Privacy & confidentiality
Your privacy, our discipline.
Discretion is a professional standard at OLH Photographie, not a checkbox at the end of a contract. This policy explains, in plain language, what is collected through this site, why, where it goes, how long it stays, and the rights you have under Quebec's privacy law (commonly called Loi 25).
01Summary
Privacy at a glance
- No advertising · no behavioural profiling · no cross-site tracking
- Identifiable photos are treated as personal information
- Encryption in transit and at rest, MFA on every privileged surface
- Cookieless analytics, only two functional cookies, both local-only
- Access · rectify · delete · port your data, 30-day response window
02Version 3.1
What's new in this version
This page is rewritten when the site changes the way information is handled, never silently. Below are the most recent material updates.
- Version 3.1
Clarified how event-album publication is described, distinct from targeted or promotional use of your image. Event albums document the events OLH Photographie covers; identifiable attendees can naturally appear in them, and a respectful removal-request path is now stated explicitly. The "separate consent" language is reserved for main portfolio features, advertising, social media campaigns, contests, and similar promotional contexts, when that consent is required. This is a wording clarification, not a change in handling.
-
Full rewrite to a layered policy aligned with Loi 25, the Quebec Civil Code right to image, and the federal Copyright Act. Adds cross-border transfers, security, incident-handling, photography-specific section, and an explicit discretion-as-standard promise.
-
Contact-form autoresponder added. Visitor confirmation now describes the secure 60-day edit link, with a precise timing expectation and a soft fallback hint pointing to the spam folder.
-
Photo-purchase flow added (PayPal-hosted checkout). Order records retained six years per Canadian tax obligations, then deleted.
03Loi 25 · P-39.1 art. 8.1
Privacy Officer (RPRP under Quebec Loi 25)
Olivier La Haye
Owner of OLH Photographie, designated Privacy Officer ("responsable de la protection des renseignements personnels", RPRP) under Quebec Loi 25 (P-39.1, art. 8.1)
For any privacy question, complaint, access request, rectification, withdrawal of consent, deletion, or data portability request, the Privacy Officer is the same person who took your photographs. Use the contact page with the subject "Privacy request" and you'll get an acknowledgement within 30 days.
04Collection
Information collected
The site only collects what it needs to do the job you came for, book a session, deliver an album, answer a question, take a payment. Tap a section to see exactly what is collected, why, how long it is kept, and where it lives. All sections are closed by default; nothing is hidden.
Contact & conversations
Contact form + secure edit link Your name, email, inquiry type, message, and any optional details, sent to me by email and stored as a private conversation thread so I can reply.
Site preferences & engagement
Cookies + theme preference Two functional cookies, one for your album cover preference (30 days), one for your light/dark theme (one year). Neither is used for tracking or advertising.
Reactions and comments When you react to a photo or leave a message, the site stores a one-way hash of your IP for rate-limiting plus the optional name and message you provide.
Testimonials Clients can voluntarily submit a testimonial through a private page. Submitted information includes your name, optional title or role, optional organization, optional email, and the testimonial text.
Optional writing assistance On the testimonial and contact-form pages, you can optionally ask for spelling and grammar suggestions. Your text is sent to Google Gemini for that purpose.
Album release alerts and news If you ask to be alerted when an upcoming album goes live, we keep your email address only to write you once, when that specific album is released. Your request is tied to that one album: your email is never reused for a newsletter, a marketing list, or notifications about any other album. To be notified about another album, you submit a separate request.
Orders & analytics
Photo purchase orders When you place a photo purchase order, the site collects your name, email, and order details (selected photos, pricing).
Privacy-first analytics Cloudflare Web Analytics (cookieless) for page traffic and performance. A separate, private interaction log records lightweight events (button clicks, page visits) keyed to a one-way IP hash.
Album photo analytics, anonymous by default, opt-in for view time Album pages only, never the homepage, portfolio, contact, or any other surface. By default, an anonymous, daily-rotating IP hash counts which photos appear in your viewport. If you choose Accept on the inline album consent card, a random session identifier (stored only in this tab's memory) lets the photographer measure how long each photo holds your attention.
Infrastructure
Anti-spam verification Comment, testimonial, and contact-form submissions are protected by Cloudflare Turnstile, a privacy-preserving alternative to image CAPTCHAs.
Web fonts The site loads fonts from Google Fonts. When your browser fetches the font file, your IP is shared with Google.
Server security logs Standard Cloudflare edge logs (IP, user agent, request URL, response code, latency) are retained briefly for security and abuse-prevention purposes.
05Photography
Photographs and your privacy
A photograph that identifies a person is, under Quebec law, a personal information. So three different rules apply at the same time, and they don't mean the same thing, explained side by side just below.
Discretion as a professional standard
Photographs published in event albums document the events that OLH Photographie covers. That is the purpose of the album itself, and identifiable attendees can naturally appear in this context. If you appear in an event photo or in a public sports gallery photo and would prefer it not be displayed, you can write to me through the contact page using the subject "Privacy request" to ask for its removal; requests are handled respectfully and diligently. Any more targeted or promotional use of your image (main portfolio features, advertising, social media campaigns, contests, or similar promotional contexts) is done with a separate consent when one is required. Beyond event coverage, identifiable client photographs from portrait, corporate, and editorial sessions stay private by default and are not published without your written authorization. Confidentiality remains the standard, not an afterthought.
Personal information (Loi 25)
When a photo identifies you, it is a personal information. Collection, retention, security, and the right to access, rectify, delete, or port apply.
Act respecting the protection of personal information in the private sector. CQLR c. P-39.1 §§ 1, 4-5, 17, 23, 27, 32
Right to image (Civil Code)
Your image cannot be published or used commercially without your consent, even if I own the copyright in the photograph itself.
Civil Code of Québec arts. 3, 35, 36 + Charter of Human Rights and Freedoms art. 5; Aubry v. Éditions Vice-Versa, [1998] 1 SCR 591
Copyright (federal)
I am the author and first owner of the copyright in the photograph as a creative work. That ownership does not let me publish your image, that's the right-to-image rule above.
Copyright Act, R.S.C. 1985, c. C-42 §§ 13, 14.1
06Loi 25 · §17
Where your data is processed
OLH Photographie is based in Quebec, but several of the platforms used to run the site host data on servers located in the United States. Loi 25 §17 requires that this be assessed and disclosed. Below is the complete list of sub-processors used by this site.
Cloudflare (D1, Workers, Pages, Web Analytics, Turnstile)
Resend
PayPal
Google (Fonts CDN, Gemini API, Places API)
OpenFreeMap (venue map tiles)
YouTube (Google LLC), video embed
07Loi 25
Your rights, and how to use them
Under Quebec's Loi 25, you have four concrete rights over the personal information held about you. Each one is one email away. Requests are acknowledged within 30 calendar days.
Access
See exactly what personal information the site holds about you, including the source, the purpose, and the categories of recipients.
Email me via the contact page with the subject "Privacy request, access" and any detail that helps me find your record (e.g. the email you used).
Rectification
Correct any information that is inaccurate, incomplete, or no longer up to date.
Reply on the same conversation thread or use the contact page with the subject "Privacy request, rectification". Tell me what is wrong and what it should be.
Withdrawal · deletion
Withdraw a consent you previously gave, or ask for the deletion of any record that is no longer needed for the original purpose. Tax-record retention takes precedence where the law requires it.
Use the contact page with the subject "Privacy request, deletion". Tell me which record (a comment, a testimonial, a conversation thread).
Portability
Receive a structured, commonly-used technological export of the personal information you provided to the site, so you can take it to another service.
Use the contact page with the subject "Privacy request, portability". A JSON export is the default; a CSV is available on request.
08Security
Security and incident handling
Photographs and the conversations around them deserve the same care given to financial data. The site enforces a layered set of technical measures, all in production today.
- TLS 1.3 with HSTS preload on every domain, no plaintext fallback.
- Encryption at rest for every data store (Cloudflare D1, Resend mailbox, PayPal vault).
- Multi-factor authentication required on every privileged surface (admin tools, mail provider, hosting).
- Hardware-encrypted disks for any local copy of unreleased photographs.
- No biometric, facial-recognition, or AI-portrait-recognition pipelines run on this site or its backend.
09FAQ
Privacy questions, asked often
I attended a public event you photographed, am I in your dataset?
If a photo identifies you, yes, and you can ask me to remove it from any public surface (portfolio, Instagram, an album page). For purely private records the photo will remain in my archive only as part of the original delivery to the event organizer; ask the organizer for any further use of the image.
Will my photographs ever appear in a portfolio or on Instagram by default?
Event albums are the documentation of the events themselves, so identifiable attendees can naturally appear in them. That is what an event album is for. If you appear in an event photo and would prefer it not be displayed, you can write to me to request its removal and the request will be handled respectfully and diligently. For uses that go beyond event documentation (main portfolio features, paid advertising, social media campaigns, contests, or similar promotional contexts), a separate consent is requested when one is required. For portrait, corporate, and editorial sessions, identifiable client photographs stay private by default and do not appear in a portfolio, on Instagram, or in any promotion without your written authorization.
How does Loi 25 differ from the right to image?
Loi 25 governs how I handle your personal information as data, collection, security, retention, your access and portability rights. The right to image (Civil Code arts. 35-36 and Charter art. 5) governs the public use of your likeness, even when I own the copyright. The two regimes apply at the same time and protect different things.
Do you use cookies or tracking pixels?
Two functional cookies (album-cover preference and theme), no advertising cookies, no behavioural profiling, no cross-site tracking, no Facebook pixel, no Google Analytics, no remarketing. Page traffic is measured with cookieless Cloudflare Web Analytics.
Do you sell or share my data?
Never. The site does not sell, rent, license, lease, or share personal information for marketing purposes. The cross-border-transfers section above lists every sub-processor and the strict purpose for which it is used.
How long do you keep my contact-form messages?
Open inquiry threads are kept while the conversation is active. Closed threads are kept for 24 months, then deleted. The secure edit link in your confirmation email expires automatically after 60 days.
Can I get a copy of all my data?
Yes, that's the portability right under Loi 25 §27. Use the contact form with subject "Privacy request, portability" and you'll receive a JSON export (CSV available on request) within 30 days.
Where can I file a complaint if I am not satisfied?
You can file a complaint with the Commission d'accès à l'information du Québec at cai.gouv.qc.ca. If you live outside Quebec, your provincial or federal privacy regulator (the Office of the Privacy Commissioner of Canada under PIPEDA) may also be relevant.
Do you use AI on my photographs without telling me?
No facial-recognition, no AI-portrait-recognition, and no generative-AI training is run on your photographs. Some routine retouching tools embed AI-assisted features (denoise, upscaling); these run locally, on the photographer's workstation, and never send your image to a third-party service for training.
How do I withdraw a consent I gave earlier?
A consent you gave (for a public portfolio image, a testimonial, a comment) can always be withdrawn, tell me via the contact page with subject "Privacy request, withdrawal" and I'll act on it within 30 days. Withdrawal does not affect anything done lawfully before the withdrawal.
A privacy question?
Whether it's an access request, a withdrawal of consent, a clarification, or a complaint, one email is all it takes. Replies arrive within 30 calendar days, usually within 48 hours.
Within 30 calendar days · usually 48 hours