Privacy
Privacy is part of the service, not an afterthought. This notice explains what NOIRÉ collects, why, how long it is kept, and the rights you hold over it under the Protection of Personal Information Act, 2013 (POPIA).
01 · Who is responsible
NOIRÉ is the responsible party for the personal information described in this notice and determines why and how it is processed. Contact details for the responsible party and the person handling privacy queries are published on the contact page, and privacy requests should be sent there with “Privacy request” selected as the topic. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
02 · What we collect
Client information: name, contact details, billing details, session brief, and the imagery produced for you. Talent information: legal name, stage name, date of birth, contact details, physical attributes you choose to give, portfolio material, work-category preferences, identity and age verification records, and agreement records. Production-client information: company details, casting briefs, booking records and agreements. Site information: account credentials in hashed form, security and audit logs, and the technical records needed to operate and defend the service. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
03 · Special personal information and children
Some information we process is special personal information under POPIA, including information about sex life or sexual orientation implied by work-category preferences, and biometric identity documents used for age verification. We process it only with your explicit written consent, only for the purposes described here, and with access restricted to staff who need it. This platform is for adults. We do not knowingly collect information from anyone under 18, and any such record found is deleted and the account closed. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
04 · Identity documents and verification photos
An application to be represented requires two files: a government-issued ID or passport, and a photo of you holding that document. They exist for one purpose, to establish that you are an adult and that the document is yours. They are stored in a restricted system separate from portfolio material, readable only by the staff carrying out verification, and are never shown on a public profile, never given to a client and never used in any publication. Photographs are re-encoded on upload, which strips embedded location data. They are retained only as long as we must be able to evidence that verification took place, and are then deleted. You may ask what identity files we hold about you at any time. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
05 · Why we process it and on what basis
To provide the service you asked for and perform our agreement with you; to verify age and identity, which is both a legal safeguard and a condition of representation; to record and honour consent; to operate private galleries and portals securely; to communicate about bookings and applications; to meet legal obligations including records we must keep; and to establish, exercise or defend legal claims. Where we rely on your consent, you may withdraw it at any time, and doing so does not affect processing that already happened lawfully. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
06 · Consent records
Work-category consent is recorded as an append-only ledger: each change is a new entry, and previous entries are never edited or erased. That history is the audit trail that proves what was authorised and when. Withdrawing consent stops future eligibility immediately; it does not delete the record that consent once existed, because that record is what protects you. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
07 · Client image publication
Nothing you create with the studio is published without your explicit written permission, recorded per image. Fully private delivery is always available and is the default. Permission you have given can be withdrawn for future use by contacting us, and we will stop using the image going forward, though we cannot recall copies already lawfully distributed under a permission that was in force. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
08 · Private gallery security
Private galleries require sign-in and an explicit access grant. Image links are individually signed and time-limited, and they stop working when they expire, when a gallery closes, or when access is revoked. Access events are logged. Sharing your own gallery link or credentials with someone else places that material outside our control, so please do not. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
09 · Talent personal data separation
Legal identity, date of birth, contact details, verification records, documents and internal notes are held as private records, technically separated from public profiles and restricted to staff who need them. A public profile carries only publication-approved information. A client of the agency can never see a talent’s private identity record, and can never see or override their consent. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
10 · Who we share it with
We share personal information only with operators processing it on our instructions under a written contract, such as hosting, storage, email delivery, age or identity verification and electronic signature providers; with a production client, only the specific information you have agreed may be shared for that engagement; and with a court, regulator or law-enforcement body where the law requires it. We do not sell personal information and we do not share it for third-party advertising. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
11 · Cross-border transfers
Some operators process information outside South Africa. Where that happens we transfer only under section 72 of POPIA, meaning the recipient is bound by a law, binding corporate rules or a contract providing an adequate level of protection comparable to POPIA. A current list of processing locations is available on request. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
12 · Security safeguards
Access is role-based and least-privilege. Credentials are stored hashed, sessions are short, repeated failed logins lock an account, and sensitive actions are written to an audit log. Private media is served only through signed, expiring links, never from a public path. Backups are held and restore procedures are rehearsed. No system is perfectly secure, and if a breach affects your personal information we will notify you and the Information Regulator as section 22 of POPIA requires. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
13 · How long we keep it
We keep personal information only as long as the purpose and the law require, under defined retention classes per record type. In outline: enquiry records are kept while the enquiry is live and for a short window afterwards; client session records and delivered galleries are kept for the agreed delivery and support period; age-verification and consent records are kept for as long as representation continues and afterwards for the period we must be able to evidence that verification and consent existed; financial records are kept for the period tax law requires; and audit logs are kept for a defined security window. When a retention period ends, records are deleted or de-identified. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
14 · Your rights
You may ask what personal information we hold about you and request a copy; ask us to correct or complete it; ask us to delete or destroy it; object to processing on reasonable grounds; and withdraw consent where consent is the basis we rely on. Send requests through the contact page with “Privacy request” selected. We confirm receipt, verify who you are before releasing anything, and respond within a reasonable period. If we cannot fulfil a request in full, for example because we must retain a record to meet a legal obligation or to defend a claim, we will tell you which part we cannot do and why. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
15 · Complaints
If you are unhappy with how we handled your information or your request, tell us first so we can put it right. You also have the right to complain directly to the Information Regulator of South Africa, whose contact details are published on its website. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
16 · Cookies and analytics
We use only the cookies needed to run the site: session and authentication cookies, a cookie recording that you acknowledged the 18+ entry notice, and a cookie holding your shortlist. These are strictly necessary and are not used for advertising or cross-site tracking. If we later add optional analytics, it will be off until you opt in. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
17 · Changes to this notice
We may update this notice as the service or the law changes. The current version is always published here, and material changes are notified to account holders by email before they take effect. This wording is a structured development draft and must be reviewed by qualified counsel before launch (task A7).
Questions or requests: contact us.