Last updated: 02 November 2026
01. Data Controller
- Business name: IdeaCave Studios
- Legal Business name: IdeaCave Studios
- Business ID (Y-tunnus): 3665582-6
- Location: Kasperinviita 03, 60150, Seinäjoki, Finland
- Email: [email protected]
- Phone: +358415767399
02. Personal Data We Collect
Depending on how you contact us or use our photography services, we may collect:
- Contact details: name, telephone number, email address and social media account details.
- Booking information: preferred date, location, photography package, session details and communications about your booking.
- Photography-related information: photographs, videos, image selections and information you provide to help us prepare for a session.
- Invoice and payment information: billing name, address, invoice details, payment status and other information required for accounting.
- Communication records: messages, enquiries and other correspondence through WhatsApp, Messenger, Instagram, phone calls, SMS and Gmail.
- Website information: basic technical information that may be processed when you visit our WordPress website, such as server logs and information necessary for website security and operation.
Please do not send sensitive personal information unless it is genuinely necessary for your enquiry or photography booking.
03. Why We Process Your Personal Data
We process personal data for the following purposes:
- Responding to enquiries and communicating with customers.
- Preparing, arranging and managing photography bookings.
- Providing photography services and editing and delivering photographs.
- Managing invoices, payments and bookkeeping.
- Handling customer questions, complaints and requests.
- Maintaining business records and meeting legal obligations.
- Protecting our business, website and customers against misuse or disputes.
We do not use customer photographs for advertising, social media posts or portfolio promotion merely because a customer has booked a session. Separate permission is requested for that purpose.
04. Legal Basis for Processing
We process personal data under the following legal bases provided by the GDPR:
- Contract: processing necessary to arrange and provide photography services, manage bookings and deliver photographs.
- Legal obligation: processing necessary to meet Finnish accounting, taxation and other legal requirements.
- Legitimate interests: responding to general enquiries, maintaining business communications, protecting our business and website, and handling potential disputes.
- Consent: where permission is required, such as using identifiable customer photographs for portfolio or marketing purposes.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before withdrawal.
05. How We Communicate and Store Information
We may communicate with customers through:
- Facebook Messenger
- Telephone calls and SMS
- Gmail
We use Google Drive through a personal Google account to store and organise photography-related files and customer photographs.
Photographs may be delivered through Google Drive sharing links or email attachments, depending on the agreed delivery method.
We use a WordPress website. Our website hosting is provided by a third-party hosting company.
Website Hosting:
- Our website, https://ideacavestudios.com, is hosted by Kandyan Host (Pvt) Ltd., a web hosting provider based in Sri Lanka.
- The hosting service uses a cPanel-managed environment to store and operate our website.
- Our hosting provider may process technical information, including server logs, IP addresses and other information necessary for website operation, maintenance and security.
We do not intentionally use Google Analytics, Meta Pixel or other analytics or advertising tracking tools on our website. Necessary technical data, such as server logs or essential website functions, may still be processed by the website or hosting provider.
06. Sharing Personal Data
We do not sell or rent customer personal data.
Personal data may be shared with service providers when necessary to operate our business, including:
- Google: for Gmail, Google Drive storage and file delivery.
- Website hosting provider: for website hosting, operation and security.
- Meta: where customers communicate with us through WhatsApp, Messenger or Instagram.
- Nord Axiz Group Oy: for bookkeeping and accounting services.
- Relevant authorities: where disclosure is required by Finnish law or another applicable legal obligation.
Service providers may process personal data on our behalf or in accordance with their own responsibilities and privacy terms. Their roles depend on the services they provide.
We only share information that is reasonably necessary for the relevant purpose.
07. International Data Transfers
Some of the service providers we use may process personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we will rely on an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards, where required.
Please refer to the privacy information of the relevant service providers for further details about their data processing and international transfers.
08. How Long We Keep Personal Data
We keep personal data only for as long as necessary for the purposes described in this policy or as required by law.
Our general retention approach is:
- Enquiries that do not result in a booking: kept only as long as reasonably necessary to respond and manage the enquiry.
- Customer booking and communication records: kept for as long as needed to provide the service and handle reasonable follow-up, complaints or potential disputes.
- Original and edited photographs: retained for an extended period to allow customers to request access or replacement copies where possible. We periodically review stored photographs and delete them when they are no longer reasonably necessary.
- Delivered photographs: customers are responsible for downloading and keeping their own copies. We do not guarantee permanent availability of delivery links or stored photographs.
- Invoices and accounting records: retained for the statutory periods required by Finnish accounting and tax legislation. These records may need to be kept even if a customer requests deletion.
- Consent records: retained for as long as necessary to demonstrate and manage the permission given.
Some accounting documents must be retained for statutory periods, so deletion requests cannot override legal retention obligations.
09. Photography and Portfolio Use
Customer photographs are collected and processed to provide the agreed photography service.
We do not automatically publish customer photographs on our website, social media accounts, advertisements or other promotional materials.
If we wish to use a photograph for portfolio or marketing purposes, we will request separate permission.
For photographs of children, permission must be obtained from an appropriate parent or legal guardian.
Refusing marketing permission does not affect your ability to book or receive photography services.
10. Data Security
We take reasonable steps to protect personal data against unauthorised access, loss, alteration or disclosure.
These steps include:
- Restricting access to customer files and photographs.
- Using account security measures, including two-step verification where available.
- Sharing Google Drive files only with intended recipients.
- Avoiding public access links where they are not necessary.
- Keeping business and customer information organised and limiting access to those who need it.
However, no online storage or communication method can be guaranteed to be completely secure.
11. Your Rights Under the GDPR
You may have the right to:
- Request access to your personal data.
- Request correction of inaccurate or incomplete information.
- Request deletion of your personal data where the legal conditions are met.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests.
- Request data portability where applicable.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with the relevant data protection supervisory authority.
Some rights are subject to legal exceptions. For example, we may need to retain accounting documents even if you request deletion.
To exercise your rights, contact us using the contact details in Section 1.
12. Complaints
If you believe your personal data has been processed unlawfully, please contact IdeaCave Studios first so we can review your concern.
You also have the right to lodge a complaint with the Finnish supervisory authority.
13. Third-Party Services
Our website and communication channels may link to or use third-party services, including Google, Meta platforms and our website hosting provider.
These services have their own privacy policies and terms. We encourage customers to review the relevant policies when using those services.
14. Changes to This Privacy Policy
We may update this Privacy Policy when our business practices, services, technology or legal requirements change.
The latest version will be published on our website with its updated date.