Effective Date: 25 September 2026
Privacy and Cookie Policy
Photo Firas operates in Australia and the United Arab Emirates.
1. Purpose and scope
This Policy explains how Photo Firas collects, uses, stores, discloses and protects personal information through its website and photography, videography, aerial imaging, editing and related services. It also explains how individuals may exercise privacy rights and how cookies and similar technologies are used.
This Policy applies to clients, prospective clients, website visitors, event attendees, photographed or recorded persons, models, suppliers, contractors and other people whose information is handled in connection with the Services. Additional notices may be provided for a particular project, form or jurisdiction. Where they conflict, the more specific notice applies to that activity.
2. Who is responsible for personal information
Photo Firas is operated by [INSERT FULL LEGAL NAME AND ENTITY TYPE]. Australian registration: [INSERT ABN OR ACN]. UAE registration, if applicable: [INSERT UAE LEGAL NAME, TRADE LICENCE NUMBER AND ISSUING AUTHORITY OR STATE NOT APPLICABLE]. Registered or principal business address: [INSERT FULL BUSINESS ADDRESS].
The Photo Firas entity that determines why and how personal information is processed is the controller for that processing. If a different regional supplier is identified in a Quote or Booking Confirmation, that supplier is the controller for the booking and will provide its details before the booking is concluded.
Privacy contact: info@photofiras.com | +61 452 633 633 | Dernancourt, South Australia, Australia.
3. Applicable privacy frameworks
For Australian activities, Photo Firas complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme where they apply. If a small-business exemption or another exemption applies, Photo Firas will still handle information consistently with this Policy unless a different lawful notice is given.
For UAE activities, Photo Firas complies with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable federal or Emirate-level rules. If processing is governed by the DIFC Data Protection Law, the ADGM Data Protection Regulations or another special-zone regime, the applicable rights and regulator may differ and an additional notice will be provided where required.
4. Personal information collected
4.1 Contact and identity information
- name, title, business name, role and authorised representative details;
- email address, telephone number, WhatsApp or other messaging details;
- postal, billing, event, venue and property addresses; and
- identity, age or guardian-authority evidence where reasonably necessary for access, child consent, safety or legal compliance.
4.2 Enquiry booking and transaction information
- enquiry content, service interests, dates, schedules, locations, budgets and briefs;
- quotes, contracts, invoices, payment status, refunds and accounting records;
- project communications, approvals, selections, complaints and feedback; and
- information needed for permits, venue access, insurance, safety and drone operations.
Payments may be handled by a bank or payment provider. Photo Firas does not intentionally retain complete payment-card numbers or security codes unless a lawful, secure payment arrangement expressly requires it.
4.3 Photography video and audio information
- photographs, video, audio, voices, names, captions and likenesses;
- date, time, location, device and file metadata;
- editing instructions, image selections and delivery records; and
- model, property, portfolio and guardian releases.
An ordinary photograph is not automatically treated as biometric information. It may become biometric or sensitive information if processed through technology for unique identification, or if it reveals sensitive characteristics and applicable law treats it as sensitive. Photo Firas will not use facial recognition or biometric identification without a specific lawful basis and additional notice.
4.4 Website device and communications information
- IP address, browser, device, operating system, referral page, pages viewed, timestamps and security logs;
- cookie identifiers and preferences;
- contact-form submissions and anti-spam information; and
- communications through email, telephone, WhatsApp, Instagram or other channels selected by the individual.
4.5 Sensitive or special-category information
Photo Firas does not seek sensitive information unless reasonably necessary. A Client may voluntarily provide accessibility, health, religious, cultural or safety information relevant to a shoot. Where the law requires consent for collection or use, Photo Firas will request it and limit the information to what is necessary.
5. How information is collected
Information may be collected:
- directly from an individual through the Website, email, telephone, messaging, meetings, contracts, forms and the performance of Services;
- from a Client, event organiser, parent, guardian, employer, venue, agency or authorised representative;
- automatically from devices and Website technology;
- from photographers, editors, drone operators and other personnel working on a project; and
- from public or authorised sources where reasonably necessary and lawful.
Where practical, Photo Firas will collect information directly from the individual. If information is received from another person, Photo Firas will take reasonable steps to ensure appropriate notice is given, especially where the information will be published or used beyond delivering the Client’s private project.
6. Purposes and lawful grounds
Photo Firas processes personal information only for identified purposes and on a lawful ground available in the relevant jurisdiction. Depending on the activity, the ground may be consent, steps requested before a contract, performance of a contract, compliance with law, establishment or defence of legal claims, protection of vital interests, or a legitimate business interest recognised by applicable law and not overridden by the individual’s rights.
| Purpose | Typical information and lawful ground |
|---|---|
| Respond to enquiries and prepare quotes | Contact details, brief and budget; requested pre-contract steps, consent or a permitted business interest. |
| Confirm and perform Services | Booking, payment, access, images, video and communications; performance of the contract and related legal obligations. |
| Edit deliver and support | Content, selections, delivery and service records; contract performance and quality control. |
| Safety permits and drone compliance | Location, site, access and permit details; legal obligation, contract and safety interests. |
| Accounting tax insurance and claims | Invoices, payments, identity and communications; legal obligations and legal claims. |
| Portfolio social media and advertising | Selected Content, name or tag where agreed; separate consent or another clearly notified lawful basis. |
| Direct marketing | Contact details and preferences; consent or another basis expressly permitted by law, with an unsubscribe option. |
| Website operation and security | Device, logs, essential cookies and forms; security, service operation, consent where required, and permitted business interests. |
If information is needed to enter or perform a contract and it is not provided, Photo Firas may be unable to quote, confirm or complete the Services. Fields that are optional should be identified where practical.
7. Photographed persons who are not the Client
Photography and video may capture event guests, employees, family members, visitors or members of the public. Photo Firas and the Client will allocate notice and consent responsibilities according to who controls the event, location and intended use. Photo Firas will not treat a Client’s general instruction as authority for public advertising use of another person’s identifiable image where separate consent is required.
For private delivery, Photo Firas may process images as necessary to perform the booking and for related legal and operational purposes. Public portfolio, advertising, tagging or promotional use will be based on a separate Portfolio Consent or another lawful basis that has been clearly communicated.
8. Children
Photo Firas does not knowingly invite a child to submit personal information directly through the Website. A parent, legal guardian or person with lawful authority should make the enquiry and provide any required information on the child’s behalf.
A child’s participation and any publication of the child’s image require appropriate authority and must be consistent with the child’s safety, dignity and best interests. Portfolio, advertising, tagging or paid-media use requires a separate and specific guardian authorisation. Photo Firas may request proof of authority and may refuse or stop a use where authority is unclear or circumstances have materially changed.
For UAE activities involving children under 13 or digital-platform functions, Photo Firas will apply the restrictions and parental-control requirements of applicable child digital-safety law. A Client or organiser cannot waive protections that the law grants directly to the child.
9. Cookies and similar technology
9.1 Current use
The Website may use essential cookies or similar storage required for security, form operation, session management and user preferences. The Website may also connect to third-party resources, such as web fonts, anti-spam services, embedded social content or messaging links, which may receive an IP address and device information.
As at the effective date of this Policy, Photo Firas does not knowingly use advertising cookies on the Website. If analytics, advertising, retargeting or other non-essential technologies are introduced, Photo Firas will update this Policy and provide a consent or preference tool where required before those technologies operate.
9.2 Cookie choices
A visitor may use the Website’s cookie controls, where displayed, or browser settings to block or delete cookies. Blocking essential technology may affect Website functions. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.
10. Communications and direct marketing
Service communications necessary for an enquiry or booking are not marketing. Photo Firas will send promotional email, SMS or WhatsApp messages only where permitted by law and will identify the sender and provide a functional way to unsubscribe. A one-off enquiry will not automatically be treated as consent to ongoing marketing.
An individual may opt out at any time by using the unsubscribe facility or contacting Photo Firas. A minimal suppression record may be retained to ensure the person is not added again inadvertently.
11. Disclosure of personal information
Photo Firas may disclose relevant information only as reasonably necessary to:
- employees, photographers, videographers, drone operators, editors, assistants and subcontractors;
- hosting, email, cloud storage, gallery, file-transfer, backup, website-security and technical-support providers;
- banks, payment processors, accountants, auditors, tax advisers and insurers;
- printing laboratories, album suppliers, couriers, venues, permit authorities and production partners;
- WhatsApp, Instagram, Meta or another communication platform chosen by the individual;
- legal advisers, regulators, courts, law-enforcement bodies or authorities where disclosure is required or lawfully justified; and
- a genuine purchaser or successor in a business transaction, subject to appropriate confidentiality and lawful notice.
Service providers must be selected and managed with reasonable care and should process personal information only for authorised purposes, subject to appropriate contractual, confidentiality, security and deletion obligations.
12. International transfers
Photo Firas operates across Australia and the UAE and may use providers that store or access information in other countries. Likely locations may include Australia, the United Arab Emirates, the United States, the United Kingdom and countries in the European Economic Area, depending on the provider, data-centre configuration and communication channel used.
Before a restricted international transfer, Photo Firas will use a lawful transfer mechanism and reasonable safeguards appropriate to the information and jurisdiction. These may include contractual protections, due diligence, access controls, encryption, a recognised adequacy mechanism, explicit consent where valid, or another statutory exception. Individuals may request available information about the relevant safeguards.
13. Retention and deletion
Photo Firas retains personal information only for as long as reasonably necessary for the purpose collected, the booking, legal obligations, claims, security and legitimate archival needs. The following periods are the normal maximums unless a longer or shorter period is required by law, a dispute, consent, or the Booking Confirmation.
| Record | Normal retention period |
|---|---|
| Unsuccessful enquiries | Up to 24 months after the last substantive contact. |
| Contracts invoices payments and tax records | At least 7 years after the relevant transaction, or the longer period required by applicable law. |
| Project communications and releases | 7 years after completion, or longer while a licence, consent, minor’s protection issue or claim remains relevant. |
| Final Deliverables and online galleries | Normally 12 months after final delivery, unless the Booking Confirmation provides otherwise. |
| RAW working and rejected files | Normally 6 months after final delivery, unless needed for an unresolved issue or expressly agreed archival service. |
| Portfolio material | Until consent is withdrawn, the use is no longer necessary, or applicable law requires removal, subject to lawful archival and completed materials. |
| Website security and server logs | Normally up to 12 months, unless a security incident or legal requirement justifies longer retention. |
| Marketing preferences | Until opt-out, plus a minimal suppression record for as long as reasonably required to honour the opt-out. |
Deletion from active systems may be followed by deletion from backups on the provider’s normal rotation. Photo Firas may anonymise information so it can no longer reasonably identify an individual and retain the anonymised information for analysis or administration.
14. Security
Photo Firas uses reasonable administrative, physical and technical safeguards appropriate to the nature of the information. Measures may include access limitation, strong authentication, device and software updates, secure transfer links, encryption where appropriate, backups, confidentiality obligations, processor due diligence and secure deletion.
No internet transmission or storage system is completely secure. Individuals should avoid sending highly sensitive information through ordinary email or social-media messaging unless an appropriate secure method has been agreed.
15. Data incidents
Photo Firas will investigate suspected loss, unauthorised access, disclosure or alteration of personal information, take reasonable containment and remediation steps, and document the response. Where applicable law requires notification to an individual, the Office of the Australian Information Commissioner, the UAE Data Office or another regulator, notification will be made within the legally required period and contain the required information.
16. Individual rights
Depending on the governing law and circumstances, an individual may have rights to:
- receive information about processing and request access to personal information;
- correct incomplete or inaccurate information;
- withdraw consent for future processing;
- request deletion, restriction, cessation or objection where the applicable law provides that right;
- request transfer or a usable copy of information where data portability applies;
- object to direct marketing;
- request information about significant automated processing and seek human review where applicable; and
- complain to Photo Firas and, where eligible, to the relevant regulator.
Photo Firas does not use solely automated decision-making that produces legal or similarly significant effects on individuals.
A request may be sent to info@photofiras.com. Photo Firas may request proportionate identity verification and authority evidence, especially for images, child information or a request made by a representative. Photo Firas will respond within the period required by applicable law and will explain any lawful refusal or limitation. No fee will be charged unless the law permits a reasonable fee in the circumstances.
17. Portfolio consent withdrawal and image removal
A person who gave optional Portfolio Consent may withdraw it for future controlled use by contacting Photo Firas and identifying the relevant image or project. Photo Firas will stop new uses and remove the material from Website pages and social accounts it controls within a reasonable period, ordinarily 30 days, unless continued retention or use is legally permitted or required.
Withdrawal cannot always recall printed materials already distributed, a lawful use already completed, third-party copies made outside Photo Firas’s control, or records that must be retained. Photo Firas will nevertheless take reasonable steps within its control and will explain any limitation.
18. Third party sites and platforms
The Website may link to Instagram, WhatsApp, maps, payment services, galleries or other third-party platforms. Those parties may process information under their own policies and may operate internationally. Photo Firas is not responsible for an independent third party’s privacy practices, but will not represent a third-party service as mandatory where a reasonable alternative is required by law.
19. Complaints
A privacy complaint should be sent to info@photofiras.com with sufficient detail and the preferred contact method. Photo Firas will acknowledge the complaint within a reasonable time, investigate fairly, and aim to provide a substantive response within 30 calendar days or the shorter period required by law.
An eligible Australian complainant may contact the Office of the Australian Information Commissioner at www.oaic.gov.au after first giving Photo Firas a reasonable opportunity to respond. For UAE processing, an individual may contact the UAE Data Office or other competent regulator when the relevant complaint channel is available. DIFC or ADGM processing may be subject to the commissioner or office responsible for that jurisdiction.
20. Changes to this Policy
Photo Firas may update this Policy to reflect changes in law, technology, vendors or practices. The revised version will state a new effective date and be published before it applies. Where a change materially affects an existing consent or a high-impact use, Photo Firas will provide additional notice and obtain renewed consent where required.
21. Contact
Email: info@photofiras.com
Telephone and WhatsApp: +61 452 633 633
General location: Dernancourt, South Australia, Australia
Legal and postal address: [INSERT FULL ADDRESS FOR PRIVACY NOTICES]