Commission a Piece
Legal

Privacy Policy

Bespoke & Carvings
Trading as: DIY Geek t/a Bespoke & Carvings
Address: 13 Makriel Road, Wadeville, 1422, Johannesburg, South Africa
Tel: 011 824 2708
VAT No: 4070293107 Effective Date: 29 June 2026

1. INTRODUCTION

1.1 Our Commitment to Privacy: Bespoke & Carvings ("We," "Us," "Our") is committed to protecting Your personal information and Your right to privacy. This Privacy Policy explains how We collect, use, disclose, and otherwise process personal information when You:

  • Visit and use Our website ("Site")
  • Place an Order for Products
  • Subscribe to Our mailing list
  • Contact Us via email, phone, or contact form
  • Interact with Us in any other way

1.2 Regulatory Compliance: This Privacy Policy complies with the Protection of Personal Information Act, 4 of 2013 (POPIA), and applicable South African privacy laws.

1.3 Your Acceptance: By accessing the Site or providing personal information to Us, You acknowledge that You have read and understood this Privacy Policy and consent to the practices described herein.

1.4 Questions: If You have questions about this Privacy Policy, contact Us at the details provided in Section 9.

2. WHAT PERSONAL INFORMATION DO WE COLLECT?

2.1 Direct Collection - Information You Provide:

When You interact with Us, We may collect the following personal information:

a) Order Information

  • Name, email address, phone number
  • Postal address and delivery address
  • Payment information (credit/debit card details, banking information)
  • Order history and preferences
  • Bespoke commission details (design preferences, materials, specifications, budget)
  • VAT registration number (if applicable to Your business)

b) Newsletter & Communication

  • Email address for mailing list subscription
  • Preferences regarding communication frequency and content
  • Consent records for marketing emails

c) Contact Form & Inquiries

  • Name, email, phone number
  • Message content and inquiry details
  • Any attachments or additional information You provide

d) Account Information (if applicable)

  • Login credentials (username, password)
  • Profile information
  • Order history and saved preferences

e) Feedback & Testimonials

  • Comments, reviews, ratings, and testimonial content
  • Associated name and permission to publish

2.2 Indirect Collection - Information We Automatically Collect:

a) Technical Information

  • IP address
  • Browser type and version
  • Operating system
  • Pages visited and duration
  • Referral source
  • Device type (mobile, desktop)
  • Timestamps of Site activity

b) Cookies and Tracking

  • Cookie data to remember Your preferences, log-in information, and improve user experience
  • Analytics data via Google Analytics (anonymized)
  • Pixel tracking from advertising partners (if applicable)
  • Session information

2.3 Third-Party Information:

  • Information from Our payment processor about transaction status
  • Delivery/courier information regarding shipping status
  • Publicly available information (e.g., social media profiles, if You link them)

2.4 Special Personal Information: We do not intentionally collect "special personal information" (race, ethnicity, religious or philosophical belief, health, sexual orientation) unless You voluntarily provide it and we have explicit consent.

3. WHY DO WE COLLECT AND USE YOUR INFORMATION?

3.1 Order Fulfillment & Delivery

  • Process and fulfill Your Orders (both Bespoke and Ready-Made)
  • Send order confirmations, invoices, and delivery updates
  • Communicate about lead times, design progress, or production updates
  • Arrange delivery or collection
  • Provide customer support regarding Your purchase

3.2 Payment Processing

  • Authorize and process payments
  • Prevent fraud and unauthorized transactions
  • Issue refunds (if applicable)
  • Maintain financial records and comply with tax obligations

3.3 Marketing & Communications (with Your consent)

  • Send promotional emails about new products, services, and special offers
  • Send newsletter content about behind-the-scenes updates, design inspiration, and industry news
  • Conduct surveys or request feedback
  • Notify You of policy changes or important updates

Note: You may opt out of marketing emails at any time by clicking "unsubscribe" or contacting Us directly.

3.4 Customer Service & Support

  • Respond to Your inquiries and complaints
  • Troubleshoot issues
  • Provide product care and maintenance advice
  • Follow up on delivery or warranty issues

3.5 Legal & Compliance

  • Comply with South African laws (Consumer Protection Act, POPIA, tax laws)
  • Enforce Our Terms & Conditions
  • Protect Our legal rights and property
  • Detect, prevent, or address fraud, abuse, or security issues

3.6 Business Operations & Improvement

  • Analyze Site usage and user behavior to improve user experience
  • Develop new features, products, and services
  • Track inventory and manage supply chains
  • Manage Our business operations

3.7 Portfolio & Marketing (with permission)

  • Photograph or display images of completed Bespoke Pieces for Our portfolio and marketing materials
  • Use customer testimonials or case studies (with explicit consent only)
  • Feature Your projects on Our Site, social media, or in marketing content

Note: You may request that We do NOT use images of Your completed piece for marketing purposes.

3.8 Personalization

  • Remember Your preferences and saved items
  • Provide personalized product recommendations
  • Customize Your Site experience

4. LEGAL BASIS FOR PROCESSING

4.1 We process Your personal information on the following legal bases (as per POPIA):

a) Contractual Necessity: To fulfill Our contract with You (e.g., processing Orders, delivering Products, processing payments).

b) Consent: You have explicitly consented to the processing (e.g., subscribing to Our newsletter, allowing Us to photograph Your completed piece).

c) Legal Obligation: We are required by law to process Your information (e.g., tax compliance, consumer protection laws).

d) Legitimate Interest: Processing is necessary for Our legitimate business interests, such as fraud prevention, customer service improvement, or marketing (balanced against Your privacy rights).

e) Automatic Processing: Limited automated decision-making is used (e.g., order status updates, shipping notifications).

5. WHO DO WE SHARE YOUR INFORMATION WITH?

5.1 We do not sell Your personal information to third parties. However, We may share information with the following recipients:

a) Service Providers

  • Payment Processors: Credit card processors, payment gateways (e.g., Stripe, PayFast) to process payments securely.
  • Delivery/Courier Partners: Postal and courier services to arrange and track delivery.
  • Email Service Provider: MailerLite for newsletter distribution and mailing list management (see Section 5.2).
  • Web Hosting & Technical Services: Hosting providers and IT support to maintain the Site.
  • Analytics: Google Analytics for anonymized Site usage analysis.

b) Legal Requirements

  • Law enforcement, government agencies, or courts if required by law, subpoena, or court order.
  • Credit bureaus or debt collectors if payment is not received.

c) Business Transfers

  • If We are acquired, merged, or Our assets are sold, Your information may be transferred as part of the transaction (You will be notified).

d) With Your Consent

  • Any other party with Your explicit written consent.

5.2 MailerLite & Newsletter Processing:

  • When You subscribe to Our newsletter, Your email address is transferred to MailerLite, Our email service provider.
  • MailerLite processes Your email for newsletter delivery and campaign analytics.
  • MailerLite is GDPR compliant and maintains strict data protection standards.
  • Your email is stored securely and used only for newsletters and related communications.
  • You may unsubscribe at any time via the unsubscribe link in emails or by contacting Us.
  • MailerLite's Privacy Policy: https://www.mailerlite.com/privacy

5.3 Data Protection Agreements:

  • We have Data Processing Agreements in place with all service providers to ensure they process Your information in accordance with POPIA and this Privacy Policy.
  • Service providers are contractually obligated to maintain confidentiality and use Your information only as instructed.

5.4 International Transfers:

  • Some service providers (e.g., MailerLite, Google Analytics) are located outside South Africa.
  • We ensure adequate safeguards and compliance mechanisms are in place (e.g., standard contractual clauses, adequacy decisions).
  • By providing Your information, You consent to such transfers.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

6.1 Retention Periods:

a) Order & Payment Information

  • Retained for the duration of the business relationship plus 7 years for tax and accounting compliance (as required by South African tax law).

b) Communication Records

  • Emails and support tickets retained for 3 years for dispute resolution and customer service.

c) Newsletter Subscription

  • Retained until You unsubscribe. After unsubscribing, Your email is removed within 30 days.

d) Technical/Tracking Data

  • Log files and cookies retained for 12 months for security and analytics purposes.

e) Bespoke Commission Information

  • Retained indefinitely for Our portfolio and business records (unless You request deletion).

f) Testimonials & User-Generated Content

  • Retained as long as displayed on Our Site unless You request removal.

6.2 Deletion Requests:

  • You may request deletion of Your personal information at any time (subject to legal retention requirements).
  • We will delete information within 30 days unless We are required by law to retain it.
  • Some information may be retained in anonymized or aggregated form.

7. SECURITY OF YOUR INFORMATION

7.1 Security Measures:

  • We implement industry-standard technical, administrative, and physical security measures to protect Your personal information.
  • Your payment information is encrypted using SSL/TLS technology.
  • Our Site uses HTTPS to encrypt data in transit.
  • Access to personal information is restricted to authorized personnel only.
  • We regularly monitor for security threats and vulnerabilities.

7.2 Limitations:

  • While We strive to protect Your information, no method of transmission over the internet is 100% secure.
  • We cannot guarantee absolute security of Your information.
  • You are responsible for maintaining the confidentiality of Your passwords and login credentials.

7.3 Data Breach:

  • In the event of a personal data breach, We will notify affected individuals and relevant authorities as required by law, within 30 days of discovery.

8. YOUR RIGHTS & CHOICES

Under POPIA and South African privacy law, You have the following rights:

8.1 Right of Access

  • You have the right to request access to the personal information We hold about You.
  • Submit a request in writing to Us (see Section 9).
  • We will provide a copy within 30 days.

8.2 Right to Correction

  • You may request that We correct inaccurate or incomplete personal information.
  • We will update Your information within 30 days.

8.3 Right to Deletion ("Right to be Forgotten")

  • You may request deletion of Your personal information.
  • We will delete it within 30 days, subject to legal retention requirements.
  • Some information may not be deletable if required by law.

8.4 Right to Object

  • You may object to processing of Your personal information for marketing or profiling purposes.
  • We will cease processing within 30 days.

8.5 Right to Withdraw Consent

  • If You previously consented to processing, You may withdraw consent at any time.
  • Withdrawal does not affect processing prior to withdrawal.

8.6 Right to Data Portability

  • You may request a copy of Your personal information in a portable, machine-readable format.
  • We will provide this within 30 days in CSV or similar format.

8.7 Right to Lodge a Complaint

  • If You believe We have violated Your privacy rights, You may lodge a complaint with the Information Regulator.
  • Information Regulator Contact:

8.8 How to Exercise Your Rights

  • Submit Your request in writing to Us (see Section 9).
  • Include Your name, email, and specific details of Your request.
  • We will respond within 30 days or notify You if an extension is needed.
  • A reasonable fee may be charged if requests are excessive or repetitive.

9. COOKIES & TRACKING TECHNOLOGIES

9.1 What are Cookies?

  • Cookies are small text files stored on Your device that allow Us to recognize You and remember Your preferences.

9.2 Types of Cookies We Use:

a) Essential/Functional Cookies

  • Required for Site operation (e.g., shopping cart, login, security)
  • Cannot be disabled; necessary for Site functionality

b) Performance Cookies

  • Google Analytics to track Site usage, user behavior, and traffic patterns (anonymized)
  • Help Us understand how visitors use the Site and improve performance

c) Marketing Cookies

  • Used for retargeting and advertising purposes
  • Allow Us to display relevant content and ads to You on other Sites
  • Can be disabled in browser settings or opt-out preferences

9.3 Cookie Consent:

  • On first visit, a cookie consent banner is displayed.
  • You may accept all cookies, reject non-essential cookies, or customize preferences.
  • Your choice is remembered via a consent cookie.
  • You may adjust cookie preferences at any time via Your browser settings.

9.4 Third-Party Cookies:

9.5 Opting Out:

10. CHILDREN'S PRIVACY

10.1 We do not knowingly collect personal information from children under the age of 13.

10.2 If We discover We have collected information from a child under 13, We will delete it immediately.

10.3 If You believe a child under 13 has provided information to Us, please contact Us immediately (see Section 12).

10.4 For children aged 13-18, parental consent is required before collecting personal information.

11. MARKETING & COMMUNICATIONS

11.1 Opt-In to Marketing:

  • We will only send promotional emails if You have explicitly opted in (e.g., subscribed to Our newsletter).
  • An "opt-in" occurs when You check a box or take an affirmative action to consent.

11.2 Unsubscribe:

  • Every marketing email includes an unsubscribe link.
  • Click "unsubscribe" to remove Yourself from future emails.
  • We will process removal within 5 business days.

11.3 Communication Preferences:

  • You may customize Your communication preferences (e.g., weekly vs. monthly newsletters).
  • Adjust settings in Your account or contact Us to update preferences.

11.4 Transactional Emails:

  • Even if You unsubscribe from marketing, We will still send transactional emails (order confirmations, delivery updates, warranty notices).
  • These are necessary for order fulfillment and are not marketing.

12. THIRD-PARTY LINKS & INTEGRATION

12.1 Our Site may contain links to third-party websites (e.g., payment processors, social media).

12.2 We are not responsible for the privacy practices of third-party sites.

12.3 We recommend reviewing their privacy policies before providing Your information.

12.4 Social Media Integration:

  • If You connect Your social media account to Our Site, You grant permission for limited data sharing.
  • We access only the information necessary (e.g., profile name, email).
  • Refer to the social media platform's privacy policy for their practices.

13. CONTACT US & DATA PROTECTION OFFICER

13.1 General Inquiries & Rights Requests

If You have questions about this Privacy Policy or wish to exercise Your privacy rights, contact Us:

  • Email: hello@bespokecarvings.co.za
  • Phone: 011 824 2708
  • Postal Address: 13 Makriel Road, Wadeville, 1422, Johannesburg, South Africa
  • Attn: Data Controller / Privacy Officer

13.2 Response Time

  • We will respond to requests within 30 days.
  • If Your request is complex, We will notify You of an extension (up to 2 additional months).

13.3 No Fee (Usually)

  • Requests are generally free.
  • A reasonable fee may be charged for repetitive or excessive requests.

13.4 Complaint to Information Regulator

If You believe We have violated Your privacy rights, You may lodge a complaint with:

Information Regulator of South Africa

  • Website: https://www.inforreg.org.za
  • Email: complaints@inforeg.org.za
  • Telephone: +27 (0)10 023 5200
  • Postal: 33 Hoofd Street, Braamfontein, Johannesburg, 2001

14. CHANGES TO THIS PRIVACY POLICY

14.1 We may update this Privacy Policy from time to time to reflect changes in Our practices, technology, legal requirements, or other factors.

14.2 We will notify You of material changes by:

  • Posting the updated policy on the Site
  • Updating the "Effective Date" at the top
  • Sending an email notification (if the change significantly affects Your privacy)

14.3 Your continued use of the Site or Services after updates means You accept the revised Privacy Policy.

14.4 We encourage You to review this policy periodically to stay informed.

15. DEFINITIONS

  • Personal Information: Any information relating to an identified or identifiable individual.
  • Processing: Any operation performed on personal information (collection, use, storage, disclosure, deletion).
  • Data Controller: The entity determining the purposes and means of processing (Bespoke & Carvings).
  • Data Processor: An entity processing personal information on behalf of the controller (e.g., MailerLite, payment processors).
  • Consent: Voluntary, specific, informed, and unambiguous agreement to processing.

Last Updated: 29 June 2026

For questions or to exercise Your privacy rights, contact Us using the details in Section 13.

Privacy Policy Version: 1.0 Applicable Legislation: Protection of Personal Information Act, 4 of 2013 (POPIA); Consumer Protection Act, 68 of 2008 (CPA); Electronic Communications and Transactions Act, 25 of 2002 (ECTA)