Privacy Policy

GOAT Creative Solutions (trading as GOAT Creative Solutions) is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Company registration: 2016/257033/07.

Physical address: 138 West Street, Sandton, Gauteng, 2196, South Africa.

Information Officer: Duncan Mufamadi. Privacy requests: info@goatcreatives.co.za. Network operations: network@goatcreatives.co.za.

We process information about website visitors; clients and corporate contacts; referrers; photographers, videographers, and studio owners; schools and school contacts; and parents or guardians who order school photo prints.

We process children’s information only for school photography, and only with the consent of a parent, guardian, or authorised school contact (a competent person under POPIA).

Accounts: name, email, phone, and a password held by Firebase Authentication (we do not store your password in our database).

Bookings and briefs: event or shoot details, venue, province, notes, package chosen, and EFT payment references.

Creator and studio profiles: bio, specialties, equipment, portfolio images, studio address, and a map pin (GPS or geocoded address).

Referrers: a street-level map pin so we can place you on the network map.

School services: school name and address, contact details, expected learner numbers, learner names, learner codes, and photographs.

Visit data on public pages (only if you accept analytics): pages viewed, referral codes, browser timezone, IP address, inferred city and province, user agent, and a temporary session id. Page views are pruned after about 180 days.

Cookies: a necessary login cookie named __session. Optional analytics uses session storage (goat_visit_session) and your analytics choice in local storage.

Contract: to create accounts, take bookings, send invoices and EFT instructions, assign creators or studios, deliver school prints, and run Refer & Earn.

Consent: optional email marketing, optional visit analytics (city and province), and processing of learner names and photographs.

Legitimate interests of the responsible party (section 11(1)(f)): securing the platform, preventing abuse, and understanding public-site use after you accept analytics.

Legal duty: tax, accounting, and records we must keep.

GOAT staff who need it to run the network.

Assigned creators or studio owners, only as needed to fulfil a booked job or approved session — not a public directory of client details.

Operators who process information for us: Google Firebase (authentication, database, hosting, and file storage); ipwho.is for city and province from IP when analytics is accepted; and our email host for transactional mail.

We do not sell personal information.

Firebase / Google and IP lookup may process information outside South Africa. We rely on operator arrangements and the need to perform the contract or your consent. Ask your attorney to confirm the section 72 ground that fits this stack before you treat this clause as final.

Account and booking records: while the account is active and for a further period needed for disputes, tax, and legal claims (your attorney should set the number of years).

Visit records: about 180 days, then pruned.

School photographs: until the school or parent relationship ends, you ask us to delete them, or a legal hold applies.

We use HTTPS, role-based access, Firestore security rules, and hashed credentials in Firebase Authentication. No website is perfectly secure. Report a concern to the privacy email above.

You may request access to your personal information, ask us to correct it, object to certain processing, withdraw consent where we rely on consent, and ask us to delete information we no longer need (POPIA sections 23–25).

Email info@goatcreatives.co.za. We may need to verify who you are. You may also lodge a complaint with the Information Regulator (South Africa): https://inforegulator.org.za · POPIAComplaints@inforegulator.org.za.

We only send electronic marketing (email about packages and network news) if you tick a separate opt-in. You can unsubscribe on any marketing email or by writing to us. Transactional mail about bookings, invoices, and your account is not marketing.

Learner names and photographs are processed only for school photo days and print orders. We do not use children’s images in public marketing without extra, specific consent. A competent person must consent before we process that information.

See our Cookie notice for necessary login cookies versus optional analytics. You can change analytics on that page.

We will update this page when our practices change. The “Last updated” date at the top is the version date.