Legal

Operator Agreement

Version 1.0 — effective 2026-08-06

This agreement applies whenever you use Lumière to store or manage personal information about other people — your clients, the people in your photographs, or anyone who signs a contract or receives an invoice. It forms part of our Terms of Service.

In POPIA terms: you are the responsible party for that information, and we are your operator. In GDPR terms: you are the controller and we are the processor.

1. What we process for you

Client names, email addresses, phone numbers, company names, billing addresses and notes; photographs and the metadata inside them; contracts, signer details and signature images; invoices, line items and payment records; project records.

2. Our undertakings

We will:

  • process this information only to provide Lumière to you, and only on your instructions — using the product is an instruction — unless the law requires otherwise, in which case we will tell you first if we are permitted to;
  • keep it confidential and make sure anyone with access is under a duty of confidentiality;
  • apply appropriate technical and organisational security measures, including those described in our Privacy Policy;
  • notify you without undue delay, and in any case within 48 hours, if we discover a breach affecting your data, with what we know and what we are doing about it;
  • help you respond to requests from data subjects, and to regulators, at no charge for reasonable volumes;
  • not appoint a new sub-processor without publishing it in our Privacy Policy 30 days beforehand, and you may object;
  • delete your data within 30 days of you closing your account or asking us to, except where the law requires us to keep it;
  • on reasonable notice and no more than once a year, give you the information you reasonably need to show you are meeting your own obligations.

3. Sub-processors

The current list is in section 4 of our Privacy Policy. Each is bound by terms no less protective than these.

4. Cross-border transfers

Our providers process data outside South Africa. Section 5 of our Privacy Policy sets out the grounds we rely on. Where EU or UK personal data is involved, the Standard Contractual Clauses apply, and this agreement incorporates them.

5. Your undertakings

You confirm that:

  • you have a lawful basis to collect and upload everything you upload;
  • you have told the people concerned that their information and photographs will be stored and delivered using a third-party platform;
  • where photographs include children, you hold the consent of a parent or guardian — and you accept that section 34 of POPIA places particular restrictions on children’s information;
  • you will not upload special personal information (health, biometric, religious, political, trade union, criminal or sexual-life information as defined in section 26 of POPIA) unless you have a lawful basis under section 27, and you accept that Lumière is not designed for it;
  • you will deal with requests from your own clients about their information, and we will help where we can.

6. Liability

The limits in section 9 of our Terms of Service apply to this agreement.

7. Contact

Eternity Photography (Pty) Ltd, 282 Tryall Road, Cape Town, 7441. Information Officer: Emilio Chanderdutt, eternitysoftwaresolutions.16@gmail.com.