Privacy policy

This policy explains how ANA Studio (“we”, “us”) collects, uses, shares and protects personal information when you use our website, our client portal and our staff system, in line with the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

ANA Studio is operated by [registered company name], registration number [number], of [physical address]. Our Information Officer is [name], who you can reach at [email address]. For anything about this policy you can also write to traffic@anastudio.co.za.

2. What we collect

• Enquiries: your name, company, email, phone number and what you tell us about your project, when you use our contact form.
• Accounts: name, work email address, phone number, job title, company and role, for clients and staff who sign in.
• Bookings and work: design briefs, advertising material, files, proofs, comments and approvals you send us or that we create for you.
• Photography: client and shoot details, photographs and videos (which may show identifiable people or private property), and model and property release forms.
• Billing: quotations, invoices, and payment references (we don’t store card details).
• Security records: sign-in times, and the network (IP) address of requests, used to keep the system secure and to stop abuse.

Website and portal use: we use Google Analytics (through Google Tag Manager) to see how our website and client portal are used: pages visited, how you arrived, device and browser type, approximate location, and which buttons and forms are used. It doesn’t include your name, email address or anything you type into our forms. We don’t use advertising trackers, and our staff system isn’t measured.

3. Why we use it

• To respond to your enquiry and give you a quote (with your consent, which you give on the form).
• To provide the services you’ve booked: design, photography, video, print and related work (to perform our agreement with you).
• To invoice you and keep financial records (a legal obligation).
• To keep the system secure, prevent fraud and investigate problems (our legitimate interest in running a safe service).
• To publish work in our portfolio or gallery, only where we have the permissions required, including from identifiable people.

4. Who we share it with

We share personal information only as needed to provide our services: with the group companies you work with through the system (such as Condé Nast, Fast Company and Volt), and with the service providers who host and run it on our behalf. These are Amazon Web Services (hosting, database, file storage and email, in Ireland, with weather data fetched in Cape Town) and Google (website and portal analytics, as described above). Some of these process information outside South Africa; we use providers that are bound to protect it to a standard comparable to POPIA. [Confirm operator agreements are in place.]

We don’t sell personal information.

5. How long we keep it

• Enquiries that don’t become work: [24 months], then deleted.
• Accounts: while the account is active, and [12 months] after it’s closed.
• Invoices and financial records: five years, as tax law requires.
• Photographs and release forms: for as long as an image may be used under a licence or our portfolio, and [period] after that.
• Security records: [12 months].

6. How we protect it

Information is encrypted in transit; files are kept in private storage and opened only through short-lived links after we’ve checked who is asking; people see only what their role allows; and changes are logged. No system is perfectly secure, and if a breach affects your information we’ll tell you and the Information Regulator as POPIA requires.

7. Your rights

You may ask what personal information we hold about you, ask us to correct or delete it, object to how we use it, or withdraw consent you gave (this doesn’t affect anything we did before). Contact our Information Officer at [email address]. If you’re not happy with our response, you may complain to the Information Regulator: inforegulator.org.za.

8. Cookies

We use cookies and similar storage that the site needs to work, and Google Analytics cookies to measure how the website and portal are used. We don’t use advertising cookies.

• Sign-in: keeps you signed in and protects forms (set when you sign in).
• Settings: the company you’re working in, the admin “preview” and “test as” modes, and whether the side menu is collapsed.
• Analytics: Google Analytics cookies (named _ga and _ga_…, kept for up to two years) that tell visits apart, on the website and the client portal only.
• On your device only: whether you’ve seen the cookie note, your sound setting, and your contact details on the booking form if you ask us to remember them.

9. Children

Our services are for businesses and adults. We don’t knowingly collect information from children, except where a child appears in a photograph with the required consent of a parent or guardian.

10. Changes

We may update this policy. The date at the top shows when it last changed. See also our terms of use.