Privacy

Privacy in Plain Language

We take your privacy seriously. Here’s the short version:

  • We only collect the information you give us, plus basic website analytics.
  • We use it to run PORTRAIT: The National Portrait Prize, show relevant content, and make the site better.
  • We don’t sell your data. Ever.
  • Some things you submit (e.g. media releases, published news) may appear publicly.
  • We work with trusted service providers for hosting, analytics, email and payments (where applicable).
  • You’re in control — you can ask to see, fix, or delete your info at any time.
  • If something goes wrong (like a data breach), we’ll let you know and follow the law.
Read the full Privacy Policy Contact us

Privacy Policy

Effective date:

1. Introduction

This Privacy Policy explains how Strydom-Graves Gallery (Pty) Ltd, trading as PORTRAIT: The National Portrait Prize (we, us, our) collects and uses personal information when you visit https://www.nationalportraitprize.co.za/ (Website) and related services. We comply with South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA) and, where applicable, the EU/EEA General Data Protection Regulation (GDPR) and UK GDPR.

2. What information we collect

2.1 Information you provide

  • Enquiries & forms: your name, email, phone and the content of your message.
  • Submissions (e.g. media/news): names, bios, artwork details, images and other materials you upload for potential publication.
  • Accounts (if introduced later): name, email, password and profile info.
  • Payments (if/when enabled): billing/contact details (payments are processed by PCI-compliant providers; we don’t store full card data).

2.2 Information collected automatically

  • Log & usage data: IP address, device/browser, pages viewed, timestamps and referring URLs (typical server/analytics logs).
  • Cookies/SDKs: to keep the site functional, remember preferences and help us understand what’s working. See “Cookies & analytics”.

2.3 Publicly available sources

For published content we may collate public details (e.g. venue names, dates, published artist names) from official sources to improve accuracy and context.

3. Our legal bases for processing

We process personal information on these grounds (depending on your location): consent (e.g. non-essential cookies, newsletters), contract (e.g. taking steps to deliver requested services), legal obligation (e.g. tax/records), and legitimate interests (e.g. site security, measuring performance) balanced against your rights. For GDPR/UK GDPR, these bases align with the framework of lawful processing and data subject rights. :contentReference[oaicite:0]{index=0}

4. How we use information

  • Operate and improve the Website: publish content, maintain security, measure performance.
  • Manage submissions and communications: review materials, correspond with you and (where relevant) publish approved content.
  • Payments: process entry fees or sponsorships (if enabled) via trusted South African payment gateways.
  • Legal & compliance: keep records, prevent misuse/fraud and meet regulatory obligations.

5. How we share information

  • Public content: if you submit material for publication, the published parts will be visible on the Website and may be shared on our social channels.
  • Service providers: hosting, security, analytics, email and payment processors working under contract and confidentiality.
  • Legal/requests: if required by law or to protect our rights, users or the public.
  • Business changes: if we restructure or transfer our operations, your information may transfer as part of that process.

We don’t sell personal data.

6. Cookies & analytics

We use essential cookies for basic site functions and may use optional analytics/advertising cookies to understand usage and improve content. Non-essential cookies will only run with your consent (shown in our cookie banner, where enabled). You can withdraw consent anytime in your browser or via the banner. See our Cookies page for details.

7. International transfers

We are based in South Africa and use reputable service providers that may process data in other countries. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) to protect your information for EEA/UK users under GDPR/UK GDPR. :contentReference[oaicite:1]{index=1}

8. How long we keep information

We retain personal information only as long as needed for the purposes above or to meet legal requirements (e.g. accounting, tax, dispute resolution). We then delete or anonymise it.

9. Your privacy rights

You can request access, correction, deletion, restriction or objection to processing, and you can withdraw consent for optional processing at any time. South African residents may lodge a complaint with the Information Regulator (South Africa). EEA/UK residents have equivalent rights under GDPR/UK GDPR. :contentReference[oaicite:2]{index=2}

Information Regulator (South Africa): inforegulator.org.za — POPIA complaints can be emailed to POPIAComplaints@inforegulator.org.za (use prescribed Form 5). :contentReference[oaicite:3]{index=3}

10. EU/UK representative (if required)

If we are subject to GDPR Article 3(2) and do not have an establishment in the EU/UK, we may be required to appoint an EU/UK representative under Article 27. If so, we will publish the representative’s contact details here. :contentReference[oaicite:4]{index=4}

11. Security

We use administrative, technical and physical safeguards to protect personal information. However, no system is completely secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authority where required by law (e.g. the Information Regulator in South Africa). :contentReference[oaicite:5]{index=5}

12. Children

The Website is intended for adults. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, please contact us so we can delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the revised version with a new effective date. Your continued use of the Website after changes are posted means you accept the updated policy.

14. How to contact us

To ask a question or exercise your privacy rights, please contact us. If you are in the EEA/UK and GDPR applies, you may also contact your local supervisory authority.