Privacy policy

Grace & Light Photography (“Grace & Light”, “I”, “me”) respects your privacy. This policy explains what personal information I collect through this website and my photography services, why I collect it, and the choices and rights you have under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible for your information

The responsible party is Grace & Light Photography, based in Johannesburg, Gauteng, South Africa.

• Information Officer: [full name]
• Email: hello@gracenlight.co.za
• Postal / business address: [address, if applicable]

2. What I collect

• Enquiries: your name, email address, phone number (optional), the type of session you're interested in, preferred date, location, approximate budget, the story you share and how you heard about me.
• Newsletter: your first name and email address, and a record of your consent.
• Clients: details needed to plan and deliver your session, invoices and payment records, and the photographs themselves.
• Website use: this site uses Google Analytics to understand how many people visit and which pages they find useful. It records things like the pages you view, roughly where in the world you are, and whether you arrived from a search engine or social media. It does not tell me who you are, and no advertising cookies are used.

3. Why I use it

• To reply to your enquiry and plan your session.
• To provide the services you book, including delivering your gallery.
• To send Letters from the Light — only if you have opted in. Every email includes an unsubscribe link.
• To meet legal, tax and accounting obligations.

I only process information for these purposes, and I rely on your consent, the need to perform our agreement, or a legitimate interest as allowed by POPIA. Marketing emails are only sent with your prior consent.

4. Photographs

Your photographs belong to your story. I will only share images from your session publicly (for example in my portfolio, journal or social media) with your permission, which you are free to decline. I will never publicly share identifiable images of children without a parent or guardian's explicit consent.

5. Who I share it with

I never sell your personal information. I use a small number of trusted service providers (“operators”) to run the business, such as:

• Form processing: [provider, e.g. Formspree]
• Email newsletter: [provider, e.g. MailerLite]
• Client galleries and file storage: [provider]
• Website hosting: Vercel

Some of these providers may store information outside South Africa. Where that happens, I use providers that are bound by data protection laws or agreements offering protection comparable to POPIA.

This website also loads fonts from Google Fonts and placeholder images from Unsplash, which means your browser connects to their servers and shares technical information such as your IP address. [Review before launch; consider self-hosting fonts and images.]

6. How long I keep it

• Enquiries that don't become bookings: deleted after [12] months.
• Client and financial records: kept for as long as the law requires (currently [five] years for tax purposes).
• Newsletter details: until you unsubscribe.
• Client galleries: [period, e.g. available online for 12 months].

7. Keeping it safe

I take reasonable technical and organisational steps to protect your information, including secure, password-protected accounts, two-step verification where available and limited access. If a data breach is likely to affect you, I will let you and the Information Regulator know as required by POPIA.

8. Your rights

You may, at any time and free of charge:

• ask what personal information I hold about you, and request a copy;
• ask me to correct or delete it;
• object to how it is used, or withdraw your consent;
• unsubscribe from the newsletter using the link in any email.

Email hello@gracenlight.co.za and I will respond as soon as I can. If you're unhappy with how your information has been handled, you have the right to lodge a complaint with the Information Regulator (South Africa).

9. Cookies and browser storage

Google Analytics sets cookies in your browser so it can tell returning visits from new ones. They are used only to count and understand visits — never to advertise to you, and the data is not sold or shared. You can opt out entirely with Google's browser add-on, or by using your browser's "do not track" and cookie settings.

The site also briefly uses your browser's session storage to greet you by first name on the newsletter thank-you page; that information is deleted as soon as the page has loaded.

10. Changes to this policy

I may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.