Privacy policy

What we collect

We collect only what we need to take and fulfil orders, support customers, and run the business. Depending on how you interact with us, that may include:

• Contact and identity details — name, email address, phone number, and a school or business name.
• Delivery information — the address you ask us to ship to.
• Order and billing details — what you bought, when, and the last four digits of the card used, plus the billing address linked to the payment.
• Correspondence — emails and messages you send us, kept so we have a record if you contact us again.
• Website usage — IP address, browser and device details, pages visited and basic analytics, used to keep the site secure and to improve it.

How we use it

• Processing orders, taking payment, invoicing and arranging delivery.
• Answering customer queries and providing support.
• Sending order updates, and — only if you opt in — newsletters about new releases and shop news. You can unsubscribe from marketing emails at any time.
• Fraud prevention, security, and meeting our legal and tax obligations.
• Improving the website and our product range through aggregated, non-identifying analytics.

Who we share it with

We do not sell your personal information. We share it only with service providers that need it to deliver our service to you, including:

• Payfast — our payment gateway. Card numbers are entered on Payfast's secure environment and are not stored by us.
• The Courier Guy and any other couriers or postal services used to deliver your order.
• IT and hosting providers that run our website and email systems.
• Professional advisers (accountants, auditors, lawyers) where reasonably required.

Some of these providers may process data outside South Africa. Where that happens, we make sure they are subject to laws or contractual terms that give your information a comparable level of protection to POPIA.

How we keep it safe

Information is transmitted between your browser and our servers using TLS encryption. Access to customer data inside the business is limited to the people who need it to do their job. No online system is perfectly secure, but we take reasonable steps to protect your information against loss, unauthorised access and misuse.

How long we keep it

We keep order and tax records for at least five years to meet our obligations under South African tax and company law. Marketing data is kept only while you remain subscribed. Other personal information is kept only as long as we have a legitimate reason to keep it, after which it is deleted or anonymised.

Your rights under POPIA

Subject to the limits set by POPIA and other applicable law, you have the right to:

• Ask what personal information we hold about you and request a copy.
• Have inaccurate or incomplete information corrected.
• Ask us to delete personal information we no longer have a lawful reason to keep.
• Object to direct marketing at any time.
• Withdraw any consent you have given us, without affecting processing done before withdrawal.
• Complain to the Information Regulator at inforegulator.org.za.

To exercise any of these rights, email info@depicta.co.za. We may need to verify your identity before acting on the request.

Cookies

We use a small number of first-party cookies to keep you signed in, remember the contents of your cart, and support basic analytics. You can clear or block cookies in your browser settings; some parts of the site may not work properly if you do.

Children

Although our products are made for use in classrooms, this website is intended for adults — parents, teachers and other business customers. We do not knowingly collect personal information from children under 18 without parental or guardian consent.

PAIA manual

A copy of our manual under the Promotion of Access to Information Act, 2000 (PAIA) is available on request by emailing info@depicta.co.za.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The current version is always the one published here.