Privacy Policy
Last updated: 24 September 2026
This notice explains how Tsoko Art Advisory handles information when you browse our website or app, create an account, purchase an artwork, book an event or contact us. For privacy questions and requests, email mpumi@tsokoart.com.
Who is responsible
Tsoko Art Advisory is a trading name of Creative Guild Studio (Pty) Ltd. We are the responsible party for the personal information described here under the Protection of Personal Information Act, 2013 (POPIA). Our information officer can be reached at mpumi@tsokoart.com.
Information we use
- Accounts: your email address, email verification, name if supplied, account identifier and authentication/session information. These support sign-in, account security and access to your own purchases.
- Purchases: order items, prices, buyer contact information, order and payment references, provider payment status, receipts, invoices and fulfilment records. We use these to verify payment, supply your purchase and resolve problems.
- Event tickets: ticket identifiers, event and tier, holder details when provided, entry QR codes and check-in or cancellation records. These let us issue tickets, confirm entry and prevent repeated admission.
- Enquiries and claims: the contact details, messages and supporting documents you submit, including proof of payment when you choose to provide it. We use them to respond and investigate the request.
- Service and security records: requests to our services, associated technical information and operational or security logs needed to run the platform, investigate failures and protect accounts and transactions.
Payments and service providers
Payfast and Ozow process the payment methods offered at checkout. Payment opens with the payment provider; Tsoko receives the payment references and results needed to reconcile your order. We do not store your card number, card security code or online banking password. The provider's own privacy notice also applies to information you give it.
We use Amazon Web Services for platform hosting, account authentication and data storage, and an email delivery service using SMTP for transactional messages such as confirmations and tickets. These services receive information needed to perform their functions. Information may also be disclosed where required by law or to handle a payment dispute.
Our platform is hosted in Amazon Web Services' Cape Town region. Some providers, such as our email delivery service, may process information outside South Africa. Contact us if you need information about the providers or transfers relevant to your request.
Camera and ticket scanning
The app requests camera permission when an authorised staff member chooses ticket scanning. QR decoding takes place on the device. The scanner sends the decoded ticket code and selected event to Tsoko to check the ticket and record admission; it does not upload the camera feed. You can refuse or withdraw camera permission in your device settings. Public browsing and customer ticket access do not require camera permission.
A ticket QR code or ticket link permits access to that ticket. Keep it private and share it only when you intend to give someone the ticket.
Cookies and device storage
Cookies and browser storage are small pieces of information kept by your browser. We use two kinds. Essential ones make the site work: signing in, keeping your basket, completing checkout and remembering your cookie choice. These are needed to provide the service you ask for, so they are always on. Optional ones are only used if you choose “Accept all” in the cookie notice. If you choose “Essential only”, or make no choice, none of them run.
You can change your choice at any time under , also at the foot of every page. Choosing “Essential only” after accepting stops the optional items from that point on.
| Name | Purpose | Kind | Kept for |
|---|---|---|---|
tsoko_consent | Remembers your cookie choice. | Essential | 12 months |
tsoko_customer_at, tsoko_customer_rt, tsoko_customer_flow | Keep you signed in to your account securely, and complete a sign-in in progress. On the live site these names start with __Host-. | Essential | Up to 30 days (sign-in); 10 minutes (sign-in in progress) |
tsoko_cart (browser storage) | Keeps the works in your basket. | Essential | Until you check out or clear it |
tsoko_at, tsoko_rt, tsoko_exp, tsoko_admin, tsoko_staff_mfa_enrollment | Staff sign-in to the Tsoko admin only. Not set for visitors. | Essential | Up to 24 hours |
| Anonymous visit count (no cookie) | Counts page views and daily visitors so we know which pages are read. Your IP address is used only briefly, in memory, to avoid counting you twice on the same day. It is never stored, and no identifier is kept on your device. | Optional | Daily totals only |
tsoko_cart_stats (browser storage) | A random identifier connects cart contents and activity so we can measure carts left before checkout. No names, email addresses or contact details are included. Only enabled with your optional analytics consent; withdrawing consent stops collection and removes the browser identifier. | Optional | Up to 90 days, or until checkout or consent withdrawal. Reports cover the latest 90 days. |
| Ozow Happy Pay widget | Shows instalment prices next to an artwork or ticket. The widget is loaded from Ozow, which receives your browser's technical details under its own privacy notice. | Optional | Set by Ozow |
We do not use advertising or cross-site tracking cookies, and we do not sell personal information. The website's fonts are served from our own servers, so browsing does not send your details to a font provider. When you choose to pay, the payment provider's pages set their own cookies under its own notice. You can also clear cookies and storage in your browser, although this can sign you out or empty your basket.
The native app stores refresh credentials and unfinished checkout information in protected device storage so sign-in and an interrupted purchase can resume. Signing out clears the app's sign-in credentials.
Keeping and deleting information
You can request account deletion from My account on the website or the Account screen in the app. See Delete your account for the steps, including access after uninstalling the app.
Account deletion revokes account access and removes the sign-in account and profile information. If the identity service is temporarily unavailable, access is revoked while deletion retries automatically. The result screen distinguishes completed deletion from a request still being processed.
Deletion does not erase financial transaction, invoice and payment records required for legal obligations or disputes, paid ticket entitlements and records needed to fulfil them, or the minimal deletion record used to block old account tokens. Keep your existing ticket confirmation links before deleting your account.
Retention depends on the record, the purpose for which it is needed and applicable legal or dispute requirements. You can contact us to ask about specific retained information or request access, correction or deletion of information outside your account profile. We may need to verify your identity before acting on a request.
Your rights and choices
Under POPIA you may ask whether we hold personal information about you and request access to it, ask us to correct or delete it, and object to processing based on our legitimate interests. You may also withdraw consent you have given, such as for optional cookies, at any time. Withdrawal does not affect processing that already took place. To make a request, raise a concern or ask about retention, contact mpumi@tsokoart.com. Please describe the request without sending passwords, card security codes or banking login details. Account deletion can be started directly from the account controls and does not need an email request.
If you are not satisfied with how we handle your information, you have the right to lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za.
We update this notice when our practices change. The date above identifies the latest published version.