Privacy policy
Personal Data Act (523/1999) Sections 10 and 24 | Date of preparation 14.01.2026
1. Controller
Sapfograf Oy / Sonjasphoto | Business ID: 3104338-8 | Hämeenkatu 28 F, 20700 Turku | Phone: +358 451477474
2. Contact person
Sonja Siikanen | sonja(at)sapfograf.com | +358 451477474
3. Name of the register
Sonjasphoto customer register and website
4. Purpose of processing personal data
Personal data is processed for the purposes listed below based on consent:
– to manage the relationship related to customer service and other relevant connections
– to produce, order and invoice the photography services and products ordered by the customer
– to market the photo services, participate in photo competitions or exhibitions if the customer has given their consent (applies to photographs).
5. Personal data stored in the register
The customer register contains the following information
Contact information:
– name
– email
– telephone number
– address, if the customer has ordered photo products or other products to be mailed, or the information has been disclosed for another reason
Customer information
– information about purchased products/services
– wishes given by the customer and additional information about the photo session and matters related to the photo session, e.g. wedding day, party location, wedding day schedule, child's birthday, child's age, etc.
– Photographs produced according to the service ordered by the customer, e.g. wedding photography, family photography or boudoir photography
– In addition to the above, the website www.sonjasphoto.com uses the Google Analytics service, from which the controller can see cookie information when using the website (which browser the customer uses, how many seconds/page they spend time on or what search terms they used to find the website). However, the controller does not collect or analyze IP addresses or information from which the website user could be identified in any way.
6. Regular data sources
This is a privately maintained data source. Personal data about the customer is always collected only from the customer theirselves, either by email, verbally, by telephone or via the contact form on the www.sonjasphoto.com website in order to enable the provision of services. The customer agrees that when ordering a photography service through Sapfograf Oy and its subsidiary Sonjasphoto, the controller has the right to take and process photographs taken of the customer in order to provide the appropriate service.
7. Regular disclosure of data
The controller Sapfograf Oy treats the customer's data confidentially and does not disclose it to external parties for purposes other than accounting. However, the customer accepts that in connection with the ordering and delivery of the photo services or photo products ordered by the customer, the data controller has the right to use third-party services, in which photos taken of the customer are uploaded, for example, to an electronic, password-protected photo gallery, from which the customer can select their favorite photos from proofs and download them electronically for themselves. Photos are also handed over to third parties for processing in cases where the customer wants to order physical photo products, such as photo books or prints. In this case, the customer's photos can be processed by an external party from which the data controller orders their photo products. In such a case, an appropriate level of data protection is ensured by complying with applicable data protection legislation in the EU, outside of it and in each relevant country. In addition, the photographer has the right, with the customer's consent, to use photos taken of the customer for marketing the photography services, for participation in exhibitions or photo competitions.
8. Duration of processing
Personal data is generally processed for as long as the customer is in business. However, personal data may be stored for longer periods for accounting purposes required by law or if the customer does not specifically request that their data be deleted and the customer relationship be “forgotten”. However, the photographer may also store the customer’s images after the customer relationship has ended, if desired, under the photography agreement approved by the customer and the Copyright Act.
9. Register protection
Sapfograf Oy is the controller of the collected personal data. The electronically processed data contained in the register are protected by firewalls, passwords and generally accepted technical means in the information security industry. Manually maintained materials are stored behind locked doors.
The data contained in the register can only be accessed by employees of the controller and companies acting on its behalf and to the extent necessary for the provision of services.
10. Rights of the data subject
A registered customer has the right to check their data stored in Sapfograf Oy's customer register. If the register contains incorrect data, the customer has the right to request correction of their data. The customer also has the right to request deletion of the data if the data processing is not necessary. We will process the deletion request, after which we will either delete the information or provide a justified reason why the information cannot be deleted.
It should be noted that the controller may have a statutory or other right not to delete the requested information. The controller is obliged to store accounting material for the period specified in the Accounting Act (Chapter 2, Section 10) (10 years). Therefore, accounting material cannot be deleted before the deadline has expired. The customer has the right at any time to demand the removal of their own images from the company's website and social media.
The controller Sapfograf Oy will provide the customer, upon written request, with information about the personal data that Sapfograf Oy has stored about the customer. The customer must be prepared to identify themselves appropriately in connection with the request. Requests for review, correction and deletion must be made in writing to sonja@sapfograf.com.