Privacy Policy

1. Who we are & our Information Officer

Stroke of Hope is a young-artist upliftment initiative operated by BotAndBotty. We are the “responsible party” for the personal information described below.

2. The personal information we collect

We collect only what we need to run the showroom, fulfil orders and keep you informed:

• Buyers / customers: name, email address, cellphone number, delivery address, and your order history (the works you have bought and their status).
• Newsletter subscribers: your email address only, where you choose to subscribe.
• Enquiries: the name, email and message you submit through our contact form.
• Site & device data: a strictly-necessary session cookie (soh_session) to keep you signed in, and your shopping cart stored in your browser’s local storage. We may keep basic, aggregated analytics (such as page views) to understand how the site is used. See our Cookie & Storage Notice.

3. Information about the young artists we represent

We hold limitedinformation about the young artists whose work we show. Because these artists are minors, we treat their information with particular care — see section 11 below and our child-safeguarding statement.

4. Why we process it & our lawful basis

Under POPIA section 11, we rely on one or more of the following grounds:

• Performance of a contract — to process your order, take payment, arrange delivery and provide support.
• Your consent — for example, when you opt in to our newsletter, or agree to our terms at checkout.
• Legitimate interest — to keep the site secure, prevent fraud and abuse, and run our initiative responsibly.
• Legal obligation — where the law requires us to keep certain records (for example, financial records).

5. How we use your information

• To create and manage your account and process your orders.
• To take payment and confirm it, and to arrange and track delivery.
• To send you order confirmations, delivery updates and essential service messages.
• To respond to your enquiries and provide customer support.
• To send you our newsletter, only where you have opted in.
• To keep the site secure and to comply with our legal obligations.

6. Who we share it with (our operators)

We do not sell your personal information. We share it only with trusted service providers (“operators” under POPIA) who process it on our behalf and under contract, to deliver our service:

• PayFast — to process payments securely. We never see or store your full card details.
• Couriers / delivery partners — your name and delivery address, to deliver your artwork.
• Resend — to send transactional and (where opted in) newsletter email.
• SMS Portal — to send one-time sign-in codes by SMS.
• Supabase & Vercel — database, hosting and infrastructure providers that store and serve the site.

We may also disclose information where required by law or to protect our rights.

7. Cross-border transfers

8. How we protect your information

We use appropriate technical and organisational measures — including encryption in transit (HTTPS), access controls, one-time-code sign-in (no passwords stored), and reputable processors — to safeguard your information against loss, unauthorised access and misuse. No method of transmission is perfectly secure, but we work to protect your information and to address any incident promptly.

9. How long we keep it

We keep personal information only for as long as necessary for the purposes above or as required by law (for example, financial and tax records). Order records are retained for the period required by applicable law; newsletter data is kept until you unsubscribe. When information is no longer needed, we delete or de-identify it.

10. Your rights (POPIA)

As a data subject, you have the right to:

• access the personal information we hold about you;
• ask us to correct or update it where it is inaccurate or incomplete;
• ask us to delete or destroy it where we no longer have grounds to keep it;
• object to certain processing;
• withdraw consent you previously gave (this will not affect processing before withdrawal); and
• complain to the Information Regulator (South Africa).

To exercise any of these rights, email our Information Officer at bot@botandbotty.com. We may need to verify your identity before we act on a request.

11. Children’s personal information

12. Direct marketing & your right to opt out

Our newsletter is strictly opt-in (POPIA section 69) — we only email you marketing if you ask us to. Every newsletter includes a one-click unsubscribe, and you can opt out at any time by emailing bot@botandbotty.com. We will always send you essential service messages about an order you have placed.

13. Complaints to the Regulator

If you believe we have not handled your personal information lawfully, you may lodge a complaint with the Information Regulator (South Africa) at https://inforegulator.org.za. We would, however, appreciate the chance to put things right first — please contact us.

14. Access to information (PAIA)

For requests under the Promotion of Access to Information Act, 2000 (PAIA), please contact our Information Officer at bot@botandbotty.com, who will guide you through the process.

15. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above shows when it last changed. Material changes will be communicated where appropriate.