What we collect, why, and how to get rid of it.

01 · Who we are

AYCAS Studios is a trading name of AYCAS Investments (Pvt) Ltd, a company registered in Zimbabwe (Reg. No. 56514A0282025), of Rosedale, 208–209 Sam Nujoma Street, Harare, Zimbabwe. For the purposes of this policy, we are the data controller for any personal information you share with us directly.

02 · What we collect

We only collect information you give us, or information that is generated automatically when you visit this site.

From our enquiry form or emails to us:

• Your name and email address
• Your company or artist name
• Your role and the nature of your brief
• Indicative budget, timing, referral source, preferred contact channel
• Anything else you choose to tell us in free text

From visiting the site:

• Aggregated, anonymous analytics (page views, country, referrer, device type) via Cloudflare Web Analytics — no cookies, no user fingerprinting, no third-party tracking
• Server logs held for a limited period for security and abuse detection

We do not collect, from this site:

• Payment information (we don't take payments on the site)
• Advertising cookies or third-party marketing pixels
• Cross-site identifiers
• Any sensitive personal data (health, biometric, political, etc.)

03 · How we use your information

Short answer: to respond to you, and to run the engagement if it turns into one.

• Enquiry response. Your enquiry is triaged by the AYCAS Studios team, reviewed by the Principal, and answered within two business days.
• Engagement delivery. If you become a client, we use the information necessary to deliver the engagement — per the signed Scope of Work and our published Data Handling & Confidentiality Policy.
• Service improvement. We look at aggregated analytics to see what's working on the site. Not at individual visitors.

We do not use your information to train external AI models, sell it, rent it, or share it with advertising networks. Ever.

04 · Legal basis

Under applicable data protection law (including Zimbabwe's Data Protection Act and South Africa's Protection of Personal Information Act), our legal basis for processing your personal data is one or more of:

• Consent — you gave it by sending us the enquiry
• Contract — we need the information to deliver a service you've asked for
• Legitimate interest — running and protecting our business (e.g. security logs)
• Legal obligation — where we're required to retain information by law or tax regulation

05 · Who we share it with

Only with the minimum set of people and systems needed to respond to you and deliver the work.

• Our engagement team — named specialists under confidentiality obligations.
• Infrastructure providers — Google Workspace (email & drive), Cloudflare (DNS, hosting, analytics). Each operates under its own data-processing terms.
• Professional advisors — legal, accounting, banking — where necessary and under confidentiality.
• Regulators — only if we are legally required to.

We do not sell your data to anyone. We do not swap it for marketing lists. We do not include it in any "data partnership" programme.

06 · How long we keep it

• Unanswered enquiries — retained for twelve months, then deleted, unless you've asked us to keep in touch.
• Active engagements — retained for the duration of the engagement plus three years, per our Data Handling & Confidentiality Policy, solely for audit, reference, and tax purposes.
• Invoicing & tax records — retained as long as applicable tax law requires.
• Analytics logs — retained for thirty days, aggregated and anonymous thereafter.

07 · Your rights

You have the right to:

• Access the information we hold about you
• Correct anything that's wrong
• Delete your information where we're not legally required to keep it
• Restrict or object to how we use it
• Port your information to another provider on request
• Withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, email [email protected]. We'll respond within five business days.

08 · Security

All data in transit is encrypted over TLS. Data at rest is protected by Google-managed encryption. Two-factor authentication is enforced on every account with access to client or enquirer data. We review access quarterly. We don't store passwords in our documents. We publish a written incident response commitment in our Data Handling & Confidentiality Policy.

09 · International transfers

Our primary infrastructure (Google Workspace, Cloudflare) operates globally, which may mean your data is processed outside your country of residence. Both providers meet internationally recognised data protection standards and operate under appropriate cross-border safeguards.

10 · Children

This site is not directed at children under 16 and we do not knowingly collect personal data from children. If you believe a child has sent us information, email [email protected] and we'll delete it.

11 · Complaints

If you think we've mishandled your data, raise it with us first — we'd rather hear from you than from a regulator. Email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

12 · Changes to this policy

If we update this policy, we'll bump the effective date at the top and keep the previous version linked below. Material changes that affect how we use your information will be notified by email to anyone they apply to.

13 · Contact

For any privacy matter, write to:

Effective date: 23 April 2026 · Version 1.0