Virentum (Pty) Ltd respects privacy and processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law. This Policy explains how Virentum handles personal information when people visit virentum.co.za, request a quotation, make a payment, work on or appear in a production, supply services, apply for work or otherwise interact with Virentum.

1. Responsible party and contact details

Responsible party: Virentum (Pty) Ltd

Registration number: 2022/253974/07

Business location: Johannesburg, Gauteng, South Africa

Privacy and Information Officer enquiries: [email protected]

Telephone: +27 69 409 9449

2. Personal information we may collect

·     Identity and contact details, such as a name, company, role, email address, telephone number and business address.

·     Enquiry and project information, including briefs, budgets, dates, locations, communications, approvals, contracts and preferences.

·     Production information, including call sheets, crew or supplier details, contributor and talent information, releases, photographs, audio, video footage and other content captured for a project.

·     Billing and transaction information, including invoices, payment status and limited payment-related records. Full card details are handled by the payment provider and are not supplied to Virentum when Payfast processes the payment.

·     Website and device information, such as IP address, browser, device, referring page, pages viewed, approximate location, cookie identifiers and advertising or conversion data.

·     Supplier, crew, recruitment and compliance information, such as experience, rates, tax or company details, banking information where required for payment, references and production credentials.

3. How information is collected

Information may be collected directly from the person, from an authorised client or agency, from a production participant or supplier, through website forms, email, telephone, WhatsApp, social media, Payfast, invoices, contracts, project platforms, public sources or referrals. If information is obtained from another source, Virentum will process it only where this is permitted and reasonably expected in the circumstances.

4. Why we process personal information

·     Responding to enquiries, preparing quotations and communicating about services.

·     Planning, producing, editing, delivering and administering creative and production projects.

·     Managing bookings, suppliers, crew, talent, equipment, locations, access, safety and releases.

·     Processing payments, issuing invoices, keeping records and preventing fraud or abuse.

·     Providing customer support, handling changes, complaints, refunds and disputes.

·     Operating, securing, measuring and improving the website, advertising and services.

·     Complying with legal, regulatory, tax, accounting, insurance and contractual obligations.

·     Sending relevant marketing where legally permitted, with an easy way to opt out.

5. Legal grounds

Virentum processes personal information where this is necessary to enter into or perform a contract, comply with law, protect a legitimate interest of Virentum or another person, establish or exercise a legal right, protect a vital interest, or where valid consent has been given. Consent may be withdrawn, but withdrawal does not invalidate lawful processing that occurred before withdrawal.

6. Voluntary and mandatory information

Supplying information is usually voluntary. Certain information is required to provide a quotation, confirm a booking, process a payment, issue an invoice, arrange access, comply with safety or legal requirements, or deliver a project. If required information is not supplied, Virentum may be unable to provide the requested service or allow participation in a production.

7. Payments

Online payments may be processed by Payfast by Network. Payment providers, banks and card schemes process payment data under their own legal and security obligations. Virentum receives transaction confirmation and related administrative information but does not receive or store the payer's full card number where the payment provider hosts or processes the payment. Customers should also review Payfast's own privacy and security information.

8. Cookies, analytics and advertising

The website may use necessary cookies and similar technologies for security and functionality, and optional analytics or advertising technologies to measure visits, enquiries and advertising performance. Virentum's current website infrastructure may use LeadConnector/HighLevel services, Google Ads conversion tracking, embedded video services and links to social or messaging platforms.

Where consent is required, optional cookies should be activated only after the visitor's choice. A visitor can use the website's cookie controls when available and can also manage cookies in the browser. Blocking some technologies may affect functionality. Third parties may process identifiers, device data and interaction information under their own privacy policies.

9. Sharing personal information

Virentum may share relevant personal information only as reasonably necessary with:

·     employees, authorised contractors, production crew, editors, photographers, suppliers and professional advisers;

·     clients, agencies, venues, talent representatives and project partners involved in the applicable production;

·     Payfast, banks, accounting platforms and payment or fraud-prevention providers;

·     website hosting, CRM, cloud storage, file-transfer, email, communications, analytics, advertising and IT providers;

·     insurers, auditors, legal advisers, regulators, courts or public authorities where required or lawfully permitted; and

·     a buyer, successor or adviser involved in a legitimate business restructuring, subject to appropriate safeguards.

Virentum does not sell personal information.

10. Operators and safeguards

Service providers that process personal information for Virentum are expected to protect it, maintain appropriate confidentiality and security, and use it only for the authorised service. Access is limited to people who reasonably need the information for their work.

11. Cross-border processing

Some cloud, website, email, advertising, payment or file services may process information outside South Africa. Where personal information is transferred across borders, Virentum will take reasonably practicable steps to ensure that the transfer is permitted by POPIA, including through an adequate legal framework, binding agreement, consent or another lawful basis where required.

12. Security

Virentum uses reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved. These may include access controls, secure payment providers, device and account security, backups, restricted project access and contractual confidentiality. No online system can be guaranteed completely secure.

If Virentum has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, it will investigate and make notifications required by POPIA as soon as reasonably practicable.

13. Retention

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, an agreed project-storage period, legitimate evidentiary or business needs, or a period required by law. When retention is no longer authorised or necessary, information will be deleted, destroyed or de-identified as reasonably practicable.

Production footage and project files are operational assets and may have separate storage and deletion arrangements. Virentum does not guarantee indefinite retention of raw footage or project files unless agreed in writing.

14. Direct marketing

Virentum may send marketing communications where consent has been obtained or another legal permission applies. Every electronic marketing message will provide a practical way to opt out. A person may object to direct marketing at any time by using the unsubscribe method or emailing [email protected].

15. Children and minors

Virentum may process a child's image, voice or other personal information only where a competent person's consent or another lawful authorisation applies. For client-commissioned productions involving minors, the client and Virentum must agree who is responsible for obtaining and retaining the necessary parental or guardian permissions.

16. Your rights

Subject to POPIA and other applicable law, a data subject may:

·     ask whether Virentum holds personal information about them;

·     request access to that information and information about relevant recipients;

·     request correction, updating, deletion or destruction where legally permitted;

·     object to certain processing on reasonable grounds;

·     withdraw consent where processing is based on consent; and

·     lodge a complaint with the Information Regulator.

Requests should be sent to [email protected]. Virentum may require reasonable proof of identity and may refuse or limit a request where permitted by law, including where another person's rights or confidential information would be affected.

17. Information Regulator

A person may contact or lodge a complaint with the Information Regulator (South Africa):

·     Website: https://inforegulator.org.za

·     Telephone: 010 023 5200 | Toll-free: 0800 017 160

·     General email: [email protected]

·     POPIA complaints: use the Regulator's online complaint process or the prescribed Form 5 available on its website.

18. Changes to this Policy

Virentum may update this Policy to reflect changes in law, technology or business practices. The current version and effective date will be published on the website.