A friend of mine opened an account with an online company that sells picture prints. Without her knowing, just after signing in, somehow (she did not understand how; probably through the Apple application Photos), the company came into possession of the photos she had on her computer.
When she realized they were in possession of her photos, she sent an email asking for the account to be closed and her personal data (photos included) to be deleted from their system. It follows a pretty long list of confusing emails at the end of which they agreed to close the account. They did not confirm they would delete the pictures though.
Two months later, she received a promotion email that included her pictures! She sent another email asking to stop promotional emails and also asking to delete the pictures. They answered they can't delete the pictures themselves, but they can reopen the account so that she can delete her pictures herself. She accepted it to reopen the account (which was probably an unfortunate move). Turns out, deleting pictures can only be done one at a time and there are thousands of pictures, which is more than inconvenient! That's at this moment that my friend told me the story.
No payment and no banking information has ever been given to this company. Note also, if it matters, that my friend lives in Canada.
I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures. Am I right?
Can you please advise us on an appropriate answer to hopefully convince the company to respect those rights?