PRIVACY POLICY

This website is owned and operated by Larnelle Bakala, an independent director and photographer based in South Africa (the “Responsible Party” under the Protection of Personal Information Act, 2013 (POPIA), and the “Data Controller” under the EU General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR)).

This site is a portfolio. It has no accounts, no forms, no newsletter and no shop. The sections below describe the limited information that is nevertheless processed when you visit.

1. Information collected

Server logs. Our hosting provider automatically records technical data for every request: IP address, browser type and version, referring page, and the date and time of the request. This is standard for any website and is used only to operate the site, diagnose faults and protect against abuse. An IP address is treated as personal information under both POPIA and GDPR.

Local storage. Three of your own choices are saved in your own browser: that you dismissed the cookie notice, whether you prefer the light or dark version of the site, and whether you last viewed a photo series compact or large. They never leave your device and are not readable by us. They are listed in full in our Cookie Policy.

We do not ask for, and have no way to receive, your name, email address, phone number or payment details through this website.

2. What we do not do

There is no analytics software on this site — no Google Analytics, no tracking pixels, no advertising or social media trackers. We do not build profiles, we do not use automated decision-making, and we never sell, rent or trade personal information.

3. Third parties

Vercel Inc. hosts this website and processes the server logs described above on our behalf.

Vimeo Inc.serves the videos. Video players are loaded only after you have allowed them in the notice at the bottom of the screen, and then only when you hover over or open a project — never on page load — and every embed is requested with Vimeo's Do Not Track flag enabled, which instructs Vimeo not to set tracking cookies and not to record the viewing session for analytics or advertising. Once a video loads, Vimeo receives your IP address as a necessary part of delivering it. See Vimeo's Privacy Policy.

Vercel and Vimeo are the only two. In particular, the preview images in the galleries are stored on this site rather than pulled from an outside image service, so simply browsing sends no request to any third party at all.

4. Cross-border transfers

Vercel and Vimeo operate servers outside South Africa and outside the European Economic Area, including in the United States. Your information may therefore be processed abroad, as permitted by section 72 of POPIA and Chapter V of the GDPR. Both providers are bound by their own contractual data protection commitments, including the EU Standard Contractual Clauses where applicable.

5. Why we may process it

Under GDPR the legal basis is our legitimate interest in keeping the website secure, available and working correctly (Article 6(1)(f)). Under POPIA the corresponding ground is that processing is necessary for pursuing our legitimate interests (section 11(1)(f)). The one exception is the Vimeo video players, which are optional and load only after you allow them: that processing is based on your consent (Article 6(1)(a) GDPR; section 11(1)(a) POPIA), which you can withdraw at any time as described in the Cookie Policy.

6. Retention

Server logs are retained by our hosting provider for a limited period in line with their standard practice and are then deleted. We keep no separate database of visitors.

7. Security and breaches

The site is served over HTTPS and holds no database of its own, so there is no store of visitor information to be taken from us. Our hosting provider applies its own technical and organisational safeguards to the server logs it keeps on our behalf, as required by section 19 of POPIA and Article 32 of the GDPR. Should personal information nevertheless be accessed or acquired by an unauthorised person, we will notify the Information Regulator and any affected person as required by section 22 of POPIA, and the relevant supervisory authority under Articles 33 and 34 of the GDPR.

8. Information Officer

As a sole practitioner, Larnelle Bakala is the Information Officer for the purposes of POPIA and is the person to contact about anything on this page, at Lordnelle@hotmail.com. No representative has been appointed under Article 27 of the GDPR: this site is a portfolio, it offers nothing for sale in the European Union and it monitors nobody's behaviour, so that obligation does not arise.

9. Your rights

You have the right to ask what personal information we hold about you, to have it corrected or deleted, and to object to its processing. If you are in the European Economic Area or the United Kingdom you have the rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21), and you may withdraw consent at any time without affecting the lawfulness of earlier processing (Article 7(3)).

In practice, because this site keeps no visitor records of its own, we will usually have nothing to retrieve. You may still contact us at Lordnelle@hotmail.com and we will respond within the time limits set by the applicable law.

10. Complaints

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za), or, if you are in the European Economic Area or the United Kingdom, with your national data protection supervisory authority.

11. Children

This website is not directed at children and we do not knowingly process the personal information of children.

12. Changes

We may update this policy from time to time. The date at the top of this page shows when it was last revised. See also our Cookie Policy and Terms of Use.

Contact: Lordnelle@hotmail.com