Privacy & POPIA Policy

1. Introduction

Event Photography SA takes your privacy seriously. This policy explains how we collect, use, store and protect personal information under South Africa's Protection of Personal Information Act, 4 of 2013 (“POPIA”). It applies to everyone who books through eventphotographysa.co.za, everyone photographed at an event we cover, and everyone who applies to join our photographer panel.

If you have any questions, contact our Information Officer directly using the details above.

2. What personal information we collect

From clients (people who book us):

• Full name, company name, VAT number
• Email address, phone number, WhatsApp number
• Billing and physical address
• Event date, venue, guest count, brief
• Payment information (processed by our payment provider; we never store card numbers)

From event attendees (people we photograph):

• Photographic and video images captured at your event
• In some cases, name badges, job titles or affiliation visible in frame

From photographers who apply to our panel:

• Full name, ID number (for B-BBEE verification only), contact details
• Portfolio URL, years of experience, gear list
• Bank details for freelance payment (post-selection only)

3. Why we collect it (lawful bases under POPIA Section 11)

We only process personal information where we have a lawful basis:

• Consent — for external-facing publication (marketing, website, social media)
• Contractual necessity — to deliver the photography service you booked
• Legitimate interests — for internal client galleries, archival records and standard business operations
• Legal obligation — for tax, invoicing and B-BBEE compliance records

You can withdraw consent at any time by emailing [email protected]. We will remove identifiable images from our marketing channels within 7 working days of a written request.

4. Event photography — how consent works on the day

At every event we photograph, we require our client (the event host) to display visible photographic signage at all entrances. This signage informs attendees that photography is taking place and offers a straightforward opt-out mechanism — typically a red lanyard or similar identifier collected at reception.

Our photographers are briefed before every event that individuals wearing the opt-out identifier are not to appear in the final gallery. Wide crowd shots are captured and edited to avoid identifiable close-ups of opted-out individuals.

Photographs of children (persons under 18) will not be captured or published without prior written consent from a parent or legal guardian, in line with POPIA's special provisions for the personal information of children.

5. Where your information is stored

• Client galleries are hosted on POPIA-aligned South African servers
• Financial records are stored in encrypted cloud accounting on SA-hosted infrastructure
• Portfolio and marketing use images are stored on SA-based servers unless explicit written consent has been granted for cross-border transfer under POPIA Section 72
• Backup archives are encrypted and stored offline for a maximum of 5 years unless the client requests a shorter retention period

6. Who we share your information with

We do not sell your personal information. We share it only with:

• Our contracted photographers, editors and delivery platform providers, all bound by written data-processing agreements
• Our accountants and tax authorities where legally required
• Law enforcement authorities where compelled by a valid court order

We never transfer personal information across South African borders without either your explicit consent or an equivalent-protection assessment under POPIA Section 72.

7. How long we keep it

• Client contact and billing records: 5 years after last invoice (SARS requirement)
• Event galleries: 12 months, then archived or deleted per client instruction
• Marketing-consented portfolio images: until consent is withdrawn in writing
• Panel applicant data: 12 months from application, then deleted

8. Your rights under POPIA

You have the right to:

• Access — request a copy of the personal information we hold about you
• Correct — ask us to update or correct inaccurate information
• Delete — request removal of your personal information (subject to legal retention requirements)
• Object — object to further processing of your personal information
• Withdraw consent — for any processing based on consent
• Complain — lodge a complaint with the Information Regulator

To exercise any of these rights, email [email protected]. We will respond within 21 working days as required by POPIA regulations.

9. How to complain

If you believe we have not handled your personal information correctly, contact our Information Officer first — we resolve most concerns within 7 working days. If you are not satisfied with our response, you may complain directly to the Information Regulator of South Africa:

10. Cookies and website tracking

Our website uses essential cookies for functionality and analytics cookies (Google Analytics 4 with IP anonymisation enabled). You can decline non-essential cookies on your first visit via our cookie banner. Declining does not affect your ability to book.

11. Security measures

We maintain the following technical and organisational safeguards:

• SSL/HTTPS encryption on all website traffic
• Encrypted cloud storage for all client galleries
• Two-factor authentication on all administrative accounts
• Written data-processing agreements with every subcontracted photographer or editor
• Annual internal POPIA compliance review

12. Changes to this policy

We may update this policy from time to time to reflect changes in law or our practices. The “Last updated” date at the top of this policy will always show the current version. Substantial changes will be communicated to active clients by email.