Privacy Policy

1. Who we are

Third Vision Studios is a photography, videography, livestreaming, branding, digital-marketing and event-media studio operating from Karatina, Kenya and serving clients across Kenya and beyond. For personal data used for our own business purposes, we act as the data controller. For some client-led productions, we may process event data only on the Client's documented instructions and act as a data processor.

2. Scope of this policy

This policy applies when you use our website, send an enquiry, call or message us, request a quote, make a booking, provide material for a project, receive deliverables, visit our studio, attend an event we cover, appear in commissioned media or communicate with us about our services.

A client or event organiser may have a separate privacy notice explaining how they use event media. Where that organiser determines why and how we process the material, you should also read its notice.

3. Personal data we collect

Enquiry and client data

• name, phone number, email address and preferred contact method;
• event date, event type, venue, services requested, message and project brief;
• organisation, billing details, transaction references, invoices and payment status;
• communications, approvals, feedback, complaints and records of agreed instructions; and
• names, roles and contact details of coordinators, suppliers or participants supplied for production.

Media and production data

• photographs, video, livestream footage, voice, music, speeches, interviews and performances;
• names, likenesses, event details, captions and other information connected to the media;
• brand files, logos, documents, scripts, presentations and creative material supplied to us; and
• technical project information such as file metadata, edit notes and delivery records.

Website and technical data

• internet protocol address, browser or device information, request time, referring page and server security logs;
• enquiry-form submissions and the page from which an enquiry was sent; and
• admin session information and cookie or browser-storage preferences described in our Cookie Policy.

We do not request full payment-card details through this website. A bank, mobile-money operator or other payment provider processes payment information under its own terms.

4. How we collect personal data

We collect data directly from you when you complete a form, call, email, use WhatsApp, visit the studio, approve work or participate in production. We may also receive it from the Client or event organiser, family representatives, venues, authorised coordinators, referral partners, public social-media pages, livestream platforms and payment providers.

At events, images and sound are collected through our cameras, microphones, recording equipment and production systems. Where practical, the organiser should use invitations, announcements or venue signage to tell attendees about the coverage.

5. Why we use data and our lawful handling

Depending on the context, we process personal data because it is necessary to take steps at your request or perform a contract, because we have consent, because we must comply with law, or because we have a legitimate business interest that does not override the rights and freedoms of the people affected.

We use personal data to:

• respond to enquiries, prepare quotes and manage bookings;
• plan, capture, edit, livestream, deliver and support media projects;
• communicate about schedules, approvals, payments and deliverables;
• operate event screens and coordinate venues, crew and suppliers;
• process payments, keep financial records and meet tax or legal obligations;
• secure the website, prevent spam or misuse and administer restricted systems;
• handle requests, feedback, disputes and legal claims; and
• show commissioned work in our portfolio or promotions only where the appropriate consent has been obtained.

Where processing relies on consent, you may withdraw that consent for future processing. Withdrawal does not make earlier lawful processing unlawful and may affect our ability to provide a requested service.

6. Photography, video and event content

Event media can identify attendees and may incidentally reveal information such as family relationships, religion, health, disability or other sensitive circumstances. We limit capture and use to the agreed production purpose and use additional care for funerals, worship, private family events and similar contexts.

The Client or event organiser is normally responsible for telling attendees that photography, recording or livestreaming will take place and for securing permissions required for the planned use. We will support reasonable measures such as camera-free areas, exclusion requests or editing instructions where they are communicated in time and are technically feasible.

We do not use identifiable commissioned media for our own portfolio, website, social media, showreel or marketing without consent. A person asking to be removed from future promotional use should contact us with enough detail to identify the material. Removal may not be possible from a completed private delivery, a live broadcast already viewed, or material another controller independently published.

7. Who we share personal data with

We do not sell personal data. We share only what is reasonably needed with:

• the Client, authorised family or organisational contacts, and intended recipients of deliverables;
• our crew, editors, camera operators, designers, technicians and approved subcontractors;
• website hosts, email and messaging services, secure cloud storage, file-transfer and delivery providers;
• banks, mobile-money operators, accountants and payment-service providers;
• venues, equipment suppliers, connectivity providers and production partners where coordination requires it;
• Facebook, YouTube or another platform selected by the Client for livestreaming or publication; and
• professional advisers, insurers, regulators, law-enforcement bodies or courts where disclosure is legally required or necessary to establish or defend a legal claim.

Service providers are expected to protect the data, use it only for authorised purposes and apply appropriate confidentiality and security measures.

8. How long we keep data

We keep personal data only as long as reasonably necessary for the purpose collected, including delivery, client support, legal compliance, accounting, dispute handling and agreed archiving. Retention depends on the type of record:

• unsuccessful enquiries are reviewed and removed when no longer useful for responding or record-keeping;
• booking, invoice and transaction records are retained for the period required by Kenyan tax, accounting and legal obligations;
• working and delivered media are kept for the project period and any reasonable production or archival period agreed with the Client;
• portfolio copies are retained while the relevant consent remains valid and the use remains appropriate; and
• security logs, admin sessions, backups and consent preferences follow shorter operational cycles or are cleared when no longer needed.

At the end of the applicable period, we delete, securely destroy or anonymise data, subject to backup cycles and any legal requirement to preserve it.

9. Security

We use proportionate administrative, physical and technical safeguards, including access controls, restricted admin sessions, trusted service providers, secure transfer methods, backups and staff or crew confidentiality expectations. No online transmission or storage system is completely secure, but we review risks and take reasonable steps to prevent unauthorised access, loss, alteration or disclosure.

If a personal-data breach creates a legal notification obligation, we will notify the Office of the Data Protection Commissioner and affected people as required.

10. Your data-protection rights

Subject to the Data Protection Act, 2019 and applicable exceptions, you may have the right to:

• be informed about how your personal data is used;
• request access to personal data we hold about you;
• ask us to correct inaccurate or misleading data;
• object to or request restriction of certain processing;
• request deletion where the data is no longer necessary or is being processed unlawfully;
• request portability of qualifying data;
• withdraw consent where consent is the basis for processing; and
• complain to the Office of the Data Protection Commissioner.

Send a request to director.laban@gmail.com. Describe the data or event concerned and the right you wish to exercise. We may ask for information needed to confirm identity, authority and the relevant material. We will respond within the period required by applicable law.

Rights may be limited where complying would adversely affect another person's rights, conflict with a legal obligation, undermine a legal claim, or require deletion of material we process only for another controller. In that case, we will explain the applicable position where permitted.

11. Children

Our website and enquiry services are intended for adults. We do not knowingly invite children to submit booking or payment information directly.

Children may appear in family, school, church, public or private event media. The Client or organiser must obtain permission from a parent or guardian where required and tell us about any child who should not be photographed, recorded, streamed or published. We process children's data in their best interests and do not use it for direct marketing or profiling.

12. International platforms and transfers

Some cloud, email, file-delivery, social-media and livestream providers may process or store information outside Kenya. Where personal data is transferred internationally, we use an applicable lawful basis and take reasonable steps to ensure appropriate safeguards, necessity or valid consent as required by Kenyan law.

If a Client directs us to publish or livestream through an international platform such as Facebook or YouTube, that platform also processes data under its own privacy terms and may make the content accessible in other countries.

13. Cookies and external services

Our current website does not use analytics or advertising cookies. It uses an essential restricted-admin session cookie and stores your cookie-consent preference in a first-party cookie and local storage. Embedded Google Maps content is blocked until you allow it. Google Maps, Facebook, Instagram, YouTube, WhatsApp and other linked services may receive device or usage information under their own policies when their content loads or you interact with them. See our Cookie Policy for details.

14. Contact and complaints

Questions, requests and privacy complaints should be sent to:

We ask that you contact us first so we can investigate. You may also lodge a complaint with Kenya's Office of the Data Protection Commissioner.

15. Updates to this policy

We may update this policy when our services, technology or legal obligations change. We will publish the revised policy on this page and change the "Last updated" date. Where a change materially affects existing consent-based processing, we will seek fresh consent where required.