Privacy Policy

1. Who we are

trôve studio sells pre-owned, vintage clothing and jewellery through this website. We are a virtual, online-only business based in Pretoria, South Africa, with no public-facing premises. We are the ‘responsible party’ for your personal information under POPIA (and, where it applies to you, the ‘controller’ under the GDPR).

Trading name

trôve studio

Legal name

Trôve Studio

Legal status

Sole proprietorship trading as Trôve Studio (CIPC company registration in progress)

Email (legal notices & compliance queries)

support@trove-studio.com

Our Information Officer is the owner of the business, registered with the Information Regulator as required by POPIA. Send any privacy question, access or deletion request, or complaint to support@trove-studio.com; general order questions can still go to hello@trove-studio.com.

2. Scope of this policy

This policy covers personal information we collect through this website: browsing it, creating an account, placing an order, subscribing to our newsletter, and contacting us. It does not cover the practices of third-party sites we link to, including our Instagram and Facebook pages, Yoco’s payment page or Google’s own services - read their own privacy policies for that.

3. What we collect and why

Account information

If you create an account we store your name and email address so you can sign in, see your order history and save addresses. Our authentication provider (Supabase) handles your password and we cannot see it. If you sign in with Google, Google gives us only your name and email address confirmed by your Google account - never your Google password.

Order information

When you order, we store your name, email address, delivery address, phone number if you give one, and the pieces you bought with their prices and the order total. We use this to process, pay for and deliver your order, to contact you about it, to handle returns or faults, and to keep the sale records that South African tax and consumer law require us to keep.

Payment information

You pay on a secure page run by our payment provider, Yoco. You enter your card or wallet payment details there, directly with Yoco; they never pass through this website and we can’t see or store them. When you go to pay we send Yoco the order total, our order reference and the names and prices of the pieces in your order, but not your name, email address or delivery address. Yoco then tells us whether the payment succeeded, and we store that result together with Yoco’s payment reference and the time of payment on your order, so we can confirm it, dispatch it and deal with any refund. We email you a confirmation when payment is confirmed and a message when your order ships. Yoco handles whatever it collects from you itself under its own privacy policy.

Saved addresses

If you save a delivery address to your account, we keep it so checkout is quicker next time. You can add, edit or delete saved addresses from your profile at any time.

Newsletter

If you subscribe, we store your email address and use it only to send you news about the studio, new pieces and offers. We only email marketing to people who have opted in, in line with section 69 of POPIA and section 45 of the ECT Act, and every send includes a way to unsubscribe.

Messages you send us

When you use the contact form we store your name, email address, the subject you chose and your message, so we can reply and keep a record of the conversation in case you get back to us.

Technical and usage information

Like most websites, our hosting provider automatically logs basic technical data for every request the site receives - for example your IP address, browser type, the page requested and the time of the request - in server logs, to keep the site secure, diagnose faults and prevent abuse. We do not use this data to build a marketing profile of you, and we don’t run any advertising, analytics or tracking scripts on this site beyond what is described in this policy.

Do you have to give us this information?

No, but some of it is needed for what you are asking us to do: we can’t deliver an order without your name, email address and delivery address, or reply to a message without an email address. Creating an account and subscribing to the newsletter are both optional - you can buy as a guest and browse without subscribing.

4. How we collect it

We collect most information directly from you, when you create an account, place an order, save an address, subscribe, or use the contact form. Yoco tells us whether your payment succeeded. If you choose ‘Continue with Google’, we receive your name and email address from Google with your permission. Our hosting infrastructure collects basic technical log data automatically, as described above.

5. Our lawful grounds for using it

Under POPIA section 11, we only process your personal information where at least one of the following applies:

• it is necessary to carry out your order, manage your account, or respond to a request you have made (performance of a contract, or steps you asked us to take before one);
• the law requires us to keep it, for example tax and consumer transaction records;
• you have given us consent, as with the newsletter and, where used, cookies that aren’t strictly necessary; or
• we have a legitimate interest in running, securing and improving the site and preventing fraud or misuse, weighed against your privacy - for example keeping server logs to keep the site safe.

If you are in the European Union or United Kingdom, these same grounds correspond to the GDPR’s lawful bases of contract, legal obligation, consent, and legitimate interests respectively (see section 13 below).

6. Cookies and browser storage

We keep this to what the site needs to work, and we don’t run advertising, analytics or cross-site tracking cookies:

• Session/authentication cookies, set by our authentication provider, keep you signed in between visits. These are strictly necessary for the site to work and can’t be switched off if you want to sign in.
• Payment link - when you go to pay, your browser keeps a short-lived record of your Yoco payment link in session storage, so the Back button doesn’t start a second payment. It is cleared when you return from Yoco, and disappears when you close the tab.
• Shopping bag - the pieces in your bag are kept in your browser’s local storage (not a cookie), so your bag survives a page reload. Nothing about your bag is sent to us until you go to pay.

Because these are strictly necessary to provide the service you’ve asked for (staying signed in, keeping your bag), they don’t require a cookie-consent banner under South African or EU/UK law. You can block or delete cookies and local storage in your browser settings at any time, though doing so will sign you out and may clear your bag.

7. Who else processes your information

We don’t sell, rent or trade your personal information to anyone. We share it only with the service providers that run this website for us (our ‘operators’ under POPIA, or ‘processors’ under the GDPR), and only as much as each one needs to do its job:

• Supabase - our database, authentication and image storage provider. Our data is hosted in the European Union (Ireland).
• Vercel - hosts and serves this website, and necessarily processes technical request data (such as IP addresses) to do so.
• Yoco - processes your payment on its own secure page, as described under ‘Payment information’ in section 3. Yoco is a South African payment provider; it is the responsible party for the payment details you give it.
• Resend - sends the emails about your order (confirmation and dispatch). It receives your name, email address, delivery address and the contents of the order for that purpose.
• Google - provides the optional ‘Continue with Google’ sign-in, and the address-lookup feature you can use when saving a delivery address; what you type into that address search is sent to Google to find matching addresses. Google also supplies the fonts this site is displayed in: your browser requests them directly from Google when a page loads, which shares your IP address with Google.

We require each of these providers, by agreement or by their own standard terms, to use your information only to provide their service to us and to protect it appropriately. We do not currently use a courier integration that itself receives your personal information, and this policy will be updated before that changes. We may also disclose personal information where the law requires or permits it, for example to comply with a court order, tax authority request, or to establish or defend a legal claim.

8. International transfers of your information

Some of our service providers store or process personal information outside South Africa - in particular, Supabase hosts our database in the European Union (Ireland), and Google, Vercel and Resend operate infrastructure that may be outside South Africa. Section 72 of POPIA allows us to transfer personal information to a foreign country where, among other grounds, that country’s law provides an adequate level of protection comparable to POPIA, or where we have an agreement in place with the recipient that requires them to protect the information to a comparable standard, or where the transfer is necessary to perform our contract with you. We rely on the European Union’s data protection framework (which is treated as providing an adequate level of protection) and on our contractual arrangements with these providers when your information is transferred to them.

9. How long we keep it

We only keep personal information for as long as we have a genuine reason to:

• Account details are kept while your account is open. If you delete your account, it is permanently removed after 30 days; until then you can reinstate it simply by signing in again.
• Order and transaction records (including Yoco’s payment reference) are kept for five years after the tax year in which the transaction occurred, in line with the record-keeping periods required under the Tax Administration Act, 2011 and general commercial practice for consumer transaction records.
• Newsletter subscriptions are kept until you unsubscribe or ask us to delete them.
• Contact-form messages are kept for as long as we reasonably need them to deal with your enquiry and for a short period afterwards in case you follow up, and are then deleted.
• Server/technical logs are kept for a limited period (typically no more than 12 months) for security and diagnostic purposes, and then automatically age out.

Where we must keep information for longer to comply with the law, resolve a dispute, or enforce our agreements, we keep only what is needed for that purpose and for no longer than necessary.

10. How we protect it

We take reasonable technical and organisational measures, as POPIA section 19 requires, to keep your personal information secure and to prevent its loss, unauthorised access, interference or disclosure. In practice: traffic to and from this site is encrypted in transit (HTTPS/TLS); our database enforces row-level access controls so one customer can never read another customer’s orders, addresses or account details, and only authenticated store administrators can see the full order list; authentication and password handling is delegated to our authentication provider rather than handled by us directly; card and wallet payment details are entered only on Yoco’s own payment page and are never entered into, transmitted through, or stored on this website; and payment confirmations from Yoco are cryptographically signed, so nobody can mark an order paid by faking one. No method of transmission or storage is completely secure, but if we become aware of a security compromise involving your personal information, we will notify you and the Information Regulator without undue delay, as POPIA section 22 requires.

11. Automated decision-making

We don’t use automated processing to make any decision about you that would have a legal or similarly significant effect on you (for example, we don’t profile you for pricing or credit purposes, or automatically refuse an order because of who you are). Pieces are held for whoever reaches checkout first, and an order is marked as paid automatically when Yoco confirms the payment, but neither involves any judgement about you personally. If that ever changes, we will update this policy first and give you the information POPIA section 71 and, where applicable, GDPR Article 22 require.

12. Your rights under POPIA

As a data subject under POPIA, you have the right to ask us to:

• confirm, free of charge, whether we hold personal information about you;
• give you a copy of the personal information we hold about you, within a reasonable time and for no more than a prescribed, reasonable fee if one applies;
• correct or update personal information that is inaccurate, out of date, incomplete, misleading, or obtained unlawfully;
• delete or destroy a record of personal information we are no longer authorised to keep;
• object, on reasonable grounds, to us processing your personal information;
• object to your personal information being processed for direct marketing, at any time and free of charge; and
• not be subjected to a decision based solely on automated processing that affects you legally or similarly significantly, without the safeguards described in section 11 above.

To exercise any of these, email support@trove-studio.com. We will respond within a reasonable time and may need to verify your identity first, to make sure we don’t hand your information to someone else. You can also update your name, manage saved addresses and delete your account yourself at any time from your profile, and unsubscribe from the newsletter using the link in any newsletter email or by emailing us.

If you are unhappy with how we have handled your information or responded to a request, you can complain to South Africa’s Information Regulator at POPIAComplaints@inforegulator.org.za or through inforegulator.org.za, or through their online complaints portal at eservices.inforegulator.org.za.

13. If you are visiting from the European Union, the United Kingdom, or elsewhere

trôve studio is established in South Africa, and while we ship to a limited number of other countries at a customer’s request, we do not market or direct our pieces to, or maintain a business presence in, the European Union (‘EU’) or United Kingdom (‘UK’). Because of that, we don’t consider this site to fall within the extraterritorial scope of the EU General Data Protection Regulation (‘GDPR’) or the UK GDPR under their Article 3(2). That said, if you browse this site or create an account from the EU, UK, or elsewhere, we apply the same protections and security described in this policy to your information regardless of where you are, and as a matter of good practice we recognise the following rights, which mirror the rights POPIA already gives you in sections 12 above: the right of access, rectification, erasure (‘right to be forgotten’), restriction of processing, data portability, and objection to processing, including for direct marketing. To exercise any of these, email support@trove-studio.com.

If we ever process your personal information on a lawful basis under this section, the GDPR/UK GDPR equivalents of our POPIA grounds in section 5 are: performance of a contract (Article 6(1)(b)), compliance with a legal obligation (Article 6(1)(c)), consent (Article 6(1)(a)), and legitimate interests (Article 6(1)(f)). If you are in the EU or UK, you may also lodge a complaint with your local supervisory authority - in the UK, the Information Commissioner’s Office (ico.org.uk) - in addition to, or instead of, South Africa’s Information Regulator.

We do not sell personal information, and have not sold personal information in the preceding 12 months, as those terms are defined under the California Consumer Privacy Act or similar laws that may apply to a small number of visitors from other jurisdictions.

14. Children

This website and its checkout are meant for adults. We do not knowingly collect personal information from children, and section 3 of these terms of use for the site requires a parent or guardian to be involved if a user is under 18. If you believe a child has given us personal information without appropriate consent, email support@trove-studio.com and we will delete it.

15. Changes to this policy

We may update this policy from time to time, for example if we start using a new service provider or the law changes. If we make a material change, we will update the date at the top of this page and, where appropriate, let account holders and newsletter subscribers know by email. See also our Terms of Service.

16. Contact us

For any question about this policy or your personal information, email support@trove-studio.com. For a general order or product question, email hello@trove-studio.com.