How we look after your information.

The Drop Network (Pty) Ltd (registration number 2026/741781/07), trading as Drop, is the responsible party for personal information collected through dropstudio.co.za, as defined in the Protection of Personal Information Act 4 of 2013 (POPIA).

Our Information Officer can be reached at hello@dropstudio.co.za with “Privacy” in the subject line. This policy explains what we collect, why, who we share it with and the choices you have. It applies to buyers, sellers and visitors.

• Account details. Your name, email address and sign-in credentials. Sign-in is handled by Clerk, our authentication provider, which also records the device and time of each sign-in for security.
• Seller details. Your store name and branding, payout bank account details, whether you are VAT registered, and your payout history.
• Order details. The recipient’s name, delivery address, phone number, what was ordered, and the order history.
• Payment confirmation. Our payment providers tell us that a payment succeeded and give us a reference. We never receive or store card numbers.
• Designs and uploads. Artwork, images and text you add in the design tool, and the products you create with them.
• Messages. Emails and support requests you send us, and our replies.
• Usage data. Pages visited, actions in the design tool, browser and device type, approximate location from your IP address, and the referring site. This comes from cookies and analytics tools described below.

POPIA requires a lawful basis for each use. Ours are:

• To provide the service you asked for (performance of a contract): creating your account, printing and delivering orders, running your store, paying your margins, answering support requests.
• To meet legal obligations: keeping accounting, tax and payout records, issuing statements and tax invoices, and responding to lawful requests from authorities.
• Our legitimate interests, where they do not override your rights: preventing fraud and abuse, securing the platform, understanding how the site is used so we can improve it, and reviewing designs for content that breaks our terms.
• Your consent: marketing emails about new products and features. You can withdraw consent at any time using the unsubscribe link or by emailing us. Order and account emails are not marketing and continue while you have an account.

We share personal information only with the operators we need to run the service. Each one may use it only for the purpose we set and must protect it. They are:

• Print and fulfilment. The people who print and pack your order see the design, the product and the delivery details.
• Couriers receive the recipient’s name, address and phone number to deliver the parcel.
• Payment and payout provider. Ozow processes buyer payments and pays out sellers and print partners, so it receives the bank details needed for an EFT.
• Clerk provides sign-in and account security.
• Postmark sends our order, payout and account emails.
• Google Analytics and PostHog give us usage statistics. Where possible, IP addresses are shortened and data is aggregated.
• Hosting. Our servers and database run in a data centre in Johannesburg, South Africa. Uploaded designs are stored in the same region.

Sellers can see the orders placed in their own store, including the buyer’s name and what was ordered, so they can support their customers. Sellers must use that information only for the order and treat it under this policy.

We do not sell personal information. We may disclose it where the law requires, to protect our rights, or to a successor if the business is sold, in which case this policy continues to apply.

Your core data is stored in South Africa. Some of the providers above, including Clerk, Postmark, Google and PostHog, process data in the United States or the European Union. We only use providers that are bound by contracts or laws giving your information protection substantially similar to POPIA, as section 72 of the Act requires.

• Account and store data: while your account is open, then deleted or anonymised within 90 days of closure, unless we must keep it longer.
• Order, payment and payout records: five years after the transaction, as the Companies Act and tax legislation require.
• Designs: while they are in your account or store, plus the time needed to fulfil open orders and handle reprints.
• Support messages: up to two years after the matter is closed.
• Analytics data: up to 26 months, then aggregated.

Under POPIA you can:

• ask what personal information we hold about you and get a copy;
• ask us to correct or delete information that is wrong, out of date or no longer needed;
• object to processing based on our legitimate interests;
• withdraw consent to marketing at any time;
• ask us not to use your information for direct marketing;
• complain to the Information Regulator if you are not satisfied with our response.

Email hello@dropstudio.co.za with “Privacy” in the subject line. We may ask you to confirm your identity first, and we respond within 30 days. The Information Regulator (South Africa) can be reached at inforegulator.org.za or complaints.IR@justice.gov.za.

We use two kinds of cookies and similar technologies:

• Essential cookies keep you signed in, remember your cart and your choices while you move around the site. The site does not work without them.
• Analytics cookies from Google Analytics and PostHog tell us which pages are used and where the design tool loses people. They do not identify you by name.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop sign-in and checkout from working.

Data travels between you and Drop over encrypted connections. Access to personal information inside the company is limited to the people who need it for their work. Card details never touch our systems. If a breach ever affects your information we will notify you and the Information Regulator as POPIA requires.

Drop is for people 18 and older. We do not knowingly collect information from children without a parent or guardian’s consent. If you believe a child has given us personal information, email us and we will remove it.

We may update this policy as the service or the law changes. The date at the top shows the current version, and we will tell account holders by email about material changes.

Privacy questions and requests go to the Information Officer at The Drop Network (Pty) Ltd, hello@dropstudio.co.za. For everything else, see our Terms of Service.