Your information, handled with care.

This notice explains what personal information is collected through this website, why, and what rights you have over it. It is written to align with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

1. Who’s responsible

This site is operated on behalf of Gabyriella Groenewald. Questions about personal information, access requests, or complaints can be directed via the Contact page or by Instagram DM.

2. What I collect

• Booking form: your name, email address, optional phone number, preferred date, project type, and whatever you type into the message field. This is collected only when you submit the form on the Book page.
• Anonymous page views: a timestamp and the relative URL you visited (e.g. /portfolio). No cookies are stored, no IP address is recorded, no user-agent string, no account linkage.The data is purely aggregate — “the Portfolio page was visited 34 times last week” — and helps shape which shoots are featured.

I do not use Google Analytics, Meta Pixel, advertising cookies, or third-party trackers of any kind.

3. Why I collect it

• Booking enquiries: so I can reply, discuss your brief, and confirm (or politely decline) a date. Lawful basis: your consent by submitting the form plus the legitimate interest of running a modelling career.
• Page views: to understand which pages and shoots people find interesting, without knowing anything about the people themselves.

4. Who sees it

Only me and, if needed, the person who maintains this site for me (a family friend). Nothing is sold, shared, or handed to any third party for marketing. The site is self-hosted on a private server in South Africa — no cloud analytics provider touches the data.

5. How long it’s kept

• Booking requests: kept for up to 24 months after your enquiry so that repeat bookings are smoother. Deleted on request.
• Page view records: auto-deleted after 180 days.
• Email correspondence:kept in my normal inbox, subject to the email provider’s retention.

6. Your rights under POPIA

You have the right to:

• ask what personal information I hold about you;
• request that it be corrected if it’s wrong;
• request deletion (“right to be forgotten”) — I’ll action this within 30 days;
• object to any further processing;
• complain to the Information Regulator of South Africa if you believe your rights have been infringed.

7. Security

The site uses HTTPS end-to-end (Let’s Encrypt). Booking requests are stored in an access-controlled database — only signed-in admin accounts can read them. Passwords are hashed (not stored in plaintext). If a data breach happens, I’ll notify anyone affected and the Information Regulator as POPIA requires.

8. Children

The booking form is aimed at adults acting for clients or agencies. If you’re under 18 please ask a parent or guardian before submitting.

9. Changes to this notice

If anything material changes, I’ll update the “Last updated” date at the top and — for significant changes — flag it on the home page.