Privacy Policy for Karoo Taxidermy
KAROO TAXIDERMY · PRIVACY & PERSONAL INFORMATION
Your information. Handled with care.
How we use personal information, how long we keep it and how to contact us about your rights.
Karoo Taxidermy cc is responsible for the personal information it processes in operating its business. This policy explains how we handle information about clients, website visitors, staff and other people who deal with us. It is guided by South Africa’s Protection of Personal Information Act (POPIA). Other privacy laws, including the GDPR and applicable US state laws, apply where their legal requirements are met.
1. Information We Collect
Depending on your dealings with us, we may collect:
- Your name, contact details, delivery address and client preferences.
- Order instructions, approvals, trophy details, production photographs and correspondence.
- Invoice, payment and billing information needed for a transaction.
- Identity, hunting, permit, veterinary, customs and shipping information where needed to process or export your trophies.
- Technical information such as IP address, device and browser information when you use our website or embedded services.
- Employment, application or supplier information relevant to that relationship.
Information may come directly from you or, where lawful, from your authorised representative, outfitter, shipping agent, service provider or a relevant authority. Providing information is generally voluntary, but we may be unable to quote, fulfil an order, arrange permits or shipping, or meet a legal requirement without the necessary details. We will explain any mandatory requirements relevant to your transaction.
2. How We Use Your Information
We use relevant information to respond to enquiries, prepare quotations, fulfil orders, manage accounts and payments, arrange permits and delivery, provide aftercare, and meet legal obligations. We may also use it to protect our systems, handle complaints or disputes and improve our services.
For returning clients, relevant order history helps us understand previous work and preferences. This does not automatically authorise marketing or justify retaining every supporting document. Marketing is subject to applicable consent and opt-out requirements.
3. Legal Basis for Processing Your Data
Depending on the purpose and applicable law, processing may be based on your consent, steps needed to enter into or perform a contract, a legal obligation, or a lawful legitimate interest such as providing aftercare, preventing fraud or establishing and defending claims. We use only information reasonably needed for the relevant purpose.
Where processing relies on consent, you may withdraw it. Withdrawal does not make earlier lawful processing unlawful or prevent processing on another applicable legal basis.
4. Sharing of Information
We may share necessary information with service providers and parties involved in your order, such as IT and website providers, payment processors, outfitters, professional advisers, permit authorities, veterinary authorities, customs officials and shipping agents. Information may also be disclosed when required by law or with your consent.
Access must be limited to the relevant purpose. Providers processing information on our behalf must be subject to appropriate confidentiality and data-protection obligations. We do not sell your personal information or provide it to third parties for their own marketing purposes.
5. Data Transfers
International orders and service providers may involve processing outside South Africa, including in the destination country for a shipment. Where a transfer occurs, it must meet applicable legal requirements, including an appropriate level of protection or another lawful transfer basis under POPIA and any other applicable law. Contact us for information about transfers relevant to your order.
6. Your Rights
Subject to applicable legal requirements and exceptions, you may:
- Ask whether we hold personal information about you and request access to it.
- Request correction of inaccurate or outdated information, or deletion where retention is no longer lawful or necessary.
- Object to processing on applicable legal grounds and opt out of direct marketing.
- Withdraw consent where processing depends on consent.
- Exercise additional rights, such as restriction or data portability, where the applicable law provides them.
We may need to verify your identity or authority before acting on a request. Where a lawful retention duty prevents deletion, we will explain the reason. Please use the contact details below.
You may lodge a complaint with South Africa’s Information Regulator, including through its published complaint channels. Where another privacy law applies, you may also have the right to complain to the relevant supervisory authority.
7. Security of Your Information
We are committed to reasonable technical and organisational safeguards against loss, unauthorised access, disclosure, alteration and destruction. Access to personal information should be limited to authorised people who need it for their work. Security compromises will be handled and notified as required by applicable law.
8. Data Retention
We retain personal information only for as long as needed for a lawful purpose, including fulfilling your order, providing relevant aftercare, maintaining an ongoing client relationship, meeting record-keeping duties and handling claims. The schedule below sets out the retention periods or criteria for different categories.
We periodically review inactive records. A returning-client designation is not a reason to retain all information indefinitely. A longer legal or documented business requirement applies only to the records needed for that purpose. When retention is no longer justified, information must be securely deleted, destroyed or irreversibly de-identified as soon as reasonably practicable.
9. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to support functionality and may use them to understand website use. You can manage cookies through your browser and any consent controls provided. Blocking cookies or third-party content may affect some features.
Google reviews are displayed through Elfsight. Loading embedded services can disclose technical information, such as your IP address and browser details, to their providers. Interacting with Google, Elfsight or external links may involve additional processing under those providers’ privacy notices. Displaying a review on our site does not remove it from Google.
10. Updates to This Policy
We may update this policy to reflect changes in our practices or legal requirements. The effective date above identifies the current version. Where the law requires additional notice or consent for a change, those requirements apply.
11. Contact Information
If you have any questions or concerns regarding this privacy policy or wish to exercise your rights, please contact us at:
Karoo Taxidermy cc
15 Van der Bijl Street, Graaff-Reinet, Eastern Cape, South Africa, 6280
Data retention schedule
This schedule distinguishes personal records from genuinely non-identifying reference material. Lawful retention exceptions apply to the relevant information only.
| Record category | Retention period or criteria | Conditions |
|---|---|---|
| Enquiries and quotations | Normally 12 months after the last substantive contact if no order results. | Retain longer only where there is an ongoing enquiry or another documented lawful reason. |
| Completed orders and related correspondence | Normally 5 years after delivery or collection and final settlement, whichever occurs later. | Applicable financial, permit, aftercare or dispute requirements may require relevant records to be kept longer. |
| Returning-client history | Relevant order history and preferences may be retained beyond the normal period while an ongoing relationship or documented need for future work or aftercare continues. | Inactive records are periodically reviewed. Retain only relevant history; delete or de-identify it when the justification ends. Supporting identity and financial records follow their own rules. |
| Non-identifying trophy reference photographs | May be retained long term for craftsmanship, design and reference purposes where no person is identifiable or reasonably re-identifiable. | Remove client names, order references, identifying metadata and other identifying links. Photographs that remain identifiable follow the applicable personal-information rules; public use requires a separate lawful basis. |
| Invoices, payments, accounting and tax records | For the applicable statutory period. For filed tax returns, generally at least 5 years after submission; where no return is required, generally 5 years after the relevant tax period. | Longer applicable accounting requirements, outstanding returns, audits, investigations and dispute holds take precedence. The period is not always measured from the invoice date. |
| Hunting, provenance, CITES, veterinary, export and shipping records | For the period required by the relevant law, permit conditions and destination requirements, and any documented lawful traceability need. | Requirements vary by record and shipment. Retain only the personal information needed to meet those requirements. |
| Identity and passport copies | Until the verification, permit or shipping purpose has ended, unless further retention is required by law or otherwise lawfully justified. | Returning-client status alone does not justify keeping unnecessary identity-document copies. |
| Marketing contacts and preferences | While there is a lawful marketing basis. Stop marketing when consent is withdrawn or a valid objection is received. | Review inactive contacts periodically. Keep only the minimal suppression record needed to honour opt-outs and necessary evidence of compliance. |
| Website enquiries, technical logs and analytics | Enquiries follow the enquiry or order rules above. Technical data is retained only for the period needed for functionality, security or the stated analytics purpose. | Incident evidence may be retained while needed for investigation or claims. Irreversibly anonymised statistics may be retained longer. |
| Backups and archived copies | Deleted information may remain in restricted backups until overwritten through the applicable recovery cycle, unless a lawful hold applies. | Residual copies must not be used for ordinary business purposes. Relevant deletions must be reapplied if a backup is restored. Backup retention must remain limited to a justified recovery need. |
| Complaints, disputes and legal holds | For as long as necessary to resolve the matter and meet applicable legal retention or claims requirements. | Restrict access, document the reason and review retention when the matter closes. |
| Staff, applicants and suppliers | For the period needed for the relevant relationship and applicable employment, tax, contractual or other legal requirements. | These records are assessed separately; customer retention periods do not automatically apply. |
Deletion and review process
- The responsible record owner checks that the retention trigger has occurred and confirms there is no applicable legal, permit, tax, contractual or dispute hold.
- Keep only information still justified; restrict archived records to authorised staff and the purpose for retaining them.
- Securely delete or destroy expired records, or irreversibly de-identify them, as soon as reasonably practicable. Apply the same decision to relevant service providers and working copies.
- Track any residual backup copies under the applicable recovery cycle. Restoring a backup must not reinstate information for ordinary use that has already been marked for deletion.
- Record the deletion date, category, authority and method without unnecessarily copying the personal information being deleted.
- Verify identity proportionately when handling access, correction or deletion requests. Explain any lawful retention exception and restrict use where required. A deletion request does not automatically override a legal retention duty.
