Last Updated: November 5, 2025
Introduction
Welcome to Exquisite Photography ("we," "our," or "us"). We are a South African-based photography business committed to protecting your privacy and ensuring the security of your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or engage with us for photography sessions.
By using our website or services, you agree to the collection and use of information in accordance with this policy and POPIA. If you do not agree with our policies and practices, please do not use our services.
Information We Collect
Personal Information
We may collect the following types of personal information:
- Contact Information: Name, email address, phone number, physical address
- Account Information: Username, password, and account preferences
- Payment Information: Banking details, card information (processed securely through PCI-DSS compliant payment processors)
- Identification: ID number (when required for invoicing and tax compliance)
- Booking Information: Session dates, locations, preferences, and special requests
- School Information: School names, grade levels, learner information for school photography services
- Communication Data: Messages, emails, and other communications with us
Photographic Content
- Photographs and videos taken during photography sessions
- Images uploaded by you for printing or editing services
- Metadata associated with images (date, location, camera settings)
Technical Information
- IP address, browser type, and device information
- Website usage data, pages visited, and time spent on pages
- Cookies and similar tracking technologies (see our Cookie Policy below)
- Referring website addresses and online identifiers
How We Use Your Information
We use the collected information for the following purposes:
Service Delivery
- To provide and manage photography services and sessions
- To process orders for prints, digital downloads, and other products
- To schedule and confirm appointments
- To deliver purchased products and services
Communication
- To respond to your inquiries and provide customer support
- To send booking confirmations, reminders, and updates
- To notify you about your account, orders, or service changes
- To send marketing communications (with your consent)
Business Operations
- To process payments and prevent fraudulent transactions
- To improve our website, services, and customer experience
- To analyze usage patterns and conduct market research
- To comply with legal obligations and enforce our terms
Marketing and Portfolio
- To showcase our work in portfolios, galleries, and marketing materials (with explicit consent)
- To share on social media and promotional channels (with permission)
- To send newsletters and special offers (with opt-in consent)
Image Rights and Usage
Your Images
We retain copyright to all photographs we create, but you have purchased certain usage rights as specified in your service agreement. We will:
- Never sell your images to third parties without your explicit consent
- Only use your images for portfolio or marketing purposes with your written permission
- Always obtain a separate model release for any commercial use of images featuring identifiable people
- Respect your requests to not have images shared publicly
Children's Images
For school photography and sessions involving minors (persons under 18 years of age):
- We require parental or guardian consent before photographing children
- Images of children will not be used for marketing without explicit parental permission
- We comply with POPIA requirements for processing children's personal information
- Schools and parents can request removal of images from our systems
- Special consent is obtained when photographing children under 12 years of age
How We Share Your Information
We may share your information in the following circumstances:
Service Providers
- Payment processors for secure transaction processing (South African and international)
- Printing and fulfillment companies (local and international suppliers)
- Cloud storage providers for secure data storage
- Email service providers for communications
- Website hosting and analytics services
All third-party service providers are carefully selected and required to maintain appropriate security measures and comply with POPIA requirements when processing South African residents' data.
Legal Requirements
- When required by law or legal process
- To protect our rights, property, or safety
- To enforce our terms and conditions
- In connection with a business transfer or acquisition
With Your Consent
- When you explicitly authorize us to share your information
- For marketing or promotional purposes you've approved
We do not sell your personal information to third parties.
Data Security
We implement appropriate technical and organizational measures to protect your personal information:
- Encryption of sensitive data during transmission (SSL/TLS)
- Secure storage systems with access controls
- Regular security assessments and updates
- Employee training on data protection
- Backup systems to prevent data loss
- Limited access to personal information on a need-to-know basis
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
Data Retention
We retain your information for as long as necessary to:
- Provide you with services and fulfill our contractual obligations
- Comply with legal, tax, and accounting requirements
- Maintain business records and resolve disputes
- Enforce our agreements and protect our legal rights
Photographic images: We typically retain original images for 1-2 years after a session, unless otherwise specified in your service agreement. After this period, images may be archived or deleted. Portfolio images (with permission) may be retained indefinitely.
Your Rights Under POPIA
Under the Protection of Personal Information Act (POPIA), you have the following rights regarding your personal information:
Right to Access
- Request confirmation of whether we hold your personal information
- Request access to your personal information we hold
- Receive a description of the information and how it is used
Right to Correction
- Request correction of inaccurate, irrelevant, excessive, or outdated personal information
- Update your personal details through your account or by contacting us
Right to Deletion (Right to be Forgotten)
- Request deletion of your personal information (subject to legal obligations)
- Request removal of your images from public portfolios and galleries
- Note: We may need to retain certain information for legal, tax, or regulatory purposes
Right to Object
- Object to the processing of your personal information on reasonable grounds
- Object to direct marketing communications at any time
- Opt-out of marketing emails by clicking "unsubscribe" in any marketing message
Right to Restrict Processing
- Request restriction of processing in certain circumstances
- Challenge the accuracy of your information while we verify it
Right to Data Portability
- Receive your personal information in a structured, commonly used format
- Transfer your information to another service provider where technically feasible
Right to Complain
To exercise these rights, please contact our Information Officer using the details provided below. We will respond to your request within 30 days as required by POPIA. We may request proof of identity to verify your request.
Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience on our website:
Essential Cookies
- Required for website functionality and security
- Enable shopping cart and checkout processes
- Maintain your session and preferences
Analytics Cookies
- Help us understand how visitors use our website
- Collect anonymous usage statistics
- Improve website performance and user experience
Marketing Cookies
- Track your interests to show relevant advertisements
- Measure effectiveness of marketing campaigns
- Provide personalized content
You can control cookies through your browser settings. However, disabling certain cookies may affect website functionality.
Third-Party Links
Our website may contain links to third-party websites, including social media platforms and payment processors. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing any personal information.
Children's Privacy
While we provide school photography services involving children, our website and online services are not intended for children under 18 years of age to use independently. In accordance with POPIA, we take special care when processing personal information of children (persons under 18 years):
- We work with schools and parents/guardians to obtain appropriate consents before photographing children
- For children under 12, we obtain prior consent from a competent person (parent/guardian) before processing their information
- Parents/guardians have the right to review, access, correct, delete, or refuse further collection of their child's information
- We comply with POPIA's special requirements for processing children's personal information
- Schools act as responsible parties when collecting learner information on our behalf
If you believe we have inadvertently collected information from a child without proper consent, please contact our Information Officer immediately.
Cross-Border Data Transfers
As a South African business, we primarily store and process your information within South Africa. However, some of our service providers (such as cloud storage, email services, and payment processors) may be located outside South Africa. When transferring personal information across borders, we ensure:
- The recipient country has adequate data protection laws, or
- The recipient is subject to legally binding agreements providing adequate protection, or
- We have obtained your consent for the transfer
- We comply with Chapter 9 of POPIA regarding trans-border information flows
By using our services, you consent to the transfer of your information to countries with adequate data protection measures in place. We take reasonable steps to ensure your information remains protected in accordance with this privacy policy and POPIA requirements.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:
- Posting the updated policy on our website with a new "Last Updated" date
- Sending email notification for significant changes
- Displaying a notice on our website
Your continued use of our services after changes are posted constitutes acceptance of the updated policy.
Contact Us - Information Officer
In accordance with POPIA, we have appointed an Information Officer who is responsible for ensuring compliance with POPIA and handling privacy-related queries and requests.
If you have questions, concerns, or requests regarding this Privacy Policy, your personal information, or wish to exercise your POPIA rights, please contact our Information Officer:
We will respond to your inquiry within 30 days as required by POPIA. For access requests, we may charge a prescribed fee to cover administrative costs.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator:
POPIA Compliance Statement
Exquisite Photography is committed to complying with the Protection of Personal Information Act 4 of 2013 (POPIA) and its regulations. We process personal information in accordance with the eight conditions for lawful processing:
- Accountability: We take responsibility for the personal information we process
- Processing Limitation: We process information lawfully, reasonably, and only for specific purposes
- Purpose Specification: We collect information for specific, explicitly defined purposes
- Further Processing Limitation: We don't process information for purposes incompatible with the original purpose
- Information Quality: We ensure information is complete, accurate, and up to date
- Openness: We are transparent about our information processing practices
- Security Safeguards: We implement appropriate technical and organizational measures
- Data Subject Participation: We respect your rights to access and correct your information
Your California Privacy Rights
While we are a South African business primarily serving South African customers, if you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to know what personal information is collected, used, shared, or sold
- Right to delete personal information held by businesses
- Right to opt-out of sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising your privacy rights
To exercise these rights, please contact our Information Officer using the details provided above.
This Privacy Policy forms part of our terms of service. By using our website and services, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.
POPIA Compliance: This privacy policy is compliant with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) and its regulations. We are registered with the Information Regulator as required by POPIA.
