PRIVACY
POLICY.

Ctrl Cut Co (Pty) Ltd (“CTRL CUT CO”, “we”, “us” or “our”) respects the privacy of visitors, prospective clients, clients, suppliers and other persons whose personal information we process.

This Privacy Policy explains how we collect, use, store, share and protect personal information in connection with the CTRL CUT CO website at https://ctrlcutstudio.co.za/, enquiries submitted through the website, our marketing activities and related business communications.

This Policy is intended to support our obligations under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Our Information Officer is:

Sherwin Naidoo Chief Executive Officer and Information Officer Email: sherwin@ctrlcutstudio.co.za

General enquiries may be directed to info@ctrlcutstudio.co.za

Depending on how you interact with us, we may collect information including your name, email address, telephone number, company or organisation name, job or professional information, services you are interested in, project information, correspondence and information you voluntarily include in an enquiry.

Where a commercial relationship develops, we may also process quotation information, contractual information, billing details, project records, communications and other information required to deliver our services.

Our website and associated technologies may collect technical information such as IP address, browser and device information, website activity, referring pages, advertising identifiers and cookie information.

We generally collect personal information directly from you when you contact us, submit an enquiry, communicate with our team or enter into a business relationship with us. We may also receive relevant professional or business contact information from referrals, clients, suppliers, publicly accessible business sources or other lawful sources.

Providing personal information through a general website enquiry is voluntary. However, certain information may be necessary for us to respond to your enquiry, prepare a quotation, enter into a contract, deliver services or comply with legal obligations.

Where information is required for a contractual or legal purpose, failure to provide it may prevent us from proceeding with the relevant request, service or transaction. Where particular information is required by law, we will identify the applicable requirement where appropriate.

CTRL CUT CO provides post-production, motion design, animation, visualisation, creative-direction and brand strategy services.

As a result, clients may provide us with footage, photographs, voice recordings, interviews, event recordings, employee information and other material containing personal information.

Where we process personal information on behalf of a client and in accordance with that client's instructions, CTRL CUT CO may act as an operator under POPIA. The client will ordinarily remain the responsible party for determining the lawful basis and purposes of that processing.

Clients are responsible for ensuring that material supplied to us has been lawfully collected and that all necessary permissions, notices, consents, releases and other applicable rights have been obtained.

CTRL CUT CO will process such information in accordance with applicable law, relevant contractual obligations and documented client instructions, subject to any independent legal obligations that apply to us.

Where third-party service providers or production partners require access to personal information for an authorised project purpose, we will take reasonable steps to ensure that appropriate confidentiality, access control and data protection arrangements are in place.

We do not intentionally request children's personal information or special personal information through our website. Such information may nevertheless occur incidentally in legitimate client-supplied production material.

We may process personal information to respond to enquiries, assess potential projects, prepare proposals and quotations, communicate with clients, provide services, manage projects, process payments and accounting records, maintain client and supplier relationships, comply with legal and regulatory requirements, protect our legal rights, maintain our systems and improve our website and services.

We may also process information for analytics, measurement and marketing where permitted by law and, where required, with the appropriate consent.

Submitting an enquiry, requesting a quotation or communicating with CTRL CUT CO does not automatically constitute consent to receive marketing communications.

We may use business contact information to respond to enquiries, communicate about existing business relationships and undertake lawful business development activities.

Where electronic communications constitute direct marketing under POPIA, we will obtain consent where required or rely on an applicable exception permitted by law, including the limited circumstances relating to existing customers.

Where permitted, we may contact existing customers about our own similar services, provided the applicable legal requirements and opportunities to object have been satisfied.

Marketing communications will identify CTRL CUT CO and provide an appropriate means of requesting that further marketing communications cease.

Where you have subscribed to marketing communications, you may withdraw your consent or unsubscribe at any time by using the available unsubscribe mechanism or contacting info@ctrlcutstudio.co.za.

We may retain limited suppression information where reasonably necessary to honour opt-out requests and prevent further unwanted marketing communications.

Our website may use cookies and similar technologies for functionality, security, analytics, performance and marketing.

Depending on the technologies enabled on our website, we may use essential cookies, analytics services and, where applicable, advertising or measurement technologies.

Non-essential cookies and tracking technologies will be subject to the consent or preference controls required by applicable law.

Details of the cookies and technologies in use, their purposes and available controls are provided in our Cookie Policy.

We use third-party service providers where reasonably necessary to operate our business.

These may include Google Workspace, Gmail and Google Drive; Microsoft 365; WeTransfer; Frame.io; Webflow; Adobe; ClickUp; Xero; Calendly; WhatsApp; OpenAI/ChatGPT; cloud storage and rendering providers; TaxAssist; hosting, analytics and advertising providers; and professional or technical service providers.

These service providers may process information on our behalf or provide platforms through which information is stored, transmitted or accessed.

We seek to use appropriate contractual, organisational and technical safeguards where reasonably required.

We may engage authorised external creative specialists, production partners and technical service providers where required to deliver agreed services. Access to personal information

will be limited to what is reasonably necessary for the relevant purpose and subject to appropriate confidentiality and data protection arrangements.

We remain responsible for meeting our applicable obligations under POPIA, including where personal information is processed on our behalf by an operator.

CTRL CUT CO may use artificial-intelligence-assisted technologies in creative production, research, administration, technical development and internal business processes.

Where AI-assisted services involve personal information, we will assess the purpose and necessity of the processing, the nature of the information, applicable client agreements and the safeguards offered by the relevant service provider.

We will take reasonable steps to minimise unnecessary disclosure of personal or confidential information, restrict access where appropriate and apply relevant contractual and organisational safeguards.

Where client-supplied confidential material or personal information is involved, its use with third-party AI services will be subject to applicable law, contractual restrictions and any necessary client authorisation.

We do not use the website to make solely automated decisions about individuals that produce legal or similarly significant effects.

Some of the technology providers we use operate internationally and may store, route, support or otherwise process information outside South Africa.

Where personal information is transferred outside South Africa, CTRL CUT CO will seek to do so in accordance with section 72 of POPIA and through an appropriate lawful mechanism, contractual safeguard, adequate protection, consent or other basis permitted by law.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or where continued retention is required or permitted by law, contract, legitimate business requirements, dispute management or regulatory obligations.

An enquiry that becomes an active client, project, supplier or commercial relationship may therefore be retained longer than an enquiry that does not progress.

Financial, corporate, tax, contractual and employment-related records may be retained for statutory periods applicable to those records.

Production material and project records are retained according to project requirements, contractual commitments, legitimate archival needs and our production workflows, after which they may be securely deleted or archived.

Where personal information is no longer required and no lawful basis for continued retention applies, we will take reasonable steps to securely delete, destroy or de-identify it, subject to applicable legal, contractual and technical requirements. Where information is retained for archival or backup purposes, appropriate access and security restrictions will continue to apply.

We use reasonable technical and organisational measures appropriate to the nature of the information and the systems concerned.

These measures may include access controls, authentication, permissions management, security measures supplied by our cloud providers, malware protection, backups, secure transmission technologies and internal access restrictions.

No internet-based system can be guaranteed to be completely secure.

Where we become aware of a security compromise involving personal information, we will assess the incident and take appropriate steps to contain, investigate and address it. Where required under POPIA, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with applicable legal requirements.

Where we act solely as an operator processing personal information on behalf of a client, we will notify the responsible party of a relevant security compromise in accordance with POPIA and applicable contractual obligations.

Subject to POPIA and other applicable law, you may request confirmation of whether we hold personal information about you, request access to that information, request correction or deletion where appropriate, object to certain processing, withdraw consent where processing is based on consent, or lodge a complaint regarding our processing.

Requests relating to personal information may be directed to:

Information Officer: Sherwin Naidoo Company: Ctrl Cut Co (Pty) Ltd Email: sherwin@ctrlcutstudio.co.za General enquiries: info@ctrlcutstudio.co.za

We may request reasonable information to verify your identity or authority before disclosing or changing personal information. Requests will be considered in accordance with POPIA, PAIA and other applicable law.

You also have the right to lodge a complaint with the Information Regulator (South Africa).

Information Regulator: Website: https://inforegulator.org.za Email for POPIA complaints: POPIAComplaints@inforegulator.org.za Telephone: 010 023 5200

Formal requests for access to records may additionally be subject to the Promotion of Access to Information Act 2 of 2000 (PAIA) and our PAIA Manual.

We may update this Privacy Policy when our systems, services, legal obligations or business practices change.

The current version of this Privacy Policy is published on this page.