Last updated: September 29, 2026.
For team requests, we record the selected coverage type (day or full season). The forms also let you optionally indicate a monochrome or cinematic post-processing preference. These choices help us understand and prepare the request; they do not guarantee a specific treatment and may be discussed before the assignment.
Operator: Jonathan Toh. Address: 8125 Notre-Dame Street East, Apt. 16, Montréal, Québec H1L 3L1, Canada. Privacy lead: Jonathan Toh, reachable at [email protected].
When you submit a booking request, we collect your first name, last name, email address, request type, match date, time and venue. For a player request, we also collect position and number. An optional field lets you add up to 2,000 characters of other useful information; avoid entering sensitive information that is not necessary. When a collection is priced, the amount, payment status and, if an invoice summary is sent, its reference and date are associated with the booking. We also retain replies sent from the dashboard and, when a private collection is delivered, the technical information needed for secure access. The site currently does not request a phone number.
Each booking form offers an optional, unchecked consent to publish the photo collection in the public portfolio. Declining does not affect the request. Photos in a private collection remain private unless consent has been given and the administrator explicitly chooses to copy the files to the public media library and publish the collection. The private source files remain outside the public web root and are not moved or altered by this action. To withdraw consent or request removal of a publication, contact [email protected].
This information is used only to receive, assess, manage and answer your booking request, and to protect the form from abusive submissions. If the GDPR applies to your situation, the legal basis may include steps taken at your request before entering a contract and, as appropriate, the legitimate interest in securing the form. The operator must confirm this assessment.
Requests are stored in WordPress on the site’s hosting. Transactional notification and reply emails are sent through Brevo. The site is delivered and has audience metrics at the Cloudflare proxy level. The site currently loads fonts from Google Fonts; that request may transmit technical data such as an IP address to Google. These providers may process the information necessary for their services. Processing locations, subprocessors, agreements and transfer mechanisms must be confirmed in their contractual documents and account settings.
An unverified request is deleted automatically after 24 hours. Verified booking requests are retained for 6 months from receipt. A daily task then anonymizes personal information and reply history; it keeps only a non-identifying administrative record. This period must be reviewed if a legal, contractual or invoicing obligation requires different retention.
Public pages currently set no non-essential cookies. After a booking request, a strictly necessary, secure and HTTP-only cookie lasting no more than 24 hours lets the submitter enter their verification code and correct their email address. Access to a private collection also uses a necessary, secure and HTTP-only cookie so the access token is not exposed in a web address or logs; it stops working when the link is revoked. Cloudflare produces audience metrics at the proxy level; no Cloudflare JavaScript beacon or Cloudflare cookie was observed during public tests. WordPress may use necessary cookies during an administrative login. Any non-essential technology added later will be assessed before it is loaded.
The server keeps technical logs, including for security and diagnostics; observed Nginx retention is 14 days. A value derived from the IP address is temporarily retained to limit repeated submissions. We use administrative access controls, form validation, nonces and transport encryption where available. As of September 26, 2026, no Proxmox backup is configured: server data is not replicated to a known off-site backup and is accessible only from the operator’s local infrastructure. The absence of backups reduces data copies, but increases the risk of loss in the event of an incident. The separate processing performed by Brevo, Cloudflare and Google Fonts is described elsewhere in this policy.
You may request access to, correction of or deletion of your information where permitted. Depending on applicable law, you may also have rights to withdraw consent, object, restrict processing or receive portability. Write to [email protected]. We may request reasonable identity verification. For a complaint, contact Jonathan Toh first; depending on your situation, you may also contact the relevant authority, including Québec’s Commission d’accès à l’information or an EEA data protection authority.
Emails generated by a booking request, a reply or delivery of a private collection are transactional and serve the relevant request. The email address provided in the booking is used for confirmation and, when the photos are ready, for delivery. These emails are not a marketing subscription. Any future promotional communication must be separate, meet applicable consent requirements, identify the sender and include an unsubscribe mechanism where required.
We will update this policy when our practices, providers or obligations change. The last updated date will appear at the top of this page.