Privacy Policy

1. Who I am

This site is operated by Mounis Bin Muzafar Khan, an independent visual storyteller working in photography and film, based in India. For the purposes of data protection law I am the data controller for information collected through this site. You can reach me at mounisibnmuzafar@gmail.com.

2. What I collect

I only collect what you actively send me. There is no account system, no newsletter list, and no advertising network on this site.

I do not collect payment details through this site, and I do not ask for sensitive personal information. Please do not send confidential material through the contact form.

3. Why I use it

Information sent through this site is used only to:

• reply to your enquiry and discuss possible work;
• negotiate, agree, and carry out a commission or licence;
• keep records of correspondence relating to a project;
• keep the site secure and working properly; and
• meet legal or tax obligations that apply to my practice.

I do not sell your information, rent it, trade it, or use it to build an advertising profile. I will not add you to a mailing list because you sent an enquiry.

4. Lawful basis for processing

Where the GDPR or UK GDPR applies to you, I rely on the following bases:

• Consent — you chose to send an enquiry. You may withdraw it at any time by asking me to delete your message.
• Performance of a contract — where we are discussing or carrying out a commission.
• Legitimate interests — keeping the site secure, preventing abuse, and maintaining ordinary business records.
• Legal obligation — where tax or other law requires me to retain records.

Where India's Digital Personal Data Protection Act 2023 applies, I process personal data for the lawful purpose for which you provided it, on the basis of the consent you gave when submitting it.

5. Who it is shared with

I keep this deliberately short. Your information is handled by me, and by a small number of service providers who make the site work:

• Formspree — processes contact form submissions and forwards them to my email.
• Vercel — hosts this website and keeps standard server logs.
• My email provider — receives and stores our correspondence.

These providers act on my instructions and are not permitted to use your information for their own purposes. Beyond them, I disclose information only where I am legally required to, or where it is necessary to establish or defend a legal claim.

6. International transfers

I work in India and take commissions internationally. The providers above operate servers outside your country, so information you send may be processed elsewhere, including in the United States and the European Union. Where personal data is transferred out of the UK or European Economic Area, that transfer relies on the safeguards those providers have in place, such as standard contractual clauses.

7. How long I keep it

• Enquiries that do not lead to work — kept while a reply is useful, then deleted, generally within two years.
• Project correspondence — kept for the life of the project and afterwards for as long as tax and limitation periods require.
• Server and security logs — kept for short periods by the host and rotated automatically.

You can ask me to delete your enquiry sooner, and I will unless I am required to keep it.

8. Your rights

Depending on where you live, you may have some or all of the following rights over your personal information:

• to ask what I hold about you, and get a copy;
• to have inaccurate information corrected;
• to have information deleted;
• to object to or restrict how it is used;
• to receive it in a portable format;
• to withdraw consent at any time; and
• to complain to a data protection regulator.

If you are in California, I do not sell or share personal information as those terms are used in the CCPA, and you will never be treated differently for exercising a privacy right. If you are in India, you may nominate another person to exercise your rights in the event of death or incapacity, and you may complain to the Data Protection Board of India.

To exercise any of these, email me at mounisibnmuzafar@gmail.com. I will respond within thirty days.

9. If you appear in my photographs

This deserves its own section, because documentary work involves photographing real people, often in difficult circumstances.

I photograph people in public places and in the course of journalism and documentary practice. Where practical I seek informed consent, explain what the work is for, and respect a refusal. I take particular care with images of children, of people in distress, and of anyone who could be placed at risk by being identified.

If you appear in an image published on this site and wish to raise a concern — whether about consent, context, safety, or accuracy — write to me at mounisibnmuzafar@gmail.com. I will consider any such request seriously and promptly. Where an image creates a genuine risk to someone's safety, tell me and I will remove it from this site while we discuss it.

Journalistic and artistic work carries exemptions under several data protection regimes, and images already published by third parties may be outside my control. That does not change how I would rather handle these requests, which is directly and in good faith.

10. Cookies and tracking

This site sets no advertising or analytics cookies and does not track you across other websites. The only cookie this site may set is a strictly necessary one used to keep the site's private administration area signed in — it is never set for ordinary visitors.

Some images are served from third-party hosts such as Google Drive, and embedded video links point to external platforms. Following those links or loading that content means the third party may set its own cookies under its own policy.

11. Security

The site is served over HTTPS, the administration area is password protected, and access to enquiries is limited to me. No system is perfectly secure, so please do not send anything through the contact form you would not want read by someone other than me. If you need to share something sensitive, email me first and we will find a better route.

12. Children

This site is not directed at children and I do not knowingly collect personal information from anyone under eighteen through it. If you believe a child has sent me information, contact me and I will delete it.

13. Changes to this policy

If this policy changes, the revised version will appear on this page with a new date at the top. Material changes affecting how I use information already collected will be explained here rather than made quietly.