Your data, your rights

Privacy Policy

Effective date: 26 May 2026

01 — Who We Are

The Responsible Party

This website, stamer.co.za, is operated by Luke Stamer, a sole proprietor and professional cellist based in South Africa. Under the Protection of Personal Information Act 4 of 2013 (POPIA), Luke Stamer is the Responsible Party — the person who determines the purpose of and means for processing your personal information.

If you have any questions about this policy, or wish to exercise any of your rights, please get in touch:

02 — Scope

What This Policy Covers

This policy explains what personal information we collect when you use stamer.co.za, why we collect it, who we share it with, and what rights you have over it. It applies to all visitors, whether you are simply browsing, submitting a general enquiry, or requesting a booking quote.

This policy does not cover third-party websites that we may link to. Once you leave stamer.co.za, the privacy practices of those sites govern your experience there.

03 — Information We Collect

What We Collect and How

We only collect information that you actively provide to us, plus basic technical data that every web server receives automatically. We do not use tracking pixels, third-party analytics, or advertising networks.

Home page contact form

When you complete the contact form on our homepage, we collect:

  • First name and last name
  • Email address
  • Phone number (optional)
  • Enquiry type (wedding, private event, corporate event, fundraiser, or other)
  • Your message

Booking enquiry form at /book

When you submit a booking enquiry, we collect:

  • First name and last name
  • Email address
  • Phone number
  • WhatsApp number (optional — you may indicate this matches your phone number)
  • Event type
  • Preferred date (or indication that a date is not yet set)
  • Event location (free-text entry powered by Google Maps Places autocomplete — see section 6 below)
  • Approximate guest count
  • Desired performance duration in minutes
  • Message or additional notes

Server and access logs

Our hosting provider, Vercel, automatically records standard web server log data each time you request a page. This includes your IP address, browser type and version (user-agent string), the page you requested, the date and time of the request, and the HTTP status code returned. This data is used solely for performance monitoring and security purposes, and we do not use it to identify or profile individual visitors.

04 — Purpose of Processing

Why We Use Your Information

We use the information you provide exclusively to respond to your enquiry and, where relevant, to prepare and provide a performance quote or booking confirmation. Specifically, we use your details to:

  • Respond to general enquiries and answer questions about availability and repertoire
  • Prepare accurate quotations tailored to your event type, location, and duration requirements
  • Coordinate and confirm performance bookings and related logistics
  • Maintain a CRM record of our correspondence so that follow-up communications are efficient and nothing falls through the cracks
  • Send you a WhatsApp notification (internally, to Luke) so that new booking requests are actioned promptly

We do not use your information for automated decision-making, profiling, or unsolicited marketing communications. We will never sell your personal information to any third party.

05 — Lawful Basis

Our Legal Grounds for Processing

Under POPIA section 11, we process your personal information on the following grounds:

  • Consent: By submitting our contact or booking form, you voluntarily provide your information and consent to us using it to respond to your enquiry. You may withdraw this consent at any time by contacting us (see section 9 for your rights).
  • Legitimate interest / pre-contractual measures: Processing is necessary to take steps at your request prior to entering into a contract for performance services — for example, to calculate a quote or check availability.
  • Contractual necessity: Once a booking is confirmed, processing is necessary to fulfil our contractual obligations to you.

For visitors based in the European Union or European Economic Area, the equivalent lawful bases under GDPR Article 6 apply: Article 6(1)(a) (consent), Article 6(1)(b) (performance of a contract or pre-contractual steps), and Article 6(1)(f) (legitimate interests) where applicable. Our legitimate interests are to respond to genuine commercial enquiries and to manage our business records efficiently, and these interests are not overridden by your privacy rights given the limited and expected nature of the processing.

06 — Third-Party Processors

Who We Share Your Information With

We share your information only with the service providers listed below. Each receives only the data necessary to perform their function. We do not sell, rent, or trade your personal information with any other party.

  • Attio (USA) — Our customer relationship management (CRM) platform. Enquiry and booking form submissions are stored here so we can manage correspondence and follow-ups in one place. Attio Privacy Policy
  • WaSender (USA) — A WhatsApp notification service. When you submit a booking enquiry, a WhatsApp alert is sent to Luke's number so that new requests are actioned promptly. Your name and enquiry details are included in this notification. WaSender Privacy Policy
  • Google LLC — Maps Platform / Places API (USA) — The location field in the booking form uses Google's Places autocomplete service to help you select your venue accurately. Text you type into that field is sent to Google's servers in real time to generate suggestions. Google Privacy Policy
  • Vercel Inc. (USA) — Our hosting and deployment platform. Vercel processes server log data (IP address, user-agent) as a necessary part of serving the website. Vercel Privacy Policy
  • Sanity AS (USA / Norway) — Our headless CMS, used exclusively to manage blog content. Sanity does not process visitor personal data; it only serves published blog posts. Sanity Privacy Policy

We also load typefaces (Cormorant Garamond, Manrope, and Jost) via Google Fonts at page load. Google may log the request including your IP address. We do not receive any data from Google in relation to this. Google Privacy Policy

07 — Cross-Border Transfers

Transfer of Information Outside South Africa

As described above, all of our third-party processors are based in the United States of America. In terms of POPIA section 72, personal information may be transferred to a third country only if that country, territory, or international organisation ensures an adequate level of protection, or if the recipient is bound by binding corporate rules, contractual obligations, or equivalent measures that uphold the conditions of lawful processing comparable to POPIA.

Each processor listed in section 6 above maintains data processing agreements (DPAs) and contractual safeguards — including standard contractual clauses where required under GDPR — that provide equivalent protections. By submitting a form on this website, you acknowledge that your personal information will be transferred to and processed in the United States under these protections.

08 — Retention

How Long We Keep Your Information

We retain personal information for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. For booking and enquiry records, we follow the seven-year retention period aligned with South African Revenue Service (SARS) requirements for business records under the Tax Administration Act.

If your enquiry did not result in a booking and there is no ongoing business relationship, we may delete your information sooner upon request (see section 9). Server log data held by Vercel is subject to Vercel's own retention schedule and is outside our direct control, though we will facilitate requests to the extent we are able.

09 — Your Rights

Your Rights Under POPIA and GDPR

You have the following rights regarding your personal information. To exercise any of them, email luke@stamer.co.za with a clear description of your request. We will respond within a reasonable time and at no cost to you.

  • Right of access: You may request a copy of the personal information we hold about you.
  • Right to correction: You may ask us to correct any inaccurate or incomplete personal information.
  • Right to deletion (erasure): You may ask us to delete your personal information where we no longer have a lawful basis to retain it, subject to any overriding legal obligation (such as the seven-year retention period described above).
  • Right to object: You may object to processing based on legitimate interests. We will consider your objection and cease processing unless we have compelling grounds to continue.
  • Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
  • Right to data portability (GDPR): If you are in the EU/EEA, you may request your personal information in a structured, commonly used, machine-readable format.
  • Right to lodge a complaint: If you believe we have mishandled your personal information, you have the right to lodge a complaint with the South African Information Regulator:
    inforeg@justice.gov.za. EU/EEA residents may also complain to the supervisory authority in their member state.

10 — Cookies & Tracking

Cookies and Tracking Technologies

This website currently uses no tracking cookies, analytics cookies, or advertising pixels of any kind. We do not use Google Analytics, Meta Pixel, HotJar, or any similar third-party tracking service.

The only external network requests made on page load are to Google Fonts (to load our typefaces) and, on the booking page, to the Google Maps Places API as you type in the location field. Neither of these sets first-party cookies via this site. Should we introduce any cookies or tracking technologies in the future, we will update this policy, add an appropriate notice, and obtain consent where required.

11 — Client Testimonials

Use of Client Communications for Marketing

We may from time to time quote positive feedback and kind words you share with us — for example, messages sent after a performance — on our website or social media as testimonials. By default, we do this in an anonymised form: we may include your first name only, your event type, or a general descriptor (e.g. “wedding client”), without any information that would identify you to a third party.

If we wish to publish a testimonial that includes your full name, photograph, social media handle, or any other directly identifiable information, we will first seek your separate, explicit written consent before doing so. No identifiable testimonial will be published without that consent.

You may opt out of having your feedback used in any form — anonymised or otherwise — at any time by emailing luke@stamer.co.za. We will remove any existing quotes promptly upon request. This clause mirrors the corresponding provision in our Terms of Service.

12 — Children

Children's Privacy

This website is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and you believe your child has submitted personal information through this site, please contact us immediately at luke@stamer.co.za and we will delete that information without delay.

13 — Policy Updates

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make a material change, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of the website after any update constitutes acceptance of the revised terms.

If we introduce new data collection practices — such as analytics cookies or a newsletter — we will update this policy before those practices begin and will obtain any necessary consent.

14 — Contact

Get in Touch

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal information, please contact us directly — we are happy to help.

You also have the right to lodge a complaint with the South African Information Regulator if you believe your personal information has not been handled in accordance with POPIA: inforeg@justice.gov.za.