Privacy policy

Last updated: 21 October 2026

This notice explains how the KwaZulu-Natal Society of Arts (KZNSA Gallery) collects, uses, shares and protects your personal information when you visit or buy from our online shop at shop.kznsagallery.co.za, subscribe to our emails or enquire about a work. We handle personal information in line with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible for your information

The responsible party is:

KwaZulu-Natal Society of Arts (KZNSA Gallery), a registered non-profit organisation (NPO number 004-833 NPO)
166 Bulwer Road, Glenwood, Durban, 4001, South Africa
Email: online@kznsagallery.co.za | Telephone: 031 217 7705 (+27 31 217 7705)

Information Officer: Russel Hlongwane, Director
Email: director@kznsagallery.co.za | Telephone: 031 217 7705 (gallery)

Please contact the Information Officer about any privacy question or request.

2. What we collect

Information you give us

  • When you order: your name, email address and/or phone number, billing and delivery address, a delivery phone number, the items you buy, and any message you send with your order.
  • When you pay: payments are made through our payment provider, Payfast. Payfast collects your payment details and processes your payment. We receive confirmation of payment and limited transaction details, not your full card details.
  • If you create an account: your login details, saved addresses and order history.
  • When you subscribe to our emails: your email address (and your name, if you give it) and a record of when and how you agreed to receive our emails.
  • When you enquire about a work or contact us: your name, contact details, the work you are asking about and your message.

Information collected automatically

  • Device and usage information: your IP address, browser and device type, the pages and works you view, the website or search that brought you to us, and how you use the shop. Our shop platform, Shopify, collects this through cookies and similar technologies. See section 6.
  • Email engagement: whether our emails are delivered and opened, and which links are clicked.
  • Security checks: our forms and login pages use hCaptcha to tell people apart from automated spam. hCaptcha processes technical information about your device and how you interact with the form.

We do not ask for special personal information, such as information about your health, religion or political beliefs. Our shop is not intended for children under 18.

3. Why we use your information, and on what basis

Purpose Lawful basis under POPIA (section 11)
Process, deliver or prepare for collection your order, and send order and delivery updates Needed to carry out our agreement with you
Answer your enquiries and messages, including about works offered by enquiry only Needed to take steps you have asked for; our legitimate interest in responding to you
Handle returns, refunds, damage claims and complaints Needed to carry out our agreement with you; legal obligation
Keep financial and tax records (including VAT) Legal obligation
Protect the shop and our customers from fraud, spam and misuse Our legitimate interest and yours
Understand how the shop is used and improve it Our legitimate interest; your consent where cookies require it
Send you news of exhibitions, new works, artist stories and events (direct marketing) Your consent, or, if you are a customer, our existing relationship with you (see section 4)
Show our works and exhibitions to you on Facebook and Instagram, and measure how well this works Your consent where cookies require it; our legitimate interest

You may object at any time to our using your information on the basis of legitimate interests. See section 9.

4. Direct marketing and how to opt out

We send marketing emails only in line with section 69 of POPIA:

  • If you are not yet a customer, we email you only if you have agreed to it, for example by subscribing through our newsletter form.
  • If you have bought from us, we may email you about similar works, exhibitions and events. You can say no when you give us your details (the box at checkout is never pre-ticked) and in every email we send.
  • Every marketing email identifies us and includes an unsubscribe link. Unsubscribing is free and takes effect promptly. You can also email online@kznsagallery.co.za and ask to be removed.
  • We do not currently send marketing by SMS or WhatsApp, and we do not sell or rent your information to anyone.

When you unsubscribe, we keep your email address on a suppression list so that we do not email you again by mistake.

5. Reminder emails

If you leave works in your cart, start a checkout without completing it, or browse works in the shop, we may send you a reminder email about those works. You can unsubscribe from them in the same way as from any other marketing email.

6. Cookies, pixels and analytics

Cookies are small files stored on your device. We use:

  • Essential cookies that make the shop work, for example to keep items in your cart, run checkout and keep the shop secure. These are set by Shopify and cannot be switched off without stopping the shop from working.
  • Analytics from Shopify, which shows us anonymised and aggregate information about visits and sales.
  • The Meta pixel (Facebook and Instagram), connected through Shopify's Facebook & Instagram channel. It records visits and actions in the shop, such as viewing a work or adding it to the cart, and sends this information to Meta from your browser and from Shopify's servers. We use it to show our works to people on Facebook and Instagram and to see whether this works. Meta's privacy policy: https://www.facebook.com/privacy/policy.
  • Google: we use Shopify's Google & YouTube channel, which can list our works on Google. It adds a Google pixel to the shop that can share information about visits and actions in the shop with Google. If we enable Google Analytics, it will collect information about how visitors use the shop, and we will update this notice. Google's privacy policy: https://policies.google.com/privacy.
  • Shop Pay and the Shop app (by Shopify) may set cookies if you use them at checkout or to track your order.

Your choices: You can also block or delete cookies in your browser settings, and manage ad preferences in your Facebook and Google account settings.

7. Who we share your information with

We share personal information only as needed for the purposes above, with:

  • Shopify, which hosts our online shop, checkout, customer records and email tool (Shopify Messaging). https://www.shopify.com/legal/privacy
  • Payfast, which processes payments.
  • Couriers and delivery services: our courier and delivery partners, which receive your name, delivery address and phone number so they can deliver your order.
  • Meta and Google, as described in section 6.
  • hCaptcha, for spam protection on forms.
  • Our professional advisers (for example auditors and legal advisers), where needed.
  • Authorities, where the law requires it, or where it is needed to protect our rights or the safety of others.

Our service providers may use your information only to provide their services to us and must keep it secure.

8. Information sent outside South Africa

Shopify and some of our other service providers (including Meta and Google) store or process information on servers outside South Africa, for example in Canada, the United States and Europe. We transfer personal information outside South Africa only as section 72 of POPIA allows. That means the recipient is bound by law, binding corporate rules or an agreement that gives protection similar to POPIA, or the transfer is needed to carry out our agreement with you, or you have consented.

9. Your rights

Under POPIA you have the right to:

  • ask whether we hold personal information about you, and ask for a copy of it;
  • ask us to correct, update or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained;
  • object to our processing your information on the basis of legitimate interests, and object at any time to direct marketing;
  • withdraw your consent at any time (this doesn't affect anything we did before you withdrew it);
  • not be subject to a decision based solely on automated processing that significantly affects you (we do not make such decisions); and
  • complain to the Information Regulator (see section 12).

To use any of these rights, email the Information Officer at director@kznsagallery.co.za. We may need to confirm your identity first. We will respond within a reasonable time and in line with POPIA and the Promotion of Access to Information Act (PAIA).

10. How long we keep your information

We keep personal information only as long as we need it for the purposes above, or as long as the law requires:

  • Orders and financial records: five years, as required by South African tax law.
  • Email subscription records: until you unsubscribe. After you unsubscribe, we keep a suppression record so that we do not email you again.
  • Enquiries and messages: only as long as needed to respond to and follow up on your enquiry, unless it leads to a purchase.
  • Customer accounts: until you ask us to close your account, subject to the order-record period above.

After that, we delete the information or make it anonymous.

11. How we protect your information

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, as section 19 of POPIA requires. Our shop runs on Shopify, and payments are processed by Payfast. Access to customer information in our shop admin is limited to staff who need it. If we believe your personal information has been accessed without authorisation, we will notify you and the Information Regulator as POPIA requires.

12. Questions and complaints

If you have a concern about how we handle your personal information, please contact our Information Officer first at director@kznsagallery.co.za, and we will try to resolve it with you.

You also have the right to complain to the Information Regulator (South Africa):

13. Changes to this notice

We may update this notice from time to time, for example when we change the tools we use. The date at the top shows when it was last updated. If we make significant changes, we will tell you by email or by a notice on the shop.