Privacy Policy
Effective Date: January 2023

NeverStill Studio is a photography business owned and operated by Boundless & Curious, LLC. Your privacy matters to us. This policy explains how we collect, use, and protect your personal information, including images and session-related data.

Information We Collect

When you book a session, purchase products, or communicate with us, we may collect:

  • Your name and contact details (email, phone number, mailing address)

  • Session details (type, location, preferences)

  • Images and media captured during your session

  • Payment and invoicing information

  • Voluntary feedback or testimonials

  • Communication history (emails, forms, messages)

We do not collect sensitive personal information unless voluntarily provided (e.g., accessibility notes or identity preferences).

Legal Basis for Processing

We process your personal information based on:

  • Contractual necessity (to provide photography services)

  • Legal obligations (recordkeeping and compliance)

  • Your consent (for marketing or image use, where applicable)

  • Our legitimate business interests (to improve services and operations)

How We Use Your Information

We use your information to:

  • Schedule, perform, and deliver photography services

  • Edit and provide access to photo galleries

  • Communicate with you about your session or purchases

  • Maintain legal and financial records

  • Improve and personalize our services

  • Share select images—with your explicit written consent—for portfolio or promotional purposes (see “Image Use and Consent”)

We will never sell or rent your personal information. That is a shitty thing to do.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal requirements. Session images and galleries will be retained per the terms of your client contract.

Storage and Security

Your data is stored securely using trusted third-party platforms including:

  • Adobe Products (e.g., Lightroom, Photoshop)

  • Google Workspace (file storage and communication)

  • SquareSpace (this website host)

Access is strictly limited to Boundless & Curious, LLC and subcontractors under binding confidentiality agreements. We implement industry-standard safeguards including SSL encryption, secure file storage, and regular data access audits.

If we transfer data outside your jurisdiction (including transfers from the EU/EEA to the US or Canada), we ensure an adequate level of protection in accordance with applicable laws, such as using standard contractual clauses under GDPR.

Image Use and Consent

You will always have the choice to opt in or out of image use for:

  • Our website or online portfolio

  • Social media or promotional materials

  • Print or educational projects

Your choice does not affect your session or access to your images (subject to timeframes outlined in your contract). You may change your image use consent at any time by contacting us in writing.

Third-Party Services

We use select third-party providers to help deliver services:

  • Pixieset or Lightroom (gallery delivery)

  • Adobe Lightroom and Photoshop (photo editing)

  • Google Workspace (file storage and email)

  • Stripe, Square, PayPal, and Venmo (payment processing)

These providers operate under their own privacy policies and comply with applicable data protection laws. We do not store your full payment details. For payment concerns, please contact the relevant provider directly.

Your Rights

You have the right to:

  • Request access to your personal data

  • Request correction of inaccurate information

  • Request deletion of your data (where legally permissible)

  • Withdraw consent for image use at any time

  • Object to or restrict certain types of data processing

  • Request transfer of your data (data portability under GDPR)

To exercise your rights or ask questions, contact us at info@boundlessandcurious.com.

If you are located in the European Economic Area (EEA) and believe your data rights have been violated, you may lodge a complaint with your local Data Protection Authority.

2. GDPR DATA PROCESSING ADDENDUM

GDPR Data Processing Addendum (DPA)

This Data Processing Addendum supplements the Agreement between Boundless & Curious, LLC (dba NeverStill Studio) (“Company”) and Client (“Client”) and reflects the parties’ agreement with regard to the processing of personal data under the EU General Data Protection Regulation (GDPR).

1. Definitions

"Personal Data," "Data Controller," "Data Processor," and "Processing" shall have the meanings given under GDPR.

2. Scope and Roles

Client is the Data Controller of Client Data. Company is the Data Processor. The Company will only process Personal Data to provide the services outlined in the Agreement.

3. Obligations of the Company

The Company shall:

  • Process Personal Data only on Client’s documented instructions

  • Implement appropriate technical and organizational measures to protect Personal Data

  • Ensure confidentiality by employees and subcontractors under confidentiality obligations

  • Assist Client in responding to requests from Data Subjects

  • Upon termination of services, delete or return all Personal Data to Client, unless legally required to retain it

4. Subprocessors

Company may engage trusted Subprocessors (e.g., Adobe, Google, Pixieset) provided they are bound by data protection terms no less protective than this DPA.

5. International Transfers

If Personal Data is transferred outside the EEA, Company will ensure adequate protection (e.g., Standard Contractual Clauses).

6. Liability

Each party’s liability under this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement.