01Who is responsible for your information
Responsible party
Eduard King, trading as e.k. Photography
Information Officer: Eduard King
Uitzicht, Durbanville, Cape Town, Western Cape, South Africa
Email: enquiry@ekphoto.co.za
Phone and WhatsApp: +27 65 803 8832
Website: www.ekphoto.co.za
e.k. Photography is a one-person business. "I" and "me" below mean Eduard King. The same person reads every enquiry, takes every photograph and answers every request made under this policy.
02What this policy covers
- This website, www.ekphoto.co.za, including the wedding, engagement, graduation and matric dance pages and the private client galleries
- Every enquiry form on those pages
- Lead forms and adverts run on Facebook and Instagram (Meta)
- Email, WhatsApp and telephone conversations about a shoot
- The photographs and video taken at a session, wedding or event
It does not cover websites linked from here. Meta, Google, and any venue, planner or supplier you deal with directly, each have their own privacy policies.
03What information is collected
3.1 When you send an enquiry through this website
The forms ask for your first name, surname, email address, phone or WhatsApp number, the type of enquiry, how you prefer to be contacted, and a message. Only the name and email address are required; everything else is optional and you decide how much to put in the message.
The form is delivered to my inbox by Web3Forms, a form-to-email service. It passes the submission on and does not use it for anything else. Nothing you type is stored in a database on this website.
3.2 When you submit a lead form on Facebook or Instagram
Meta shows the form inside the app and pre-fills it from your profile. It usually asks for your name, email address and phone number, plus answers to whatever questions the particular form asks: the kind of shoot, a date, a location, how you would like to be contacted. You see and confirm every field before you submit it, and you can edit or clear anything Meta has pre-filled.
Meta also passes me the time of submission and which advert and form the enquiry came from, so I know what you were responding to. Meta keeps its own copy under its own terms and makes it available to me for a limited period (90 days at the time of writing). I download leads from Meta into my own records and then work from those.
Submitting a lead form is a request for me to contact you about photography. It is not an order, a booking, or a commitment to pay anything. Nothing is charged, and no payment detail is ever requested in a lead form.
3.3 When you book a shoot
A booking needs more detail: the date and running times, the venue and addresses, who is to be photographed, contact details for a coordinator or other suppliers where relevant, and anything you tell me about access, mobility or family circumstances so the day can be planned considerately. The signed agreement records your name, address, email and phone number, and I keep invoices and payment references.
Payments are made by electronic transfer. I never ask for, see, or store card numbers, CVV codes or online banking credentials. What reaches me is a payment reference and an amount on a bank statement.
3.4 Photographs and video
Photographs of identifiable people are personal information under POPIA, so the images themselves fall under this policy. Image files also carry technical metadata: date, time, camera and lens settings, and in some cases GPS coordinates of where the frame was taken.
3.5 When you simply visit the website
Google Analytics 4 and Google Tag Manager record your IP address, an approximate location derived from it, your browser and device type, which pages you viewed, how long you stayed and how you arrived. This is used in aggregate, to see which pages are worth keeping. It is not used to identify you. Section 9 lists the cookies involved and how to refuse them.
The pages also load typefaces from Google Fonts and one script from the jsDelivr content network (the country code selector on the phone field). Those services see your IP address as an unavoidable consequence of sending you the file.
3.6 When you open a private client gallery
Client galleries are password protected. Entering the correct password sets a signed session cookie so that you are not asked again for every photograph. That cookie holds the gallery name and an expiry time only. It carries no name, no email address and no identifier for you, and it is deleted when it expires or when you log out.
3.7 On social media
Comments, likes, follows, tags and direct messages on the e.k. Photography Instagram and Facebook accounts live on those platforms. They are covered by the platform's own policy as well as by this one.
04Why it is collected, and on what legal basis
POPIA requires a lawful basis for each purpose. These are mine.
- Replying to your enquiry, answering questions, sending a quote
- Steps taken at your request before a contract, section 11(1)(b)
- Planning and delivering a booked session, wedding or event
- Performance of our contract, section 11(1)(b)
- Invoicing, accounting and keeping tax records
- Legal obligation, section 11(1)(c)
- Using your photographs in my portfolio, on this website and on social media
- Consent, given in the signed session or wedding agreement, section 11(1)(a). See section 10.
- One or two follow-ups about a shoot you enquired about, if I have not heard back
- Legitimate interest, section 11(1)(f). Say the word and it stops.
- Understanding which pages people use, so the site can be improved
- Legitimate interest, section 11(1)(f)
- Advertising on Meta and Google
- Consent, through the cookie and platform ad settings you control
No automated decision-making or profiling is used to decide anything about you. Every enquiry is read by a person.
05What I never do
- I do not sell, rent or trade your personal information. Not to marketing lists, not to other photographers, not to venues or planners.
- I do not add you to a mailing list because you enquired. If a newsletter ever exists, you will be asked to opt in first.
- I do not pass leads collected on Meta to anyone else.
- I do not share your event details with other suppliers unless you have asked me to, or the day genuinely cannot run without it (a coordinator who needs the photography timeline, for example).
- I do not use your photographs to advertise a third party's products without asking you first.
07Information that leaves South Africa
Google, Meta, Cloudflare and Web3Forms run their servers outside South Africa, mainly in the United States and the European Union. Information you send through this website or through a Meta lead form is therefore processed abroad.
Section 72 of POPIA allows this where the recipient is subject to laws or binding agreements that provide protection substantially similar to POPIA, or where you consent. Each of these companies publishes contractual data protection terms, and by sending an enquiry you consent to the transfer as contemplated in section 72(1)(b).
08How long it is kept
- Enquiries that do not become bookings
- 12 months, then deleted
- Leads from Facebook and Instagram
- Downloaded into my records and treated as an enquiry above. Meta's own copy expires under Meta's retention rules.
- Client correspondence, agreements and invoices
- 5 years after the last transaction, which is the retention period South African tax law requires
- Your online gallery
- Live for at least 6 months from delivery, as set out in your agreement. Please download and back up your images during that time.
- Final edited images
- Archived beyond the gallery period so that reprints and replacements stay possible, unless you ask for deletion
- Unedited camera files
- Normally deleted about 12 months after delivery. These are never supplied to clients.
- Website analytics
- Held by Google for the period set in the account, to a maximum of 14 months for user and event level data
When a retention period ends, records are deleted or anonymised. Where a legal obligation requires me to keep something longer, it is kept and used for nothing else.
10Photographs and portfolio use
The signed session or wedding agreement grants me the right to use photographs from your shoot in my portfolio, on this website, on social media, and in print and digital marketing. That is a matter of contract, but it is also a matter of courtesy, and the following always applies:
- Tell me before delivery if there are images you would rather keep private, for security, professional or personal reasons, and they will not be published. You do not have to give a reason.
- If something is already published and you want it taken down, email me. It will be removed from everything I control, ordinarily within 7 days. Copies other people have already shared or that search engines have cached are outside my control, though I will help where I can.
- Guests and other people photographed at a wedding or event, who never signed anything themselves, can make exactly the same request directly to me.
- Copyright in the photographs stays with me under section 21 of the Copyright Act 98 of 1978. Your licence to use your images is set out in your agreement. Copyright and privacy are separate things: owning the copyright does not entitle me to publish an image you have asked me not to publish.
11Children
Some of this work involves people under 18: matric dance sessions, family portraits, the occasional graduation. POPIA treats information about a child as a special category that may only be processed with the consent of a competent person, ordinarily a parent or legal guardian.
- A parent or legal guardian must be present for the whole of any session involving a minor.
- Consent to photograph a minor, and to use those photographs as described in section 10, comes from the parent or guardian who signs the agreement, not from the minor.
- My adverts and lead forms are not directed at people under 18. If you are under 18, please ask a parent or guardian to make the enquiry so that the booking is made by someone who can enter into a contract.
- If you believe I hold information about a child without the proper consent, contact me and it will be deleted.
12Your rights
POPIA gives you the following rights over the information I hold about you.
- Access. Ask what personal information I hold about you and get a copy of it, together with who has received it (section 23).
- Correction. Ask me to fix anything inaccurate, misleading, outdated or incomplete (section 24).
- Deletion. Ask me to delete information that is no longer needed, or that I was never entitled to hold (section 24).
- Objection. Object to processing that rests on legitimate interest (section 11(3)(a)).
- Withdrawal of consent. Withdraw consent you gave, at any time. That does not undo anything lawfully done before you withdrew it (section 11(2)(b)).
- No direct marketing. Tell me to stop contacting you about my services, and I will (section 69).
- Complaint. Take the matter to the Information Regulator (section 74). See section 15.
How to exercise them
Email enquiry@ekphoto.co.za and say what you want. Plain language is fine; you do not need a form or a lawyer. A straightforward request costs nothing and I will respond within 30 days. I may first ask you to confirm who you are, so that I do not hand somebody else's information, or somebody else's photographs, to the wrong person.
Two limits worth knowing about. Records I have to keep for tax purposes cannot be deleted before that period ends, though I will stop using them for anything else. And a photograph that includes other people has to be handled with their interests in mind too, so a deletion request over a group image is dealt with case by case.
13If you are in the EU or the UK
I photograph internationally, so some clients are covered by the GDPR or the UK GDPR as well as by POPIA. The rights in section 12 line up closely with the GDPR rights of access, rectification, erasure, restriction, objection and portability, and I will treat a request under either law the same way. Where GDPR applies you may also complain to the supervisory authority in your own country.
14Security
- The whole website is served over HTTPS, with strict transport security, so nothing you type into a form crosses the network in the clear.
- Client galleries are password gated. A Cloudflare Worker checks a signed token before it will release a single photograph, and full resolution originals are never placed on the public web server.
- Camera cards are copied to more than one drive on the day of a shoot, and archives are kept in more than one place so that a single failure cannot lose your images.
- Devices and storage are password protected, and I am the only person with routine access. Anyone engaged for a particular booking gets only what that job requires.
No system is perfectly secure. If a breach happens that creates a real risk to you, section 22 of POPIA requires me to notify both you and the Information Regulator as soon as reasonably possible, and I will.
15Complaints
Please come to me first. Most concerns are a misunderstanding that a short conversation clears up, and I would rather fix something than have you take it elsewhere unhappy. If you are not satisfied with how I have handled it, you can complain to the regulator:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: complaints.IR@justice.gov.za
General enquiries: enquiries.IR@justice.gov.za
16Changes to this policy
This policy will change as the business does: a new tool, a new advertising platform, a new way of delivering galleries. The version number and effective date at the top of this page always tell you which version you are reading. Where a change materially affects how your information is used, it will be noted here before it takes effect.
Questions about any of this are welcome. Write to enquiry@ekphoto.co.za or message +27 65 803 8832.