Scope and responsibility
Milah Muse & Co. is responsible for personal information it receives in connection with its enquiries and creative services. This policy describes the intended approach under the Protection of Personal Information Act 4 of 2013 (POPIA); it is not a certification of compliance.
The current website is a showcase with contact links. Its enquiry, booking, checkout and account pages are not available. You can contact the business by email or telephone; this policy also covers information you choose to send through those channels.
Information and purposes
An enquiry may include your name, email address, phone number, preferred dates, venue, service requirements and correspondence. If you proceed with a service, relevant billing details, agreements, photographs or video of identifiable people may also be needed. Avoid sending identity documents, sensitive information or information about children unless genuinely necessary and an appropriate lawful arrangement has been agreed.
Information should be limited to what is needed to answer enquiries, prepare quotes, arrange and deliver agreed services, communicate with clients, manage payments and disputes, and meet applicable record-keeping duties. It should not be reused for unrelated marketing without an appropriate lawful basis.
Lawful and transparent handling
Depending on the circumstances, processing may be justified by informed consent, steps requested before a contract, performance of a contract, a legal obligation, or a legitimate interest assessed against your rights. Consent is not assumed merely because you browse the website. Where consent is the basis, you may withdraw it for future processing; this does not invalidate earlier lawful processing.
Any public use of client images requires separate consideration of permissions and privacy. See the Photography, Image Use & Content Usage Policy.
Retention and security
Proposed retention approach: keep enquiry records only while needed for the enquiry and a justified follow-up period; keep contract, billing and project records only for an applicable legal duty or a documented operational need. The owner must confirm record categories and retention periods. Records no longer needed should be securely deleted, de-identified or restricted where required.
Appropriate safeguards should include limited access, secure accounts, protected devices and careful sharing. No website or communication channel can guarantee absolute security. If a security compromise meets POPIA notification requirements, affected people and the Information Regulator must be notified as required by law.
Providers and international processing
Website hosting and communications providers may process technical data or correspondence. The site loads fonts from Google Fonts, which requires requests to Google servers; those requests may disclose your IP address and browser information. Email and any third-party service you choose to use have their own privacy arrangements.
Where a provider acts as an operator for the business, appropriate written safeguards and confidentiality obligations should apply. If personal information is transferred outside South Africa, the transfer must satisfy POPIA section 72, for example through adequate protection or another permitted basis. The owner should verify actual providers, locations and agreements.
Your rights and concerns
Subject to legal conditions and exceptions, you may ask whether the business holds your personal information, request access or correction, request deletion of information it is not entitled to retain, object to processing, or withdraw consent. Reasonable identity verification may be needed without collecting excessive information. Any lawful access charge or refusal should be explained.
Send a privacy request to shamilah.titus01@gmail.com or call 078 226 6744. If a concern is unresolved, you may complain to South Africa’s Information Regulator at https://inforegulator.org.za. These rights are not limited by this policy.