Legal
Privacy notice
What we collect, why we collect it, and what you can tell us to do with it. Written to be read, not to be survived.
Version 2026-09-01. This is the version referenced when you tick the consent box on the booking form.
Who we are
Lumina Ruth Media (registered name and company/CK number) is the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).
- Information Officer: full name
- Email: hello@luminaruthmedia.co.za
- Phone: +27 82 000 0000
- Address: physical address
What we collect, and why
Only what we need to quote for a shoot and then deliver it. There is no tracking, no advertising pixel and no analytics script on this website.
| What | Why | What happens without it |
|---|---|---|
| Name and email | To reply to your enquiry and identify your booking | We cannot respond at all |
| Phone number | To reach you on the day, when email is useless | Optional. We will email instead |
| Event type, date, venue, hours, guest numbers | To price the shoot and plan the coverage | We cannot quote |
| Your notes to us | Access details, accessibility needs, requests | Optional |
| How you found us | To know which channels are worth the effort | Optional |
| Photographs taken at your shoot | To deliver the work you commissioned | There is no shoot |
| Payment records | To track deposits and balances, and for SARS | Not optional once you pay |
We do not collect special personal information as POPIA defines it, and we do not knowingly collect information about children except as part of a shoot commissioned by their parent or guardian.
The three separate permissions
They are separate on purpose. Agreeing to one is not agreeing to the others, and you can decline the optional two and still book.
- Holding your details to do the job. Required. Without it we have nothing to quote against. This is processing necessary to conclude and perform a contract with you.
- Showing your photographs publicly. Optional. If you agree, images from your shoot may appear in our portfolio, on this website and on our social media. If you decline, they never leave your private gallery. We confirm this again in the contract before the shoot, and you can withdraw it later, though we cannot recall a printed magazine or unsee a post someone already shared.
- Marketing email. Optional, and off unless you tick it. Occasional availability and seasonal offers. Every message has a one-click unsubscribe, and unsubscribing has no effect on your booking.
Who else sees it
We do not sell your information. Nobody buys it. We use a small number of operators who process it on our behalf under contract:
- Supabase hosts the database holding bookings, clients and payment records.
- Your website host, e.g. Netlify or Cloudflare serves this website.
- Any album or print supplier you use receives the images and a delivery address when you order an album or prints.
- Our accountant and SARS, for records we are legally obliged to keep.
Information leaving South Africa
Our database is hosted in the region you chose, for example Ireland (EU), so your information is stored outside South Africa. POPIA permits this where the destination has comparable protection; the EU's GDPR meets that standard. If you would rather your information stayed in South Africa, tell us and we will discuss alternatives.
How long we keep it
| Record | Kept for |
|---|---|
| Enquiries that never became bookings | 12 months, then deleted |
| Booking and client records | 5 years after the shoot, because SARS requires it |
| Photographs, where you agreed to portfolio use | Indefinitely, until you withdraw consent |
| Photographs, where you did not | Your archive policy, e.g. 3 years, then deleted |
| Marketing list | Until you unsubscribe |
How it is protected
- The database refuses all access to anonymous visitors. The booking form can only call three narrow functions: check which dates are free, check one promotion code, and submit a request. It cannot read anything back.
- Reading client records requires a login that is on an explicit allowlist. A valid password alone is not enough.
- Everything travels over HTTPS.
- Photographs are delivered through private galleries, not public links.
No system is perfect. If information is ever accessed without authorisation, we will notify you and the Information Regulator as POPIA requires.
Your rights
Under POPIA you may:
- Ask what we hold about you, and get a copy.
- Have anything wrong corrected.
- Have your information deleted, subject to records we must keep by law.
- Object to processing, including marketing, at any time.
- Withdraw a consent you previously gave, including portfolio use.
- Complain to the Information Regulator.
Email hello@luminaruthmedia.co.za and we will respond within 30 days. There is no charge for a reasonable request.
The Information Regulator
If we have not handled something properly, you can complain to the Information Regulator of South Africa at inforegulator.org.za. Confirm their current complaints email and postal address on that site before publishing, as these have changed more than once.
Cookies
This website sets no cookies and runs no analytics. Your browser stores two small preferences locally, which never leave your device and are not sent to us: your light or dark mode choice, and a copy of any booking request you submit, so nothing is lost if your mail client misbehaves. Clearing your browser data removes both.
Changes
If this notice changes materially we will publish the new version here with a new version date. Every booking records which version you were shown, so you can always see what you actually agreed to.
Last updated 1 September 2026.
Any questions
Just ask
If anything here is unclear, or you want to know exactly what we hold about you, email us and we will tell you plainly.
Email the studio