Protection of Personal Information Act (POPIA) Notice

Last updated: 29 October 2026

This notice explains how Wiaan Jordaan Photography ("we", "us", "our") collects, uses, shares and protects your personal information when you visit wjphotography.co.za, browse event photos, create an account or place an order. We process personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

Our website runs on the TOGmatiX platform. TOGmatiX hosts our galleries, processes orders and delivers photos for us. It acts as our operator: it processes personal information only on our instructions and must keep it confidential and secure.

1. Personal information we collect

• Contact and account details: your name, email address and mobile number, and your login details. Passwords are stored in hashed form, never as plain text. If you sign in with Google, we receive your name and email address from Google.
• Order and delivery details: the photos and products you order, your delivery address, order history and payment status. Card payments are processed by our payment service provider; we do not receive or store your full card details.
• Event photos and videos: images taken at events in which you, or your child, may be identifiable, together with event and gallery details.
• Communications: messages you send us through contact forms, email or WhatsApp, and photo removal requests.
• Technical information: your IP address, browser and device information, cookies and the pages you visit.

Supplying contact and delivery details is voluntary, but we need them to process and deliver an order.

2. Why we use your personal information

• To publish event galleries so that participants and their families can find and buy their photos.
• To create and manage your account, and to process, deliver and support your orders.
• To send you order updates, download links and service messages by email or WhatsApp.
• To send you news and special offers, but only where you have agreed to this or are an existing customer, and always with an option to opt out.
• To keep our website secure and to prevent fraud and spam.
• To meet our legal obligations, for example tax and accounting record keeping.

We rely on the lawful grounds set out in section 11 of POPIA: performing our agreement with you, complying with the law, our legitimate interest in covering and selling event photography, and your consent where it is required.

3. Children's personal information

Many of our events, such as school and sports events, include children. We process children's personal information only as POPIA allows, including with the consent of a parent or guardian where required, which is normally obtained through the school, club or event organiser. A parent or guardian may ask us at any time to remove a photo of their child (see section 8).

4. Who we share it with

We share personal information only where needed for the purposes above:

• TOGmatiX, our platform operator.
• Payment service providers, to process your payments.
• Print laboratories and courier companies, to produce and deliver physical orders.
• Email and messaging providers (such as SendGrid and Twilio for WhatsApp), to send you messages.
• Hosting and cloud storage providers that store our website, photos and data.
• Google, for spam protection (reCAPTCHA), Google sign-in and, where enabled, website analytics, and Meta, where its advertising pixel is enabled.
• Authorities or other parties where the law requires it.

We do not sell your personal information.

5. Transfers outside South Africa

Some of these providers store or process information outside South Africa. When that happens, we take steps to ensure the information is protected to a standard comparable to POPIA, as required by section 72 of POPIA.

6. How we protect your information

We use reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access. These include encrypted (HTTPS) connections, hashed passwords and access controls that limit access to staff and service providers who need it. If we believe your personal information has been accessed without authorisation, we will notify you and the Information Regulator as required by section 22 of POPIA.

7. How long we keep it

We keep personal information only for as long as we need it for the purposes above. Order and payment records are kept for as long as tax and accounting laws require (generally five years). Event galleries remain online while the event is listed, and you can ask us to remove a photo at any time.

8. Removing a photo

If you, or a child in your care, appear in a photo and you would like it removed, use the Request removal option on the photo or email us at wiaanjordaanphotography@gmail.com. Please tell us which photo you mean and why. We review every request.

9. Cookies

We use cookies to keep you signed in, remember your shopping cart and keep the website secure. Where analytics or advertising tools are enabled, they also use cookies to measure visits. You can block or delete cookies in your browser settings, but parts of the website, such as the cart, may then stop working.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy of it;
• ask us to correct, update or delete information that is inaccurate, out of date or no longer needed;
• object to the processing of your personal information, including for direct marketing;
• withdraw your consent at any time, where we rely on consent;
• opt out of marketing messages at any time by contacting us; and
• lodge a complaint with the Information Regulator.

To exercise these rights, contact us using the details at the top of this notice. We may need to verify your identity before we act on a request. If the law allows a fee for providing records, we will tell you before we proceed.

11. Changes to this notice

We may update this notice from time to time. The latest version will always be available on this page, with the date it was last updated.