Data Privacy Impact Assessment (DPIA) ConvoPhoto
- Project / Solution Description
ConvoPhoto is a Canada-based event photography service and application that captures photographs
at events, provides secure online galleries for viewing, and enables individuals to purchase
photographic products. The solution operates exclusively within Canada and does not integrate with
institutional academic systems. - Purpose of Processing
Personal information is processed solely to capture and deliver event photography, provide controlled
access to private photo galleries, process photo orders and fulfillment, and communicate with
individuals regarding orders or support inquiries. - Categories of Personal Data
Photographic images of individuals, names, email addresses, and order-related metadata. No
academic records, government identifiers, health information, biometric identifiers, or financial account
numbers are processed. - Data Subjects
Event participants, individuals accessing private galleries, and customers purchasing photographic
products. - Data Flow Overview
Images are captured, securely stored, made available through controlled access galleries, and retained
only as long as necessary. No institutional datasets are combined with personal data. - Geographic Scope and Transfers
All data collection, processing, and storage occurs in Canada. No international data transfers occur. - Lawful Basis and Compliance
Processing is based on consent and legitimate business purposes in accordance with Canadian
privacy legislation. - Privacy Risks Identified
Risks include unauthorized access, over-retention of data, accidental disclosure through third parties,
and incident response failures. - Risk Mitigation Measures
Mitigations include access controls, data minimization, limited retention, contractual third-party
obligations, and documented incident response procedures. - Residual Risk Assessment
After mitigation, residual privacy risk is assessed as low. - Stakeholder Impact
No automated decision-making or significant effects on individuals are present. - DPIA Outcome and Approval
Privacy risks are acceptable and appropriately managed for the scope of the service. - Review and Maintenance
This DPIA will be reviewed and updated if material changes occur. - Contact
ConvoPhoto Privacy Contact Email: support@convophoto.ca