POPIA Notice — ArtworkHub SA

ArtworkHub SA (Pty) Ltd ("ArtworkHub SA") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa's primary data protection legislation.

This notice outlines how we comply with POPIA, who is responsible, and how you can exercise your rights as a data subject.

Information Officer

As required by POPIA Section 55, ArtworkHub SA has designated an Information Officer who is responsible for overseeing our compliance with POPIA and handling data subject requests.

👤

The Information Officer

Information Officer — ArtworkHub SA

✉ privacy@artworkhubsa.co.za

What Personal Information We Hold

We collect and process only the information necessary to provide our services. This includes:

Account details: name, email address, account type
Profile information: bio, profile photo, city, province (for artists and galleries)
Transaction data: order details, shipping addresses, payment references
Activity data: bids placed, class bookings, artworks listed
Technical data: IP address, session information, browser type

Full details are in our Privacy Policy.

Purpose of Processing

We process personal information only for the following lawful purposes:

Providing the ArtworkHub SA marketplace, auction, and class booking services
Communicating with you about your account, orders, and bookings
Sending marketing communications where you have given consent
Detecting and preventing fraud and abuse
Complying with South African legal and tax obligations
Improving the platform through aggregated analytics

Your Rights as a Data Subject

Under POPIA, you have the following rights. To exercise any of them, contact the Information Officer above.

📄 Right of Access

Request a copy of the personal information we hold about you. We will respond within 30 days.

✎ Right to Correction

Request that inaccurate, irrelevant, or outdated information be corrected or updated.

🗑 Right to Deletion

Request deletion of your personal information. Some records must be retained by law (e.g. financial records for 5 years).

🚫 Right to Object

Object to processing for direct marketing purposes at any time. We will stop immediately on request.

⚠ Right to Complain

Lodge a complaint with the Information Regulator if you believe your rights have been infringed.

🔒 Right to Security

Your data is protected by appropriate technical and organisational measures. See our Privacy Policy for details.

Data Breach Notification

In the event of a personal information breach that poses a risk to you, ArtworkHub SA will:

Notify the Information Regulator within 72 hours of becoming aware of the breach.
Notify affected data subjects as soon as reasonably possible, detailing what information was affected and what steps we are taking.

To report a suspected security incident: security@artworkhubsa.co.za

Third-Party Operators

We share personal information only with trusted third-party operators (as defined in POPIA) who are contractually bound to process data in accordance with our instructions and applicable law. These include:

Web hosting and database services
Payment processing (PayFast)
Email delivery services

We do not transfer personal information outside South Africa without ensuring adequate protection in line with POPIA Section 72.

Data Retention

We retain personal information only as long as necessary for the purpose it was collected, or as required by law. Inactive accounts are anonymised after 3 years. Financial transaction records are retained for 5 years as required by SARS. You may request deletion at any time by contacting the Information Officer.

🏠 Information Regulator of South Africa

If you are not satisfied with how we handle a complaint, you may contact the Information Regulator directly:

Website: inforegulator.org.za
Email: complaints.IR@justice.gov.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Cookie Policy

ArtworkHub SA uses essential session cookies to maintain your login state and protect forms from CSRF attacks. Optional analytics cookies may be present. You may manage cookies through your browser settings. See our Privacy Policy for full details.

Contact & Requests

All data subject requests (access, correction, deletion, objection) should be submitted in writing to the Information Officer at privacy@artworkhubsa.co.za. We will acknowledge your request within 3 business days and respond fully within 30 days.