1. Introduction

Crafted Clay Holdings (Pty) Ltd ("we," "us," "our," or "the Company") is committed to protecting your privacy and personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African laws. This Privacy Policy explains how we collect, use, process, store, and protect your personal information when you visit our website, use our services, or interact with our pottery and ceramics studio.

2. Who We Are

We are a pottery and ceramics studio specializing in Pottery On The Wheel, Ceramics Painting, Create With Clay, Mosaic, Online Pottery Courses, Bulk B2B Ceramics, Glazing and Firing Services. As a responsible party under POPIA, we are committed to processing your personal information lawfully, fairly, and transparently.

3. Information We Collect

3.1 Personal Information

We may collect the following types of personal information:

• Identity Information: Name, surname, username, title
• Contact Information: Email address, telephone number, physical address, postal address
• Technical Information: IP address, browser type and version, device information, operating system
• Usage Information: Website navigation patterns, pages visited, time spent on pages
• Communication Information: Messages, comments, feedback, and correspondence
• Transaction Information: Payment details, order history, billing information (if applicable)
• Marketing Information: Preferences regarding marketing communications

3.2 Special Personal Information

4. How We Collect Information

4.1 Direct Collection

• Registration forms and contact forms on our website
• Email communications and correspondence
• Phone calls and in-person interactions
• Newsletter subscriptions
• Workshop and class registrations
• Purchase transactions

4.2 Automatic Collection

• Website cookies and tracking technologies
• Server logs and analytics tools
• Social media interactions

5. Comments

When visitors leave comments on our website, we collect the data shown in the comments form, along with the visitor's IP address and browser user agent string to help with spam detection and security.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to display your profile picture. The Gravatar service privacy policy is available at: https://automattic.com/privacy/. After approval of your comment, your profile picture becomes visible to the public in the context of your comment.

6. Media and File Uploads

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

• Essential Cookies: Required for website functionality
• Performance Cookies: Help us analyze website usage and improve performance
• Functionality Cookies: Remember your preferences and settings
• Marketing Cookies: Used to deliver relevant advertisements

7.2 Specific Cookie Usage

• Comment Cookies: If you leave a comment, you may opt-in to saving your name, email address, and website in cookies for convenience. These cookies last for one year.
• Login Cookies: When you log in, we set cookies to save your login information and screen display choices. Login cookies last for two days, while screen options cookies last for a year. If you select "Remember Me," your login persists for two weeks.
• Temporary Cookies: We set temporary cookies to determine if your browser accepts cookies. These contain no personal data and are discarded when you close your browser.
• Editor Cookies: If you edit or publish content, an additional cookie is saved indicating the post ID of the article you edited. This expires after one day.

7.3 Cookie Management

You can control cookie settings through your browser preferences. However, disabling certain cookies may affect website functionality.

8. Embedded Content from Other Websites

Articles and pages on our website may include embedded content (videos, images, articles, etc.) from other websites. Embedded content behaves as if you have visited the other website directly.

These third-party websites may collect data about you, use cookies, embed additional tracking, and monitor your interaction with embedded content, including tracking your interaction if you have an account with those websites.

9. Purpose of Processing

We process your personal information for the following purposes:

9.1 Legitimate Business Purposes

• Providing pottery and ceramics services
• Processing orders and payments
• Customer service and support
• Workshop and class administration
• Website maintenance and improvement
• Security and fraud prevention

9.2 Marketing and Communications

• Sending newsletters and promotional materials (with consent)
• Notifying you about new products, services, and events
• Conducting customer surveys and market research

9.3 Legal and Compliance

• Complying with legal obligations
• Protecting our rights and interests
• Resolving disputes and enforcing agreements

10. Legal Basis for Processing

We process your personal information based on:

• Consent: Where you have given explicit consent
• Contractual Necessity: To fulfill our contractual obligations
• Legal Obligations: To comply with South African laws
• Legitimate Interests: For legitimate business purposes that don't override your rights

11. Data Sharing and Disclosure

11.1 Third-Party Service Providers

We may share your information with:

• Payment processors for transaction handling
• Email service providers for communications
• Website hosting and maintenance providers
• Analytics and marketing service providers
• Legal and professional advisors

11.2 Legal Requirements

We may disclose your information when required by law, court order, or regulatory authority.

11.3 Password Reset Security

If you request a password reset, your IP address will be included in the reset email for security purposes.

12. Data Retention

12.1 General Retention Periods

• Comments: Comments and metadata are retained indefinitely to facilitate automatic approval of follow-up comments
• User Accounts: Personal information is retained while your account is active and for a reasonable period thereafter
• Transaction Records: Retained for accounting and legal compliance purposes (typically 5 years)
• Marketing Data: Retained until you withdraw consent or unsubscribe

12.2 Data Deletion

We will delete or anonymize your personal information when it is no longer needed for the purposes for which it was collected, unless retention is required by law.

13. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against:

• Unauthorized access, use, or disclosure
• Accidental loss, destruction, or damage
• Unlawful processing

Security measures include:

• SSL encryption for data transmission
• Secure server infrastructure
• Access controls and authentication
• Regular security updates and monitoring
• Staff training on data protection

14. Your Rights Under POPIA

15. How to Exercise Your Rights

To exercise your rights or make inquiries about your personal information:

Required Information:

Please provide:

• Your full name and contact details
• Proof of identity
• Specific details of your request
• Preferred format for response (if applicable)

Response Time:

We will respond to your request within 30 days as required by POPIA.

16. Data Transfer

If we transfer your personal information outside South Africa, we will ensure adequate protection through:

• Adequacy decisions by the Information Regulator
• Binding corporate rules
• Standard contractual clauses
• Your explicit consent

17. Automated Decision-Making

We may use automated systems for:

• Spam detection in comments
• Website analytics and optimization
• Marketing personalization (with consent)

You have the right to request human intervention in automated decision-making processes that significantly affect you.

18. Children's Privacy

19. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. Please review their privacy policies before providing personal information.

20. Complaints

If you believe we have not complied with POPIA or this Privacy Policy, you can:

1. Lodge a complaint with us:

• Contact our Information Officer using the details above
• We will investigate and respond within 30 days

2. Lodge a complaint with the Information Regulator:

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will:

• Post the updated policy on our website
• Indicate the effective date of changes
• Notify you of significant changes via email or website notice

22. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal information: