything except what the law requires us to keep, such as invoices.

Complaints

If you think we've mishandled your information, please tell us first: hello@studiotres.com.au. We'll acknowledge your complaint within five business days and aim to resolve it within 30 days.

If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

Website: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001

Changes to this policy

If we change how we handle personal information, we'll update this page and change the date at the top. If the change is significant and affects photos or information we already hold about your family, we'll email you.