Privacy policy
Last updated: 1 October 2026
Art by Zulu (PTY) Ltd, trading as ArtbyZulu, respects your privacy. This notice explains how we collect, use, share and protect personal information when you visit our South African online store, contact us or place an order. Art by Zulu (PTY) Ltd is the responsible party for the processing described here under South Africa's Protection of Personal Information Act, 2013 (POPIA).
What we collect
Depending on how you use our store, we collect your name, email address, phone number, billing and delivery addresses, order details, payment confirmation, messages you send us and preferences you choose to provide. The store also receives technical information such as your IP address, browser and device details, and information about how you use the website through cookies and similar technologies.
Payment card details are handled by the payment service used at checkout. We receive the information needed to confirm payment and fulfil your order. We collect information when you place an order, use the contact form, create an account or sign up for marketing. Some technical information is collected automatically when you browse. We may also receive order and payment status information from Shopify and the payment service.
Why we use it
- To make, pack and deliver orders, process payments, provide updates and handle questions, returns or complaints.
- To operate and secure the store, prevent fraud and troubleshoot problems.
- To meet tax, accounting and other legal obligations.
- To understand how the store is used and improve it.
- To send marketing only where POPIA permits it, subject to your choices and the opt-out described below.
Under POPIA, processing may be necessary to perform our agreement with you, comply with a legal obligation, protect your or our legitimate interests, or take place with your consent, depending on the activity. Where consent is the basis, you may withdraw it at any time. Withdrawing consent does not undo earlier lawful processing or prevent us retaining records that the law requires. Your delivery address is needed to fulfil an order; marketing information is optional.
Who receives it
We share information needed to operate the store with Shopify and service providers that process payments, deliver orders, provide customer support or help us meet legal obligations. A delivery provider needs your name, delivery address and contact details. We may disclose information to regulators or authorities where the law requires it. We do not sell our customer list.
Our store is hosted by Shopify. Shopify's current data hosting location for this store is the United States. Shopify Network Intelligence is enabled. Shopify may use customer interactions with our store and other Shopify services to improve its products, advertising and personalisation, as explained in Shopify's consumer privacy policy. Shopify and other providers may process information outside South Africa. Where POPIA applies to a cross-border transfer, we use a ground allowed by section 72 and take reasonable steps to protect the information.
Cookies and marketing
The store uses cookies and similar technologies for the basket, checkout, security and remembering preferences. Analytics and advertising technologies may also be used through Shopify's enabled features or other tools we install. You can manage cookies through your browser and any privacy controls shown on our website. Blocking essential cookies may affect checkout.
If you sign up for promotional messages, you can unsubscribe using the link in an email or contact us. Existing customers may receive marketing about our own similar products only where POPIA allows it and where they had an opportunity to object when their details were collected and in each message. We may still send service messages such as order updates.
Retention and security
We keep personal information for as long as needed to fulfil orders, handle queries, meet record-keeping duties and resolve disputes. When it is no longer needed or legally required, we delete or de-identify it. We use reasonable safeguards and limit access to people and providers who need the information. If a security compromise triggers POPIA's notification requirements, we will notify the Information Regulator and affected people as required by law.
Your POPIA rights
You may ask whether we hold your personal information and request access to it. You may ask us to correct or delete information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained, subject to lawful retention duties. You may object to certain processing, withdraw consent where applicable, and object to direct marketing. We may need to verify your identity before responding.
Send requests to privacy@artbyzulu.com or use our contact form. You may also lodge a complaint with the Information Regulator of South Africa. For data that Shopify processes for its own purposes, you can also use Shopify's privacy portal.
Contact and changes
Art by Zulu (PTY) Ltd, trading as ArtbyZulu
87 Broadacres Drive, Dainfern, Gauteng, 2191, South Africa
privacy@artbyzulu.com
We may update this notice when our practices or legal duties change. The current version and its date will be posted here.