Privacy Policy

01Overview — Who We Are

Topaz Studio Inc., operating in Ontario, Canada under the business name Topaz Art Academy (the "Academy," "we," "us," or "our"), is the organization responsible for the personal information described in this policy. We run art classes and portfolio programs for young people and operate the website on which this policy is posted (the "Website"). We serve students and families in Ontario, Canada.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) — and, where applicable, provincial laws such as Quebec's Law 25 — we must (a) identify the purposes for which we collect personal information before or at the time of collection, (b) obtain your knowledge and consent, (c) use and disclose it only for those purposes, (d) keep it secure and only as long as needed, and (e) make it available to you on request. This policy is how we do all of that. We also apply Canada's anti-spam law (CASL) to any message we send — in practice, that means service messages only (see Section 3).

If you are in another country, the same commitments apply; where local law grants you stronger rights, we follow the stricter standard.

02What We Collect

We collect only what we need to book you in, run your classes, and stay in touch. Concretely:

• Booking form. Student's full name; email address; phone number; age or date of birth; the program or class of interest; and a brief note about goals or level (if you choose to give one).
• Parent / guardian information (for students under 18). Your name, relationship to the student, email, and phone. For their child's classes, we ask for the guardian's phone number as the emergency contact, and — where you choose to share it — the student's school or other contact preferences.
• Payment records (for paid enrollment only). Payment is made directly by you — in cash at the studio, or by Interac e-Transfer through your own bank. We do not collect or store card or banking credentials; we keep a record of the amount, date, and method of each payment, so we can issue receipts and refunds. The free trial requires no payment.
• Correspondence. The content of emails, messages, or calls you send us, including anything about scheduling, refunds, or your student's progress.
• Usage & technical information. When you visit the Website, standard technical data may be recorded: browser and device type, operating system, the pages you visit, referring page, and timestamps. Where a Meta advertising pixel is active on a page you visit, Meta may also record that visit — see Section 6. While you move through the booking flow, your answers are kept in your own browser's session storage; they are sent to our scheduling tool when you confirm a booking, and nothing else leaves the browser.
• Voluntary content. Work, photos, or messages you choose to share with us, for example for a portfolio review or a showcase. We only use what you choose to send us.

03Why We Collect It (Purposes)

PIPEDA requires us to tell you, before or at the time of collection, what we will use the information for. We use it to:

• Process and confirm bookings. Reserve your place in a class, send confirmations, and manage waitlists.
• Deliver the classes. Run the programs, track attendance, and manage roster changes.
• Communicate about your enrollment. Send reminders, schedule changes, cancellation notices, and other service messages directly related to a class you booked or asked about.
• Handle payments and refunds. Process fees, issue receipts, and issue refunds under our Refund Policy.
• Support and safety. Respond to your questions; in an emergency at the studio, contact the parent/guardian (or the student, if 18+) and, where necessary, share relevant information with emergency services.
• Marketing — not currently sent. We do not send marketing emails and we do not have a newsletter. If we ever start sending them, we will ask for your express, separate opt-in first (a clear, ticked "yes" — not silence), and every message will carry a working unsubscribe. See Section 9.
• Improvement & compliance. Aggregate, anonymized statistics about how the Website and programs are used; and comply with legal, accounting, and tax obligations (which is also why we keep certain records — see Section 7).

We use personal information for one of these stated purposes, not for others, unless we explain and obtain your consent for a new purpose (or the law requires it).

04Consent — Including for Minors

• For adults (18+). Submitting the booking or contact form is how you give consent for the purposes listed in Section 3. It is a single, clear step, and the form tells you what will happen to your information and links you to this policy.
• For students under 18. Consent is given by the parent or legal guardian. By submitting the form on a minor's behalf, the guardian confirms they are authorized to consent, and consents to the collection, use, and disclosure described here on the student's behalf.
• For students under 13. Following the Privacy Commissioner of Canada's guidance, we do not rely on a child under 13 giving their own consent. The parent or guardian is the consenting party for all of the child's information, and the child is notified in age-appropriate language where they are involved in the process.
• Marketing is separate. Marketing consent is a distinct, opt-in choice. Service messages (confirmations, reminders) do not require a marketing opt-in, and choosing not to receive marketing never affects your booking.
• Withdrawing consent. You may withdraw consent at any time (except where the law requires us to keep processing). Withdrawal does not affect the lawful processing that already happened. See Section 9.

05How & With Whom We Share

We disclose personal information only to the recipients needed to serve the purposes in Section 3, each of whom is contractually bound to protect it and use it only for the stated purpose:

• Our scheduling tool — Calendly. Booking details you submit (name, email, phone, class, time) are sent to Calendly to run the booking flow, confirmations, and reminders. Calendly acts as a processor on our behalf and does not sell or repurpose your information. Calendly's own privacy notice is at calendly.com/privacy. Please note Calendly may process and store some of this information in the United States — see Section 11.
• Your bank (for Interac e-Transfer payments). When you pay by Interac e-Transfer, the transfer happens between you and your bank; we are the recipient (topazartacademy@gmail.com) and we never see or store your banking credentials. Cash payments at the studio are not shared with anyone.
• Email delivery. Booking confirmations, reminders, and service updates are sent by our scheduling service, Calendly, on our behalf. We do not use a third-party email marketing platform, and we do not sell or rent your email address.
• Our advertising platform — Meta (Facebook / Instagram). Where our Meta advertising pixel is active on a page you visit, Meta may set advertising cookies and use the visit to measure ad performance and — where you have allowed it — power remarketing (a "custom audience"). We send only hashed contact information, and we tell Meta not to use it for anything else. Advertising cookies are set only after you have accepted them in our cookie consent notice — see Section 6. You can opt out of this matching by choosing "Essential only" in the consent notice, or by contacting us.
• Parent/guardian ↔ student. We share a student's attendance and progress information with their parent or guardian, and vice versa, in connection with the classes.
• Others. We may disclose information where required by law (a court order, a government request, or an investigation), or to protect the safety of students or others. We do not sell personal information to anyone.

06Cookies, Pixels & Analytics

The Website may use cookies and similar technologies in three categories:

• Essential. Strictly necessary for the Website and the booking flow to work (for example, keeping a session alive). We do not ask consent for these.
• Analytics. Privacy-conscious, aggregate statistics (for example, a no-personal-data analytics tool) that tell us which pages are useful. These do not identify you personally.
• Advertising / retargeting. A tag from our advertising platform (Meta) that may recognize returning visitors and measure ad performance, and — where you have opted in — power remarketing. Advertising cookies are set only after you have accepted them via our consent notice. You can also disable them in your browser settings or through your preferences on the relevant platform.

We do not knowingly collect advertising data from children, and we do not build advertising audiences from children's activity. The pixel cannot verify a visitor's age, so we ask parents to be aware that a child's visit may be recorded; if you believe we or Meta hold a child's advertising data, contact us and we will delete it and instruct Meta to do the same.

Nothing about the booking flow depends on advertising or non-essential cookies: the free-trial booking works fully with the minimum set.

07Retention

PIPEDA requires us to keep personal information only as long as needed for the purposes for which it was collected (or as required by law). Our default schedule:

After retention ends, we delete or anonymize the information, unless law requires us to keep a record (for example, financial records).

08Security

We protect personal information with safeguards appropriate to how sensitive it is:

• the Website and our booking tools use HTTPS encryption in transit;
• access to student and parent information is restricted to the small team that needs it, with role-based permissions;
• we do not accept card payments — cash or Interac e-Transfer — so no card or banking credentials are ever collected or stored;
• we maintain procedures for safe handling, disposal, and incident response, and we review our safeguards regularly.

No method of transmission or storage is 100% secure. If we ever discover a breach that could reasonably be expected to result in significant harm to a person, we will notify the affected individuals and the Privacy Commissioner of Canada as required by law, and tell affected parents and students promptly in plain language. Please keep an eye on the contact details you give us, and tell us if yours change.

09Your Rights & Ours

Under PIPEDA and applicable provincial law, you (or, for a minor, their parent or guardian) may:

• Access. Ask whether we hold your information and obtain a copy of it. We respond to genuine access requests within a reasonable time (and no later than 30 days, unless an exception applies), free of charge in most cases.
• Correct. Ask us to amend information that is inaccurate or incomplete. We update it and correct any records of the third parties we have shared it with, where practical.
• Withdraw consent. Pull back consent for future collection, use, or disclosure (this does not undo what has already lawfully happened, and does not stop us from providing a service you have paid for).
• Request deletion. Ask us to delete your information. We will, subject to the retention obligations and legal holds in Section 7, and we will let you know what we could and could not delete and why.
• Stop any marketing. We do not currently send marketing emails. If we ever do: every marketing email carries a working unsubscribe link, and you may also email us. We honour a stop request within 10 business days (CASL) and keep you on our do-not-contact list afterward. Stopping marketing never affects your enrollment or your service messages.
• Ask how. Ask us to explain, in plain language, how your information is collected, used, or shared.

To exercise any of these, email topazartacademy@gmail.com (for a minor's information, a parent or guardian may act directly). We verify that a request is genuinely yours (or from an authorized guardian) before acting, and we do not charge for standard requests.

10Particular Protections for Youth

Because many of our students are young, we treat their information as sensitive and apply extra care:

• Parent/guardian consent is the rule for under-18s, and the only consent for under-13s (per the Privacy Commissioner of Canada, individuals under 13 cannot give meaningful consent; Quebec's Law 25 sets the same line at under 14).
• No advertising cookies for young visitors. We do not set advertising or tracking cookies for visitors who appear to be under 13 or 16, and we do not build advertising audiences from their activity — see Section 6.
• No condition-of-service photo consent. We never require a parent or student to consent to photography as a condition of enrolling in a class (the Privacy Commissioner found this inappropriate in 2025). Photography is always an optional, separate, revocable choice — see Section 8 of our Terms.
• Plain language. Explanations aimed at students are written for a young reader, not a lawyer.
• Safe by default. The most protective reasonable settings are the default; anything less protective is an opt-in.

11International Transfers

Some of the tools we rely on are based in the United States. Most notably, our scheduling service, Calendly, may transfer, process, and store booking information (name, email, phone, class, time) on its systems located in the U.S. Calendly is a U.S. participant in the Data Privacy Framework, and its privacy notice (which you can read at calendly.com/privacy) describes the protections that apply.

By submitting the booking form you consent to that transfer, and we remain responsible for your information under PIPEDA — we contractually require our service providers to protect it with safeguards comparable to Canadian law. We are not, ourselves, based outside Canada, and we keep the master record of your booking on our systems in Canada.

12Changes, Contact & Complaints

We may update this policy as our services, tools, or the law change. Where a change is material, we will tell you by email (to the address on file) or by a prominent notice on the Website, at least 30 days before it takes effect, and we will date each version of the policy above.

Contact us. For any privacy question, request, or complaint — the privacy officer is Vahid Bahmani:

• Email: topazartacademy@gmail.com (Attn: Vahid Bahmani, Privacy Officer)
• Phone: (647) 877-9757 — Monday–Friday: 10 a.m.–9 p.m.; Saturday–Sunday: 10 a.m.–5 p.m. (Toronto time).
• Mail: Topaz Studio Inc. (dba Topaz Art Academy), Attn: Privacy, 500 Alden Rd, Markham, ON L3R 5H5

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca), or — if you are in Quebec — the Commission d'accès à l'information du Québec. We will cooperate with any investigation and respond to the Commissioner's inquiries.

Related documents: Terms & Conditions · Refund Policy · Accessibility Statement