DATA PRIVACY POLICY

 

We design our services and policies to comply with both the Consumer Protection Act 68 of 2008 (including the Consumer Protection Act Amendment Regulations, 2026 on the NCC opt‑out registry) (hereafter referred to as the “CPA”), and the Protection of Personal Information Act 4 of 2013 (including section 69 on direct marketing and the Information Regulator’s Guidance Note on Direct Marketing) (hereafter referred to as “POPIA”). These laws together govern how direct marketing may take place and how consumers can control their information and opt out of unwanted communications.

This policy explains how we obtain, process and disclose your personal information, in accordance with the requirements of POPIA. Importantly, processing also includes legal use of your personal information as per the definitions provided in POPIA.

At Capture Video Productions (Pty) Ltd (hereafter “CVP”, “we”, “us”) we are committed to protecting your privacy and to ensure that your personal information is collected and used properly, lawfully and transparently.

About CVP

CVP produces and sells cinematographic services and products inclusive of photography video production and related media services to estate agencies, attorneys and other business clients, and operates platforms such as Capture HD Media, HomeGlow AI and Eddie‑Edit.

In some cases we act as a responsible party under POPIA – for example, where we collect and use contact details and account information for our own clients and platform users. In other cases we act as a service provider (operator) on behalf of our clients – for example, where we host or process content and data that our clients provide to us for their own business purposes.

Roles under POPIA

When we decide why and how personal information is processed, we are the responsible party and we comply with POPIA’s conditions for lawful processing, including purpose limitation, data minimisation, security and data subject rights.

When we process personal information only on the documented instructions of our clients, we act as a service provider (operator), and our clients remain the responsible parties in terms of POPIA. In those situations, our contracts with clients require them to comply with POPIA and other applicable laws, and we implement appropriate technical and organisational measures to protect the information we process on their behalf.

About you

You may be either a client, an employee or a service provider to CVP.  Depending on your role in relation to CVP, for purposes of this policy you may either be a data subject, an operator or even another responsible party. CVP applies this policy irrespective as if it relates to a data subject.

Key definitions

“Responsible party” – a public or private body or any other person which determines the purpose of and means for processing personal information.

“Operator” – a person who processes information for a responsible party in terms of a contract or mandate, without coming under the direct authority of the responsible party.

“Data subject” – a person to whom personal information relates.

“Processing” – any operation or activity concerning personal information.

“Record” – any recorded information, regardless of when it came into existence.

“Personal information’’ means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.  When we refer to information, we also refer to personal information.

Rationale, collection and accountability

We prefer to process personal information on the basis of clear, informed consent wherever appropriate. However, POPIA and other laws also allow us to process personal information without your express consent in certain circumstances, for example where:

  1. Processing is necessary to comply with a legal obligation (such as tax, company or law‑enforcement requirements);
  2. Processing is necessary to perform on a contract to which you are a party or to take steps at your request before entering into a contract;
  3. Processing is required to protect your legitimate interests or those of another person; or
  4. The information is publicly available, or processing is necessary for police investigations, litigation or similar legal proceedings.

We will not use these legal bases to undermine your privacy rights and will always aim to process personal information in a lawful, reasonable and transparent manner.

Whereas we are the responsible party collecting and processing information about you, the data subject, we undertake to comply with all conditions for the lawful and reasonable processing of your personal information as these conditions are found in Chapter 3 of POPIA.

We collect and process your personal information mainly because you are a data subject to CVP.  For this purpose, upon receiving your consent we typically collect the following categories of personal information from you:

  1. Name and surname of the person
  2. Gender
  3. Marital status
  4. Nationality
  5. Health, disability, well-being or medical history
  6. Identification number
  7. Colour
  8. Email address, physical address, GPS coordinates, identifying number or symbol, telephone number
  9. Private correspondence
  10. Employment history
  11. Language
  12. Race or ethnic group
  13. Account numbers

We would also like you to know that upon becoming a data subject to CVP, we may automatically collect your personal information.  We also collect information directly from you where you provide us with your personal details.  Where possible, we will inform you what information you are required to provide to us and what information is optional, and for all such information we will seek your consent. For those instances of personal information we do not receive your consent to use, we will consequently make an assessment of whether or how it impacts upon the services and products we have agreed to deliver to you, and where lack of consent materially impacts upon such delivery we will inform you timeously.  Where your information becomes available to us in another manner, we will collect it only in accordance with the same consent and in compliance with POPIA.

Website usage information may be collected using “cookies” which allows us to collect standard internet visitor usage information.  Our cookie policy offers you a choice to proceed or to avoid exposure so caused.

YouTube API service and Google Privacy Policy

By agreeing to use the YouTube API service, you as the user also agree to be bound by the YouTube Terms of Service:

Links explaining these Terms of Service:

  1. YouTube’s Terms of Service – https://www.youtube.com/t/terms
  2. Google Privacy Policy – https://www.google.com/policies/privacy

These links are also available on our Content Management System, CaptureIT, in the left-hand navigation.

From the YouTube API service we as CVP collect and store:

  1. YouTube URLs: Links are accessible via CaputureIT or sent to you, as our client, in an email.
  2. Status of these YouTube URLs: public, private, or unlisted.  Status can be viewed in CaptureIT on your order.
  3. Comments on the last 30 days’ videos: CVP will update and display the comments made on videos.  Comments will only be displayed for a duration of 30 days on YouTube and on your CaptureIT account to give you the opportunity to respond. Thereafter it will be removed from our database as per YouTube’s Terms of Service.

You as the user can revoke access to the API Client via this link: https://security.google.com/settings/security/permissions.

(App’s) use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Should you have any questions or complaints you are welcome to email frikkie@capturevideos.co.za

How we process your information

We are legally obliged to quality assure your information and to only use it for the purposes specified.  Therefore, we will process your personal information only for the purposes for which it was collected and as it was agreed with you.  This is in holding with the principle of minimality requiring that processing of personal information be adequate, relevant and not excessive.  In addition, where necessary your information may be retained for legal or research purposes.

The following example demonstrates potential use:

  1. To conclude or perform on a contract to which you are a party;
  2. To gather contact information;
  3. To confirm and verify your identity or to verify that you are an authorised user for security purposes;
  4. For the detection and prevention of fraud, crime, money laundering or other malpractice;
  5. To conduct market or customer satisfaction research or for statistical analysis;
  6. For audit and record keeping purposes;
  7. To protect your legitimate interest;
  8. In connection with legal proceedings.

Your rights to access to information, objections to processing and withdrawal of consent to processing

You have the right to request access to the personal information we hold about you and about the details of any third parties who have or have had access to your information. To do this, simply contact us at the numbers/addresses as provided on our website and specify what information you require.  We will require proof of your identity in a legally accepted format before providing details of your personal information. Please note that any such access request may be subject to a payment of a legally allowable fee.  However, we may refuse a request for access where the law allows or requires us to do so, for example where:

  1. The information is subject to legal privilege in the course of litigation;
  2. Disclosure may result in the disclosure of confidential information or trade secrets;
  3. Giving access may cause a third party to refuse to provide similar information to us in future;
  4. The information as it is recorded would reveal personal information about another person who has not consented; or
  5. Disclosure is prohibited by law.

If we refuse an access request, we will give you reasons for the refusal unless we are prevented from doing so by law, and you may use our reasons to decide whether to lodge a complaint with the Information Regulator.

You have the right at any time, within reason and within the determinations of POPIA, to object to the manner in which we process your personal information.

You have the right at any time, within reason and within the determinations of POPIA, to withdraw your consent to collection and processing of your personal information.

You may withdraw any consent you have given us to process your personal information at any time, by contacting our Information Officer at Christian@capturevideos.co.za. Withdrawal of consent will not affect processing that has already taken place, but will apply going forward.

Please note that withdrawal of consent is still subject to the terms and conditions of any contract in place between you and Capture Video Productions (Pty) Ltd. If your withdrawal of consent interferes with our legal obligations or with our ability to perform a contract (for example, to deliver services or comply with statutory requirements), we may not be able to give effect to the withdrawal in full, or we may need to terminate the relevant services. We will explain any such consequences to you if they arise.

Correction of your information

You have the right to ask us to update, correct or delete your personal information. We will require proof of your identity in a legally accepted format before making changes to personal information we may hold about you. To this end, we would appreciate it if you would keep your personal information accurate as we collect it from you.  In whichever way your personal information is modified, we will inform you should this have any material impact upon you.

Information security

We are legally obliged to provide adequate protection for the personal information we hold, to guarantee its integrity and confidentiality, and to stop and prevent unauthorized access and use of personal information. We will, on an on-going basis, continue to review our security controls and related processes to ensure that your personal information remains secure.

Our security policies and procedures cover:

  1. Physical security;
  2. Computer and network security;
  3. Access to personal information;
  4. Secure communications;
  5. Security in contracting out activities or functions;
  6. Retention and disposal of information;
  7. Acceptable usage of personal information;
  8. Governance and regulatory issues;
  9. Monitoring access and usage of private information;
  10. Investigating and reacting to security incidents.

When we contract with third parties, we impose appropriate security, privacy and confidentiality obligations on them to ensure that personal information that we remain responsible for, is kept secure.

Should we ever experience a security breach impacting upon your personal information, we will deal with such a security breach and notify you as per the requirements of POPIA.

Disclosure of information

We may disclose your personal information to our service providers who are involved in the delivery of products or services to you or ourselves. As specified by POPIA, we have written agreements in place to ensure that they comply with the privacy requirements as required by POPIA.

We may also disclose your information:

  1. Where we have a duty or a right to disclose in terms of law or industry codes;
  2. Where we believe it is necessary to protect our rights.

Direct marketing

The CPA gives consumers the right to block unwanted direct marketing and is supported by the Consumer Protection Act Amendment Regulations, 2026, which establish a National Consumer Commission (“NCC”) opt‑out registry for direct marketing.

Capture does not currently send unsolicited direct marketing communications (such as cold calls, bulk SMS, WhatsApp broadcasts or mass marketing emails) to consumers in its own name, and does not operate bulk messaging tools. Our estate‑agency and other business clients are responsible for complying with the CPA and the Amendment Regulations, 2026 where they use their own databases to market directly to consumers, including any requirements to register as direct marketers, cleanse their databases against the NCC opt‑out registry and honour pre‑emptive blocks.

POPIA regulates direct marketing by means of unsolicited electronic communications in section 69. For completeness, and to future‑proof this policy, we explain below how Capture would handle consent and opt‑out if we ever send electronic direct marketing in our own name:

  1. Explicit opt in consent: We will only send direct marketing by electronic communication (for example, email, SMS or messaging apps) where you have voluntarily, specifically and informedly opted in. This would typically be done by ticking a box or giving clear consent on one of our platforms. If you are not yet a customer, POPIA allows us to approach you only once to ask for consent, in the prescribed manner and form, and we will keep a record of any consent you give.
  2. Existing customer “soft opt in” (section 69(3) of POPIA): section 69(3) permits limited direct marketing to existing customers without new consent, but only if all of the following conditions are met:
  1. We obtained your contact details in the context of a sale of a product or service.
  2. We market our own similar products or services to you.
  3. We gave you a reasonable, free opportunity to object to such marketing at the time your details were collected and on each subsequent communication.

If any of these conditions is not met, we will not rely on the existing customer route and will instead ask for explicit opt in consent.

  1. Your right to opt out: Whether you receive direct marketing based on explicit opt in or the existing customer route, every marketing communication from Capture will:
  1. Clearly identify Capture as the sender or specify the person on whose behalf the message is sent; and
  2. Include contact details and a simple, free way for you to opt out of future marketing.

Once you opt out or object, we will stop sending you direct marketing and will keep your details on a suppression list to ensure we honour your choice.

At the date of this policy, Capture Video Productions (Pty) Ltd does not send unsolicited direct marketing communications in its own name and does not operate bulk messaging tools. This section is included to explain how we would comply with POPIA and the Information Regulator’s Guidance Note on Direct Marketing if our services or platforms change in future.

How to contact us

If you have any queries about this notice; should you need further information about our privacy practices; should you wish to withdraw consent; should you want to exercise preferences, or access, or correct your personal information, please contact us at the numbers/addresses listed on our website.

Annexures to follow

Annexure 1: HomeGlow AI – platform‑specific processing

HomeGlow AI is an AI‑enabled platform operated by Capture Video Productions (Pty) Ltd that transforms property images and related media to improve marketing content for estate agencies and other clients.

When you use HomeGlow AI, we process:

  1. Account and contact details (e.g. name, email, login credentials);
  2. Property and media content (e.g. photographs, floorplans, captions); and
  3. Usage and technical data (e.g. IP address, device information, logs).

HomeGlow AI uses artificial intelligence models to analyse and edit images (for example, sky replacement, lighting enhancement, object removal). Depending on the specific feature, processing may take place using models developed or hosted by CVP or by selected third‑party providers. Where we use third‑party AI services or cloud infrastructure, those providers process media and related data only to deliver the requested edits, under contract, and must comply with POPIA‑aligned security and confidentiality obligations.

Edited images and associated data are retained for as long as reasonably necessary to provide the service, comply with legal obligations and maintain records, and may be deleted or anonymised thereafter. If any processing or storage occurs outside South Africa, we will ensure that appropriate safeguards are in place, such as contractual measures, to protect your personal information in line with POPIA.gov+1
Your rights under POPIA (access, correction, objection, withdrawal of consent and direct‑marketing opt‑out) apply to HomeGlow AI in the same way as to other CVP services, as described in this policy.

Annexure 2: Eddie‑Edit – platform‑specific processing

Eddie‑Edit is an AI‑assisted video editing platform operated by Capture Video Productions (Pty) Ltd that helps clients create and refine video content (for example, property videos, interview clips and marketing pieces). When you use Eddie‑Edit, we process:

  1. Account and contact details (e.g. name, email, login credentials);
  2. Video and audio content you upload (including any images, voices or text appearing in that content); and
  3. Usage and technical data relating to your interaction with the platform.

Eddie‑Edit uses artificial intelligence to analyse and edit video and audio (for example, cutting clips, removing filler words, matching footage to scripts or prompts). AI processing may be performed using CVP’s own models or through integrated third‑party AI services and cloud infrastructure. Where we use third‑party AI providers, they process your media and related data only to deliver the requested edits and are bound by contracts that require appropriate security safeguards and POPIA‑aligned handling of personal information.

We retain uploaded media and derived outputs for the period necessary to provide the service, support your projects and comply with legal or record‑keeping obligations, and may delete or anonymise content thereafter. If any data is processed or stored outside South Africa, we will implement suitable safeguards as required by POPIA, such as data‑transfer agreements or equivalent protection in the receiving jurisdiction.

As with other CVP services, you can exercise your POPIA rights in relation to Eddie‑Edit as described in this policy, including requesting access to your personal information, correcting inaccuracies, objecting to certain processing and withdrawing consent where we rely on consent as a basis.