Privacy Policy

1. Who We Are (Responsible Party)

Zahavah Studio (“we”, “us”, “our”) is a trading name of Zahavah (Pty) Ltd (registration number 2025/602702/07), the Responsible Party for the personal information processed through this website, zahavahstudio.com. We operate from Primrose, Germiston, Gauteng, South Africa.

For any privacy matter, or to reach our Information Officer, contact info@zahavahstudio.com.

2. Information We Collect

• ▸Information you give us: When you submit our contact form, our Complimentary Website Overview request form, email us, or speak with us in a consultation, we collect your name, business or company website, work email address, phone number, and the contents of your message.
• ▸Information collected automatically: When you visit the site, we and our analytics providers collect usage data such as the pages you view, links you click, your device and browser type, your referring source, and an approximate location derived from your IP address.
• ▸Session analytics: We use Microsoft Clarity, which captures anonymised session recordings and heatmaps (mouse movement, clicks, and scrolling) to help us understand how the site is used. Text you type into form fields is masked by default.
• ▸Spam protection: Our forms are protected by Google reCAPTCHA, which collects device and usage information to tell humans apart from bots. Its use is subject to Google’s Privacy Policy and Terms of Service.

3. Cookies & Tracking Technologies

We use cookies and similar technologies for analytics. Google Analytics 4 sets cookies to measure traffic and usage, and Microsoft Clarity uses cookies and local storage for session analytics.

You can refuse or delete cookies through your browser settings, and you can opt out of Google Analytics using Google’s Analytics Opt-out Browser Add-on. Disabling cookies will not affect the core functionality of the site.

4. How We Use Your Information

We use the information we collect strictly to:

• ▸Respond and deliver: Answer your enquiries and provide the services in your selected Investment Framework.
• ▸Audit and improve: Perform technical site audits and refine our diagnostic tools and content.
• ▸Secure the site: Maintain operational integrity and prevent spam, fraud, and abuse.

5. Connected Social Media Accounts

If we manage your social media, you can connect your business accounts on Facebook, Instagram, Threads, LinkedIn, Google Business Profile, YouTube, TikTok, or X to our client portal. You connect each account yourself, through that network’s own sign-in screen. We never see or store your password for any network.

When you connect an account, we receive and store only what we need to publish and manage posts on your behalf:

• ▸Account details: The name, ID, and profile link of each Page, profile, channel, or listing you choose to connect.
• ▸Access tokens: The access key the network issues so we can post for you. Tokens are encrypted before they are stored, and none of our staff can read them through the portal.
• ▸Your posts: The words, pictures, and videos you or our team prepare, their scheduled times, and whether each one was published. Pictures and videos are stored so the network can collect them when the post goes out.
• ▸Engagement on your posts: Where you ask us to manage it, the comments on your posts (with the commenter’s public name), reactions, reach, and Google reviews of your listing, so our team can see and reply to them from the portal.

6. How We Use Social Media Data

We use data from your connected accounts only to publish the posts you approve, show you how they performed, and reply to comments and reviews on your behalf. We do not use it for advertising, we do not sell it, and we do not use it to train artificial-intelligence models.

Each network’s data is used only for your own account and is never shared with another client.

Zahavah Studio’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our use of YouTube is subject to the YouTube Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy).

7. Disconnecting and Deleting Social Media Data

You can stop our access at any time, in either of two ways:

• ▸Ask us: Email info@zahavahstudio.com and we will disconnect the account. Disconnecting deletes its stored access token immediately.
• ▸Remove us yourself: Remove the Zahavah Studio app from the network’s own settings (for example, Facebook’s Business Integrations, Google Account → Third-party connections, or LinkedIn’s Permitted Services). Our access then stops straight away.

8. If You Commented on a Client’s Post

When we manage a business’s social media, the comments on its posts and the public name shown with each one are kept in our client portal so that we, or the business, can answer you. We use them only to reply on that business’s behalf. To have your comment removed from our portal, email info@zahavahstudio.com with a link to the comment or the name of the business, and we will remove it within 30 days. The comment itself stays on the social network until you or the business delete it there.

9. Requesting Deletion of Social Media Data

To have all data we hold from your connected accounts deleted, including your account details, post history, and stored media, email info@zahavahstudio.com with the subject “Social data deletion” and the name of your business. We will confirm the deletion within 30 days. If you ask Meta to delete your Threads data, Meta tells us and we remove the connected Threads account and its access automatically.

10. Lawful Basis for Processing

Under POPIA we process your personal information on the basis of your consent, the performance of our contract with you, and our legitimate business interests in operating, securing, and improving our services. You may withdraw consent at any time, as described below.

11. Who We Share It With

We do not sell your personal information or share it with marketing syndicates. We share it only with the service providers (“operators”) that help us run our business, each bound to process it only on our instructions:

• ▸Google: Google Analytics 4 and reCAPTCHA (website analytics and spam protection).
• ▸Microsoft: Clarity (session analytics and heatmaps).
• ▸Resend: Delivery of the emails generated by our website forms.
• ▸Vercel: Website hosting and delivery.
• ▸Microsoft Azure: Storage for our articles and their images.

12. Cross-Border Processing

Some of our operators process data on servers located outside South Africa. Where your personal information is transferred across borders, we take reasonable steps to ensure it receives a level of protection consistent with POPIA, including relying on providers that are subject to recognised data-protection frameworks.

13. Data Retention

We keep personal information only for as long as necessary for the purposes set out in this policy, or as required by law, after which it is deleted or anonymised. Enquiry and form data is retained for the duration of our engagement with you and a reasonable period afterward for record-keeping.

14. Data Protection & Storage

Your data is stored within secured environments, and we apply reasonable technical and organisational safeguards to protect it against loss, misuse, and unauthorised access. We handle your information with the same structural rigour we apply to your search architecture.

15. Your Rights Under POPIA

You retain ownership of your data. Subject to POPIA, you have the right to:

• ▸Request access to the personal information we hold about you.
• ▸Request that we correct or update it.
• ▸Request that we delete it or stop processing it.
• ▸Object to processing and withdraw any consent you have given.

16. How to Exercise Your Rights & Complaints

To exercise any of these rights, email info@zahavahstudio.com and we will respond within a reasonable time. If you believe we have not handled your information lawfully, you also have the right to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za, or by email to POPIAComplaints@inforegulator.org.za.

17. Updates to This Policy

We may refine this policy as our infrastructure and the law evolve. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be posted on this page.