Purpose of this manual
This POPIA Information Manual explains how CTRL CUT CO collects, processes, stores, protects and manages personal information in connection with its website, business operations, creative services and professional relationships.
The Manual is intended to provide transparency regarding our personal-information processing activities and explain the rights available to individuals and organisations under applicable South African law.
This Manual should be read together with our Privacy Policy, Cookie Policy, Website Terms & Conditions and PAIA Manual.
Where this Manual provides general information, our obligations remain subject to POPIA and other applicable law.
Company and information officer details
Legal entity: Ctrl Cut Co (Pty) Ltd
Registration no.: 2026/243068/07
Website: https://ctrlcutstudio.co.za/
Sherwin Naidoo
Email: sherwin@ctrlcutstudio.co.za
Deputy Information Officer: Kineshea Pillay
Email: kineshea@ctrlcutstudio.co.za
General privacy enquiries: info@ctrlcutstudio.co.za
The Information Officer is responsible for facilitating compliance with applicable
information-protection obligations and coordinating requests relating to personal
information.
The Deputy Information Officer assists with these responsibilities in accordance with the
company's formal designations and applicable law.
Scope and application
This Manual applies to personal information processed by CTRL CUT CO in connection with:
- Website visitors and enquiries.
- Prospective and existing clients.
- Suppliers, contractors and production partners.
- Employees and authorised personnel.
- Marketing and business development.
- Creative development and production services.
- Client-supplied footage, photography, audio and related materials.
- Administrative, financial and regulatory obligations.
CTRL CUT CO may act as a responsible party for personal information processed for its own business purposes.
Where the company processes information on a client's instructions and on that client's behalf, CTRL CUT CO may act as an operator under POPIA.
The company's legal responsibilities depend on the nature and purpose of the processing and the actual relationship between the parties.
Categories of personal information
Depending on the nature of the relationship, CTRL CUT CO may process:
4.1 Business and contact information
Names, email addresses, telephone numbers, company details, job titles, professional roles and correspondence.
4.2 Commercial and financial information
Quotations, contracts, invoices, billing details, payment records and related business documentation.
4.3 Project and production information
Creative briefs, project records, production schedules, feedback, approvals, deliverables, footage, photographs, audio recordings, interviews and other project assets.
4.4 Website and technical information
IP addresses, browser and device information, website interactions, cookie identifiers, analytics data and marketing preferences.
4.5 Personnel and supplier information
Identification information, professional qualifications, contact details, remuneration information, contracts, tax records and other information reasonably necessary for employment, contractor or supplier administration.
4.6 Third-party information contained in production material
Images, voices, likenesses and other personal information relating to persons appearing in client-supplied media.
We seek to limit collection and processing to information that is relevant and reasonably necessary for an authorised purpose.
Conditions for lawful processing
CTRL CUT CO recognises the eight conditions for lawful processing established by POPIA:
5.1 Accountability
The company is responsible for ensuring compliance with POPIA when acting as a responsible party.
5.2 Processing limitation
Personal information must be processed lawfully, reasonably and in a manner that does not unjustifiably infringe privacy.
5.3 Purpose specification
Personal information must be collected for a specific, explicitly defined and lawful purpose and retained only as permitted by law.
5.4 Further processing limitation
Further processing must be compatible with the original purpose or otherwise permitted by POPIA.
5.5 Information quality
Reasonably practicable steps will be taken to ensure that personal information is accurate, complete, not misleading and updated where necessary.
5.6 Openness
Relevant information about the collection and use of personal information will be provided in accordance with applicable notification requirements.
5.7 Security safeguards
Appropriate and reasonable technical and organisational measures must be maintained to protect personal information against loss, damage, unauthorised access and unlawful processing.
5.8 Data subject participation
Individuals and organisations may exercise applicable rights to access, correct, object to or request deletion of their personal information.
Purposes of processing
Personal information may be processed for the following purposes:
6.1 Responding to website enquiries and requests for information.
6.2 Conducting client discovery, evaluating briefs and preparing proposals.
6.3 Preparing quotations, scopes of work and contractual agreements.
6.4 Delivering creative direction, editing, motion design, animation, CGI, post-production and associated services.
6.5 Managing projects, communications, approvals and delivery.
6.6 Administering supplier and production-partner relationships.
6.7 Managing financial records, invoices, payments and tax obligations.
6.8 Managing personnel, contractors and related administration.
6.9 Maintaining the website, its security, functionality and performance.
6.10 Conducting website analytics and measuring marketing activities.
6.11 Undertaking lawful marketing and business development.
6.12 Maintaining necessary records and meeting legal or regulatory obligations.
6.13 Managing disputes, claims and the protection of legal rights.
6.14 Supporting authorised AI-assisted creative, technical, research or administrative processes.
Processing will be based on consent where required, contractual necessity, legal obligations, legitimate interests recognised by POPIA or another lawful justification applicable to the circumstances.
Client-supplied production material
CTRL CUT CO may receive personal information contained in client-supplied footage, photographs, interviews, voice recordings, employee communications, live-event content and other production assets.
Where CTRL CUT CO processes such material as an operator acting on a client's instructions, the client will ordinarily remain the responsible party for determining the lawful purpose and basis for collecting and providing the information.
Clients are responsible for securing applicable permissions, consents, releases, licences and other required authorisations for material they supply.
CTRL CUT CO will process such material in accordance with applicable law, contractual obligations and authorised project requirements.
Access to production information will be restricted where appropriate, and confidential or restricted material will not be intentionally disclosed for unrelated purposes without an appropriate lawful basis.
Children and special personal information
CTRL CUT CO does not intentionally request personal information relating to children or special personal information through its ordinary website enquiry process.
Such information may nevertheless be contained in legitimate client-supplied production material.
Where this occurs, the information will be processed only where permitted by law and subject to applicable contractual obligations, authorisations and safeguards.
Additional protections and lawful-processing requirements will be considered where information concerns children or falls within the categories of special personal information recognised by POPIA.
Marketing and direct communications
CTRL CUT CO may process relevant business contact information for client communications, supplier engagement, business development and marketing where permitted by applicable law.
Submitting a general enquiry does not automatically constitute consent to receive unrelated marketing communications.
Where unsolicited electronic direct marketing requires consent under POPIA, that consent will be obtained unless a lawful exception applies.
Recipients may object to direct marketing or withdraw consent where applicable.
Marketing communications will provide an appropriate means to request that further communications cease.
Limited suppression information may be retained to honour such requests.
Website analytics and cookies
CTRL CUT CO intends to use or test the following website measurement technologies in future, subject to appropriate implementation, privacy disclosures and consent controls where required:
Google Analytics (GA4)
When enabled, GA4 will be used to understand website traffic, visitor interactions, traffic sources and website performance.
Meta Pixel
Meta Pixel may be tested in future for Facebook and Instagram advertising measurement and related campaign and audience functions.
These technologies may process information such as online identifiers, IP addresses, device information and website interactions, depending on their configuration.
Where required, visitors will be offered appropriate choices regarding non-essential tracking.
Additional analytics or advertising technologies may be introduced in future. Their implementation will be subject to relevant privacy assessments and updates to the company's disclosures and consent arrangements where required.
Further information is provided in the Cookie Policy.
Third-party service providers and operators
CTRL CUT CO uses or may engage authorised third-party providers to support business administration, communication, creative production, project management, hosting, accounting and other legitimate activities.
These may include cloud productivity providers, creative software platforms, production tools, accounting services, professional advisers and external production partners.
Where personal information is disclosed to an authorised service provider, access will be limited to what is reasonably necessary for the relevant purpose.
Appropriate confidentiality, contractual, technical and organisational safeguards will be applied as required by POPIA and the nature of the processing.
Where a third party acts as an operator on behalf of CTRL CUT CO, the applicable requirements of POPIA concerning security and operator arrangements will be addressed.
Artificial intelligence and automated processing
CTRL CUT CO may use AI-assisted technologies in creative exploration, production, research, administration and technical workflows.
Where these activities involve personal information, the company will consider the purpose of processing, the sensitivity of the information, applicable contractual obligations and the safeguards associated with the relevant service.
Personal or confidential information will not be disclosed to external AI services without an appropriate lawful basis and consideration of relevant contractual restrictions.
Where client information is involved, any necessary client authorisation will be obtained.
The website does not currently represent itself as making solely automated decisions about individuals that produce legal or similarly significant effects.
Any future automated decision-making functionality will be assessed against applicable POPIA requirements.
Cross-border processing
Some of the technology and cloud service providers used by CTRL CUT CO operate outside South Africa.
Personal information may consequently be stored, transmitted, accessed or otherwise processed internationally.
Where personal information is transferred outside South Africa, CTRL CUT CO will seek to ensure that the transfer complies with section 72 of POPIA.
This may involve an appropriate legal basis, adequate protections, binding agreements, consent where valid and applicable, or other mechanisms permitted by law.
International processing arrangements will be considered when selecting and reviewing relevant service providers.
Security of personal information
CTRL CUT CO recognises the importance of protecting personal information from loss, damage, unauthorised access and unlawful processing.
Reasonable technical and organisational safeguards will be selected according to the nature of the information, foreseeable risks and the systems used.
Depending on the relevant system, safeguards may include:
- Access controls and permissions management.
- Authentication and account security.
- Multi-factor authentication.
- Confidentiality obligations.
- Secure communication and file-transfer methods.
- Security protections provided by cloud service providers.
- Backup, recovery and access-management procedures.
- Appropriate retention, archiving and deletion practices.
- Internal security awareness and incident-management procedures.
Security arrangements will be reviewed and adjusted where reasonably necessary.
No electronic storage or communication system can be guaranteed to be entirely free of risk.
Security compromises
Where CTRL CUT CO has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the incident will be assessed and handled in accordance with POPIA.
Where CTRL CUT CO acts as the responsible party, notifications will be made to the Information Regulator and affected data subjects as required by section 22 of POPIA.
Such notifications will be provided as soon as reasonably possible, subject to the circumstances and applicable legal requirements.
Where CTRL CUT CO acts as an operator on behalf of a client, relevant security compromises will be reported to the responsible party in accordance with applicable law and contractual obligations.
Appropriate measures will be taken to investigate incidents, reduce potential harm and address identified security weaknesses.
Retention and disposal
Personal information will be retained only for as long as reasonably necessary to fulfil its lawful purpose or where continued retention is required or permitted by law.
Retention periods may differ depending on the type of information, contractual requirements, statutory obligations, dispute-management requirements and legitimate archival purposes.
Where information is no longer required and no lawful basis for continued retention exists, reasonable steps will be taken to securely delete, destroy or de-identify it.
Project records, production assets and other client information will also be managed in accordance with applicable project agreements and internal production workflows.
Rights of data subjects
Subject to POPIA and other applicable law, data subjects may have the right to:
17.1 Be informed about relevant collection and processing of personal information.
17.2 Request confirmation of whether CTRL CUT CO holds their personal information.
17.3 Request access to their personal information.
17.4 Request correction of inaccurate, incomplete or misleading information.
17.5 Request deletion or destruction of information where legally appropriate.
17.6 Object to certain processing activities.
17.7 Withdraw consent where the processing is based on consent.
17.8 Object to direct marketing.
17.9 Exercise applicable rights relating to decisions based solely on automated processing.
17.10 Lodge a complaint with the Information Regulator.
17.11 Seek available legal remedies where their rights have been infringed.
Requests will be considered in accordance with applicable legal requirements, including lawful restrictions on disclosure and retention.
Exercising your rights
Requests relating to personal information may be directed to:
Information Officer: Sherwin Naidoo
Email: sherwin@ctrlcutstudio.co.za
General privacy enquiries: info@ctrlcutstudio.co.za
Requests should contain sufficient information to identify the requester and the information
or processing activity concerned.
Where reasonably necessary, CTRL CUT CO may request proof of identity or authority
before disclosing, correcting or deleting personal information.
Requests for correction, deletion or objection may be made using the forms prescribed by
the Information Regulator where applicable.
Formal access requests involving company records may also be subject to the procedures
set out in our PAIA Manual.
Complaints to the information regulator
A person who believes their personal information has been processed unlawfully may
contact CTRL CUT CO's Information Officer or lodge a complaint with the Information
Regulator.
Information Regulator (South Africa):
Website: https://inforegulator.org.za/
POPIA complaints: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
The Information Regulator is the independent statutory authority responsible for monitoring
and enforcing compliance with POPIA.
Information governance and review
CTRL CUT CO will review its personal-information processing arrangements as its services, systems, technology providers and legal obligations change.
Material changes affecting the company's handling of personal information will be reflected in its relevant privacy documentation.
The Information Officer will coordinate applicable compliance responsibilities, information requests, review activities and internal awareness in accordance with the company's governance arrangements and applicable law.
Changes to this manual
CTRL CUT CO may amend this Manual to reflect changes in its business practices,
information-processing activities, service-provider arrangements or legal obligations.
The latest approved version will be made available on the company's website.
Issued by:
Sherwin Naidoo
Chief Executive Officer and Information Officer
Ctrl Cut Co (Pty) Ltd
