Privacy Policy

Last updated: 27 October 2026

1. Who is responsible for your information

Chris Lary (“the studio”, “I”) is the responsible party for the personal information processed through this website and the studio’s enquiries, commissions and orders. The studio is based in Rooiels, Western Cape, South Africa.

Information Officer: Chris Lary
Email: [email protected]
Phone: 083 7089 555
Rooiels, Western Cape, South Africa

2. What personal information we collect

• Enquiries. When you use the contact form or an artwork enquiry link, you provide your name, email address, a subject and a message. The form opens your own email application — the website does not store your message, and it reaches the studio only when you send it.
• Orders and commissions. Your name, email address, phone number, billing and delivery address, the works ordered and payment confirmation details. Card details are entered on the payment provider’s secure page and are never stored by the studio.
• Order status. An order reference used on the order status page to retrieve the details of that order.
• Technical information. IP address, browser and device type and requested pages recorded in the hosting provider’s server logs for security and reliability.

The studio does not intentionally collect special personal information (such as health, religious or political information) and does not knowingly collect information about children.

3. Why we use your information

Personal information is processed only for the purposes for which it was collected:

• to respond to enquiries, confirm availability and quote works;
• to prepare, invoice, deliver and support orders and commissions;
• to keep accounting, tax and other records required by law;
• to protect the website, prevent fraud and keep the service reliable;
• to send studio news, only where you have opted in.

4. Lawful grounds for processing

Depending on the purpose, processing relies on one or more of the grounds in section 11 of POPIA:

• Consent — when you send an enquiry or opt in to studio news;
• Performance of a contract — when you order or commission a work;
• Legal obligation — for invoices, tax and accounting records;
• Legitimate interest — to answer enquiries and secure the website.

5. Who we share it with

The studio shares personal information only with service providers that help run the gallery and fulfil orders, such as the website host, the payment provider, email providers, couriers and the studio’s accountant. These providers may use the information only for the agreed purpose and are bound by confidentiality and data-protection obligations.

Personal information is never sold, rented or traded. It may be disclosed where the law, a court order or a lawful request from a regulator requires it.

6. Transfers outside South Africa

Some service providers, including the hosting and payment providers, may process personal information outside South Africa. Those transfers are made in line with section 72 of POPIA and rely on contractual safeguards and providers that offer an adequate level of protection.

7. How long we keep it

• Enquiries that do not lead to an order are kept for up to 24 months;
• order, commission and tax records are kept for five years from the end of the relevant tax year;
• marketing preferences are kept until you withdraw consent;
• hosting logs are retained for short periods by the hosting provider.

After these periods, records are deleted or de-identified.

8. How we protect it

The website uses HTTPS, access controls and reputable service providers, and the studio limits access to personal information to what is needed to run the gallery. No system is completely secure, but if a breach affects your personal information, the studio will notify the Information Regulator and affected persons as required by section 22 of POPIA.

9. Your rights under POPIA

You may ask the studio to:

• confirm what personal information is held about you and provide a copy;
• correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• stop processing information based on a legitimate interest;
• withdraw consent, without affecting processing that already took place;
• stop sending you marketing communications at any time.

Send requests to [email protected]. The studio may ask you to verify your identity and will respond within 30 days.

If you believe your personal information has not been handled lawfully, you may complain to the Information Regulator:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, 2017
Email: [email protected] · [email protected]
Phone: 010 023 5200 · www.justice.gov.za/inforeg

10. Children

This website is not directed at children. The studio does not knowingly collect personal information from a child without the consent of a competent person, as required by section 35 of POPIA.

11. Direct marketing

The studio does not send unsolicited electronic marketing. If you opt in to studio news, you can withdraw at any time using the unsubscribe link in the message or by emailing the studio.

12. Cookies and tracking

This website does not use advertising, analytics or tracking cookies. The hosting provider may keep strictly necessary technical records, such as security logs, to deliver the site reliably.

13. PAIA manual

A manual describing the records held by the studio, prepared under the Promotion of Access to Information Act, 2000 (PAIA), is available from the Information Officer on request.

14. Changes to this policy

This policy may be updated from time to time. The latest version is always published on this page, and the date at the top shows when it last changed.

15. Contact

Questions about this policy or your personal information can be sent to [email protected] or 083 7089 555.