Privacy Policy

StudioBooking.co.za ("we", "our", or "us") is committed to protecting the privacy and personal information of all users of our platform. This Privacy Policy describes how we collect, use, store, and share your personal information when you use our website or make a booking through our platform.

By using StudioBooking.co.za, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms of this policy, please do not use our platform.

StudioBooking.co.za is a content studio booking platform operating from Kyalami Estates, Johannesburg, South Africa. For the purposes of POPIA, we are the responsible party in respect of the personal information we process.

Contact details for our information officer are provided in the Contact Us section of this policy.

We collect personal information that you provide directly to us when making a booking or contacting us. This may include:

• Identity information: Full name and a copy of your South African ID or passport, required for booking verification.
• Contact information: Email address and mobile phone number.
• Booking information: Dates, times, package selections, add-ons, and the nature of your shoot or project.
• Banking details: Account holder name, bank name, account number, and branch code — collected solely for the purpose of processing your refundable breakage deposit.
• Payment information: Payment transactions are processed by our third-party payment provider. We do not store your card or full banking details on our servers.
• Technical information: Device type, browser, IP address, and usage data collected automatically when you use our website (see Cookies).

We use your personal information only for the purposes for which it was collected:

• Processing, confirming, and managing your studio bookings.
• Verifying your identity as required for booking security.
• Sending booking confirmation, reminder, and update emails.
• Processing and refunding your breakage deposit.
• Responding to your enquiries and support requests.
• Sending follow-up communications related to incomplete bookings (abandoned booking recovery).
• Complying with our legal obligations under South African law.
• Improving our platform and services using aggregated, anonymised data.

We will not use your personal information for direct marketing purposes without your explicit consent.

Under POPIA, we process your personal information on the following grounds:

• Contract: Processing is necessary to fulfil the booking agreement between you and us.
• Legal obligation: Processing required to comply with applicable South African laws and regulations.
• Legitimate interest: Processing that is necessary for our legitimate business interests, where those interests are not overridden by your rights and interests.
• Consent: Where you have given us explicit consent to process your information for a specific purpose.

We do not sell, rent, or trade your personal information to third parties for marketing or commercial purposes. We may share your information in the following limited circumstances:

• Payment processors: Your payment information is shared with our authorised payment gateway (PayFast) to process booking payments securely.
• Email service providers: We use a third-party email delivery service (Resend) to send booking confirmations and communications. Only your email address and name are shared for this purpose.
• Legal requirements: We may disclose your information if required to do so by law, court order, or other governmental authority.
• Business transfers: If our business is sold or merged with another entity, your personal information may be transferred to the new owner, subject to the same privacy protections.

All third parties with whom we share your information are required to process it only as instructed by us and in accordance with applicable privacy laws.

We retain your personal information for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Booking records are retained for a minimum of 5 years for accounting and legal compliance purposes.
• ID documents are retained for the duration of the booking relationship and deleted within 6 months of the last booking.
• Banking details provided for deposit refunds are deleted once the deposit has been returned.
• Communication records are retained for up to 3 years.

When your information is no longer required, it is securely deleted or anonymised.

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encrypted data transmission using HTTPS/TLS for all communications.
• Secure cloud storage with access restricted to authorised personnel only.
• ID documents stored in a private, access-controlled storage bucket.
• Payment information handled exclusively by our PCI-compliant payment provider — we never store card details.
• Row-level security policies enforced at the database level.

While we take all reasonable precautions, no method of data transmission or storage is 100% secure. In the event of a data breach that affects your rights, we will notify you and the Information Regulator as required by POPIA.

The Protection of Personal Information Act (POPIA) grants you the following rights regarding your personal information:

• Right of access: You may request a copy of the personal information we hold about you.
• Right to correction: You may request that inaccurate or incomplete information be corrected.
• Right to deletion: You may request that your personal information be deleted, subject to our legal retention obligations.
• Right to object: You may object to the processing of your personal information in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated.

Our website uses cookies and similar technologies to improve your browsing experience and help us understand how our platform is used. Cookies are small text files stored on your device.

We use the following types of cookies:

• Essential cookies: Required for the platform to function, including session management and security.
• Analytics cookies: Used to understand how visitors interact with our website so we can improve it. Data collected is aggregated and anonymised.

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the platform.

Our platform may contain links to third-party websites, including our payment provider (PayFast). These sites have their own privacy policies, and we are not responsible for their content or practices. We encourage you to review the privacy policies of any third-party sites you visit.

Our platform is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18 without verifiable parental or guardian consent. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

We encourage you to review this policy periodically. Your continued use of the platform after any changes constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise your rights under POPIA, or want to raise a privacy concern, please contact our information officer using the details below: