Privacy Policy

This Privacy Policy is issued pursuant to the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), and the Do Not Call Register Act 2006 (Cth).
ABN: [71775076201] | Last reviewed: 1 April 2026 | Next scheduled review: 1 April 2027

1. Introduction & Scope

MM Photos (71775076201) ("MM Photos", "we", "us", "our") is a professional photography studio operating from 406/77 Dunning Avenue, Rosebery NSW 2018. This Privacy Policy governs the collection, use, disclosure, storage, and destruction of personal information by MM Photos in connection with its business operations.

This Privacy Policy applies to all individuals who interact with MM Photos, including but not limited to prospective clients, current clients, past clients, competition entrants, expo registrants, and website visitors.

MM Photos is bound by the Privacy Act 1988 (Cth) ("the Act") and the Australian Privacy Principles ("APPs") contained in Schedule 1 of the Act. MM Photos is also subject to the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) in respect of its electronic and telephone marketing communications. Nothing in this Privacy Policy is intended to limit the rights of individuals under applicable Australian privacy legislation.

This Privacy Policy should be read in conjunction with any collection notices provided to you at the point of collection of your personal information.

By providing your personal information to MM Photos, whether directly, through a third-party platform, or via a competition or expo registration, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein. Where your consent is required for a specific purpose, MM Photos will obtain that consent separately and explicitly.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

2.1 Personal information
Has the meaning given in section 6 of the Privacy Act 1988 (Cth), being information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true, and whether or not it is recorded in a material form.

2.2 Sensitive information
Has the meaning given in section 6 of the Act, and includes health information, information about an individual's racial or ethnic origin, and biometric information.

2.3 Health information
Information or an opinion about the health or disability of an individual, including information collected in connection with the provision of a health service.

2.4 Overseas recipient
A person or entity that is not in Australia and does not carry on business in Australia.

2.5 Third party
Any person or entity other than MM Photos and the individual to whom the personal information relates.

2.6 Commercial electronic message
Has the meaning given in the Spam Act 2003 (Cth), being an electronic message where one of the purposes of the message is to offer, advertise, or promote the supply of goods, services, or business or investment opportunities.

2.7 CRM
Customer relationship management system, being the GoHighLevel platform used by MM Photos for client data management and marketing automation.

3. Kinds of Personal Information Collected and Held

MM Photos collects and holds the following categories of personal information:

3.1 Identity and Contact Information
Full legal names, preferred names, residential and mailing addresses, telephone numbers (including mobile numbers), and email addresses. Where applicable, MM Photos also collects equivalent information about partners, spouses, co-parents, and other family members involved in a booking or session.

3.2 Booking, Session, and Service Delivery Information
Session dates and times, session type preferences, styling preferences, prop and theme selections, portrait information questionnaire responses, and any other information provided by the client to facilitate the planning and delivery of a photography session.

3.3 Health and Wellbeing Information
For newborn photography sessions, MM Photos collects health information relevant to the safe conduct of the session, including but not limited to the baby's feeding schedule, birth weight, gestational age, health conditions, medical considerations, and comfort requirements. This information constitutes sensitive information under the Act and is collected only with the express consent of the parent or legal guardian. It is used solely for the purpose of ensuring the health, safety, and comfort of the subject during the session and is not disclosed to any third party except as strictly necessary for service delivery.

3.4 Child and Dependent Information
Names, dates of birth, due dates, and developmental information relating to babies, children, and other dependents. This information is used for session planning, service personalisation, and milestone re-engagement communications.

3.5 Pet Information

Pet names, species, breed, age, temperament, and behavioural notes relevant to pet photography sessions.

3.6 Photographic and Visual Information
Professional photographic images of clients, their family members (including minors), and pets created during studio sessions. Photographic images of identifiable individuals constitute personal information under the Act and, where they reveal health or other sensitive attributes, may constitute sensitive information. Images of children are treated with the highest degree of care and are subject to the specific provisions in Section 10 of this Policy.

3.7 Financial and Transactional Information
Purchase amounts, product specifications, order records, and delivery addresses. MM Photos does not directly collect, store, or process credit card or banking details. All payment processing is handled by third-party payment processors subject to their own privacy policies and applicable financial regulations.

3.8 Competition and Marketing Registration Information
Information provided at the time of entering a competition or registering at an expo or event, including name, contact details, and any additional information collected at the point of registration, such as due dates or baby details.

3.9 Communications and Interaction Records
Records of communications between MM Photos and the individual, including phone call notes, email correspondence, SMS message records, and in-person consultation notes stored within MM Photos' CRM system.

3.10 Technical and Usage Information
Where you interact with MM Photos via our website (mmphotos.com.au), we may collect technical information including IP addresses, browser type, and pages visited, to the extent collected by our website platform provider, Wix. This information is collected and processed in accordance with the Wix Privacy Policy.

4. How Personal Information is Collected

MM Photos collects personal information by lawful and fair means only. We collect personal information in the following ways:

Directly from the individual, including when they register at an expo or event, enter a competition, contact MM Photos by telephone, email, or written correspondence, complete a form on the MM Photos website, make a booking over the telephone, attend a studio session, or participate in a viewing session.
Through Meta Lead Ads (Facebook and Instagram), where an individual submits their personal information via a lead generation form in connection with a competition or promotional offer. By submitting information through a Meta lead form, the individual acknowledges that their information will be transferred to MM Photos and used in accordance with this Privacy Policy.
Through the MM Photos website at mmphotos.com.au, via contact and enquiry forms operated through the Wix website platform.
Through GoHighLevel (GHL), the MM Photos customer relationship management and marketing automation platform, which may receive personal information from the above sources and consolidate it within a single client record.
Through third-party integration tools including n8n, Zapier, or equivalent automation platforms, which facilitate the transfer of personal information between MM Photos' digital systems.
During verbal consultations, including shoot preparation calls conducted prior to a session, during which personal information may be collected and recorded in the CRM system by a member of the MM Photos team.

MM Photos will, at or before the time of collection (or as soon as practicable thereafter), take reasonable steps to notify the individual of the matters set out in Australian Privacy Principle 5, including the purposes for collection and how the individual may access their information.

Where MM Photos collects personal information about an individual from a third party (for example, where partner or family member details are provided by another individual), MM Photos will take reasonable steps to ensure the individual whose information is being collected is made aware of this Policy.

5. Purposes for Collection, Use, and Disclosure

MM Photos collects, holds, uses, and discloses personal information only for the following primary purposes, and for secondary purposes that would be within the reasonable expectations of the individual:

Service delivery: planning, preparing for, and conducting photography sessions; delivering finished photographic products; managing the viewing session process; and fulfilling product orders in accordance with the client's purchase.
Booking and session administration: sending booking confirmations, session reminders, shoot preparation communications, run sheets, and post-session follow-up communications.
Order fulfilment: coordinating with third-party suppliers including BP Studio (print laboratory) and courier services for the production and delivery of purchased photographic products.
Competition and prize administration: contacting competition winners, managing session bookings arising from competitions, and administering the competition process in accordance with the applicable terms and conditions.
Direct marketing: sending commercial electronic messages and other marketing communications, including information about session opportunities, seasonal promotions, and milestone re-engagement offers, in accordance with the Spam Act 2003 (Cth) and subject to the individual's right to opt out under Section 11 of this Policy.
Service personalisation: using information about the individual's baby, children, or pets to personalise communications, anticipate session needs, and provide relevant milestone-based re-engagement at appropriate times.
Business operations and improvement: internal record-keeping, quality assurance, staff task management, and the improvement of MM Photos' services and processes.
Legal compliance: retaining records as required by applicable taxation, accounting, and other legislation, and responding to any legal obligation, court order, or regulatory requirement.

MM Photos will not use or disclose personal information for a purpose other than those listed above without the express consent of the individual, except where required or authorised by law.

6. Disclosure of Personal Information to Third Parties

MM Photos may disclose personal information to the following categories of third parties, strictly to the extent necessary for the purposes described in Section 5:

6.1 GoHighLevel Inc. (United States)
CRM and marketing automation platform provider. GoHighLevel processes personal information on behalf of MM Photos pursuant to its data processing terms.

6.2 Meta Platforms Inc. (United States)
In the context of competition administration and advertising operations conducted through Facebook and Instagram. Meta's collection and use of personal information is governed by the Meta Data Policy.

6.3 BP Studio
Print laboratory, to whom order specifications and relevant client details are provided for the purpose of producing purchased photographic products.

6.4 Pixieset
Online gallery delivery platform, through which clients access their photographic images following a session.

6.5 Dropbox Inc. (United States)
Internal file transfer platform used to transmit images between MM Photos and its retouching team.

6.6 MM Photos retouching team
Receive photographic images for the purpose of editing and retouching services. All retouching personnel are subject to confidentiality obligations.

6.7 Automation platforms
Including n8n and Zapier, which act as data processors facilitating the transfer of personal information between MM Photos' internal systems.

6.8 Courier and logistics providers
Receive delivery addresses for the fulfilment of product orders.

6.9 Legal and regulatory authorities
Where MM Photos is required or authorised by law to disclose personal information, including the Australian Taxation Office, law enforcement agencies, and courts.

MM Photos will not sell, rent, lease, or otherwise provide personal information to third parties for their own independent marketing, commercial, or other purposes.

7. Overseas Disclosure of Personal Information

MM Photos discloses personal information to overseas recipients in the course of its ordinary business operations, specifically to the following entities and jurisdictions:

GoHighLevel Inc. (United States): primary CRM and marketing automation platform. Personal information including names, contact details, booking information, and communication records is stored on GoHighLevel's servers located in the United States.
Dropbox Inc. (United States): used for internal file transfer of photographic images.
Meta Platforms Inc. (United States): relevant information is shared in connection with advertising and competition operations.

Pursuant to Australian Privacy Principle 8.1, before disclosing personal information to an overseas recipient, MM Photos takes reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information. MM Photos has reviewed the privacy and data security practices of its primary overseas service providers and is satisfied that these providers maintain data protection standards that are broadly consistent with the requirements of the APPs.

By providing your personal information to MM Photos, you acknowledge that it may be disclosed to overseas recipients as described in this Section, and you consent to such disclosure. You acknowledge that, to the extent an overseas recipient handles your personal information in a manner inconsistent with the APPs, MM Photos' accountability for that handling may be limited in circumstances where the overseas recipient is not bound by a law or binding scheme that provides comparable protections.

8. Storage and Security of Personal Information

MM Photos takes reasonable steps, consistent with Australian Privacy Principle 11, to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, and disclosure.

The security measures implemented by MM Photos include but are not limited to:

Access controls limiting access to personal information to authorised MM Photos personnel on a need-to-know basis.
Use of password-protected systems and platforms for the storage and management of client records.
Role-based access permissions within the GoHighLevel CRM system.
Secure file management practices for photographic images, including archiving to a secure internal server and time-limited access via Pixieset galleries.
Engagement of third-party service providers who maintain their own security and access control measures consistent with applicable law.

MM Photos acknowledges that no method of electronic storage or data transmission over the internet is entirely secure. While MM Photos takes all reasonable precautions, it cannot guarantee the absolute security of personal information.

In the event of a data breach that is likely to result in serious harm to any individual whose information is involved, MM Photos will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

9. Retention and Destruction of Personal Information

MM Photos retains personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

9.1 Client contact and booking records
Retained indefinitely for active and past clients for the purpose of ongoing service delivery, milestone re-engagement, and historical record-keeping, unless a deletion request is made and granted in accordance with Section 13.

9.2 Financial and transaction records
Retained for a minimum period of seven (7) years in accordance with the Income Tax Assessment Act 1997 (Cth) and related taxation legislation.

9.3 Unedited raw image files
Deleted within 29 days of the client's viewing session.

9.4 Edited and archived images
Retained on MM Photos' internal server indefinitely, subject to periodic review.

9.5 Pixieset image galleries

Deleted within 29 days of the viewing session for clients with total purchase value below $3,000. Retained for clients with total purchase value of $3,000 or above.

9.6 Dropbox retouching files
Deleted upon completion of the retouching process and confirmation of client approval.

9.7 Competition and enquiry records
Retained in the CRM system for the purpose of ongoing marketing communications, subject to the individual's right to opt out under Section 11.

When personal information is no longer required and no legal obligation to retain it exists, MM Photos will take reasonable steps to destroy or de-identify it in a secure manner consistent with Australian Privacy Principle 11.2.

10. Photographic Images and Images of Children

10.1 Use of Images
Photographic images created by MM Photos in the course of a studio session are produced solely for the purpose of delivering the services contracted by the client. MM Photos will not reproduce, publish, display, share, or otherwise use any client images for advertising, marketing, portfolio, social media, or any other commercial or promotional purpose without the prior express written consent of the client.

10.2 Consent to Use Images
Where MM Photos wishes to use client images for promotional purposes, a separate written consent will be sought from the client. Such consent is entirely voluntary and has no bearing on the services provided or the quality of those services. Consent may be withdrawn at any time by written notice to MM Photos, following which MM Photos will cease use of the relevant images in any new materials, subject to any pre-existing publications that cannot reasonably be retracted.

10.3 Images of Minors
MM Photos recognises the heightened privacy considerations applicable to images of children and other minors. MM Photos will not share, publish, display, or otherwise use any image depicting an individual under the age of 18 years without the prior express written consent of that individual's parent or legal guardian. This obligation applies regardless of whether the image depicts the minor alone or as part of a family or group photograph.

10.4 Image Retention
The retention and deletion of photographic images is governed by the periods set out in Section 9 of this Policy.

11. Direct Marketing and the Right to Opt Out

11.1 Consent and Basis for Marketing
MM Photos sends direct marketing communications, including commercial electronic messages by email and SMS, to individuals who have consented to receive such communications or in circumstances where MM Photos has a legitimate basis to do so under the Spam Act 2003 (Cth). In particular, individuals who enter a competition or register at an expo are deemed to have provided implied consent to receive marketing communications from MM Photos in connection with the prize or service for which they have registered.

11.2 Content of Marketing Communications
Marketing communications sent by MM Photos may include information about session bookings, seasonal promotions, milestone re-engagement opportunities, new products and services, and competition promotions.

11.3 Right to Opt Out
Every individual has the right to opt out of receiving direct marketing communications from MM Photos at any time and without charge. Opt-out requests may be made by:

Replying STOP to any SMS message received from MM Photos, which will result in the immediate removal of the individual's mobile number from all automated SMS sequences;
Clicking the unsubscribe link contained in any marketing email received from MM Photos; or
Contacting MM Photos directly at info@mmphotos.com.au or by telephone on 02 9386 4298 and requesting removal from marketing communications.

MM Photos will give effect to all opt-out requests as soon as practicable and in any event within five (5) business days of receipt.

11.4 Transactional Communications
Notwithstanding an opt-out from marketing communications, MM Photos reserves the right to send transactional communications to individuals where those communications relate to a confirmed booking, an active order, a legal obligation, or any matter directly necessary for the delivery of contracted services. Transactional communications are not subject to the right to opt out under this Section.

12. Access to Personal Information

Pursuant to Australian Privacy Principle 12, individuals have the right to request access to the personal information held about them by MM Photos.

Access requests must be submitted in writing to MM Photos using the contact details in Section 15. MM Photos will respond to all access requests within a reasonable timeframe, and in any event within 30 days of receipt.

MM Photos will provide access to personal information in the manner requested where it is reasonable and practicable to do so. MM Photos reserves the right to charge a reasonable fee to cover the cost of providing access where the request requires significant administrative resources. Any applicable fee will be communicated to the individual prior to processing the request.

MM Photos may decline to provide access to personal information in the following circumstances:

where providing access would pose a serious threat to the life, health, or safety of any individual or to public health or safety;
where providing access would have an unreasonable impact on the privacy of other individuals;
where the request is frivolous or vexatious;
where the information relates to existing or anticipated legal proceedings between MM Photos and the individual;
where providing access would prejudice enforcement-related activities conducted by or on behalf of a law enforcement body; or
where MM Photos is required or authorised by law to refuse access.

Where access is refused, MM Photos will provide written reasons for the refusal and advise the individual of any mechanisms available to seek a review of that decision.

13. Correction of Personal Information

Pursuant to Australian Privacy Principle 13, individuals have the right to request the correction of personal information held by MM Photos that is inaccurate, out of date, incomplete, irrelevant, or misleading.

Correction requests must be submitted in writing to MM Photos using the contact details in Section 15. MM Photos will take reasonable steps to correct personal information within 30 days of receiving a correction request, or advise the individual in writing if MM Photos is unable to make the requested correction.

Where MM Photos has previously disclosed the personal information to a third party and the information is subsequently corrected, MM Photos will take reasonable steps to notify the third party of the correction unless it is impracticable or unlawful to do so.

If MM Photos declines to correct personal information, the individual may request that MM Photos attach a statement to the relevant record noting that the individual considers the information to be inaccurate, out of date, incomplete, irrelevant, or misleading. MM Photos will comply with any such request.

14. Privacy Complaints

14.1 Internal Complaints Process
Any individual who believes that MM Photos has interfered with their privacy or breached the Australian Privacy Principles may lodge a complaint with MM Photos. Complaints must be submitted in writing to info@mmphotos.com.au or by post to MM Photos, 406/77 Dunning Avenue, Rosebery NSW 2018.

MM Photos will acknowledge receipt of all written complaints within five (5) business days and will investigate and respond to complaints within 30 days of receipt. Where a complaint cannot be resolved within 30 days, MM Photos will notify the complainant of the reason for the delay and provide an estimated timeframe for resolution.

14.2 External Complaints Process
If a complainant is not satisfied with MM Photos' response to a privacy complaint, or if MM Photos fails to respond within the timeframe specified above, the complainant may refer the matter to the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

The OAIC has the power to investigate complaints and, where appropriate, make determinations and recommendations under the Privacy Act 1988 (Cth).

15. Contact Details

All enquiries, access requests, correction requests, opt-out requests, and complaints relating to this Privacy Policy or MM Photos' handling of personal information should be directed to:

Privacy Officer
MM Photos
406/77 Dunning Avenue, Rosebery NSW 2018
Email: info@mmphotos.com.au
Phone: 02 9386 4298
Website: mmphotos.com.au

16. Amendments to This Privacy Policy

MM Photos reserves the right to amend this Privacy Policy at any time. Any amendments will be effective from the date on which the revised policy is published on the MM Photos website at mmphotos.com.au. The version number and date of last review at the top of this document will be updated to reflect any material amendments.

Where amendments are material, MM Photos will take reasonable steps to notify affected individuals. Continued engagement with MM Photos' services following the publication of an amended Privacy Policy constitutes acceptance of the amended terms to the extent permitted by law.

17. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Commonwealth of Australia and the State of New South Wales. Any disputes arising in connection with this Privacy Policy shall be subject to the non-exclusive jurisdiction of the courts of New South Wales.