Legal

Privacy Policy

Last updated June 2026

Who we are

Handcrafted By Luke is a small, one-person leather workshop based in South Africa. We operate this website at https://handcraftedbyluke.co.za.testingarea.co.za. For any privacy-related queries contact us at orders@handcraftedbyluke.co.za.

This policy applies to all personal information collected through this website, including when you make a purchase, submit an order enquiry, or subscribe to our newsletter. We comply with the Protection of Personal Information Act, 2013 (POPIA) and relevant South African consumer protection laws.

What information we collect

We collect information you actively provide to us, and limited technical data generated by your visit:

When you place an order or enquiry

  • Full name and email address
  • Phone number (optional)
  • Delivery address — street, suburb, postal code, province
  • Order details: product chosen, options, and any message you include
  • Payment reference number from PayFast (we never store your card number, CVV, or banking credentials — these are handled entirely by PayFast)
  • Shipping method selected and calculated cost

When you subscribe to the newsletter

  • Email address only
  • Date and source of subscription

If you save your details for future purchases

  • Name, email, phone, and delivery address are stored in our database against your email address so future checkouts can be pre-filled. You opt in explicitly via a checkbox at checkout and can request deletion at any time.

If you leave a product review

  • Name, email address, star rating, and the text of your review
  • For customers who purchased before this website existed, or directly without using it, we may already hold your name and email address from that sale and use them to send you a review invitation

Technical / automatic data

  • Server access logs (IP address, browser type, pages visited) — retained for up to 30 days for security purposes, not used for marketing
  • A session cookie used only to maintain your login state if you use the admin panel (not set for ordinary visitors)
  • An optional ll_customer_email cookie, set for 12 months if you tick "Save my details" at checkout, used solely to pre-fill your name and address on your next visit

How we use your information

  • To process and fulfil your order or respond to your enquiry
  • To generate and send you a tax invoice after confirmed payment
  • To arrange collection and delivery of your parcel via our chosen courier
  • To send you your waybill number and tracking information
  • To send you the newsletter, if you have subscribed and confirmed your email
  • To invite you to leave a review of your order — either automatically a couple of weeks after your order is marked as shipped, or occasionally by direct invitation for past or off-platform customers
  • To improve this website and detect security issues (technical logs only)

We do not use your personal information for automated decision-making or profiling.

Product reviews

If you submit a product review, we store your name, email address, star rating, and review text. Every review is read by us before publication — nothing is shown publicly without our approval.

If we approve your review, your name, star rating, review text, and the product reviewed are displayed publicly on this site, alongside any reply we post. Your email address is never displayed publicly.

You can decline a review invitation, or ask us to remove a published review, at any time by emailing orders@handcraftedbyluke.co.za.

Who we share your information with

We share the minimum necessary information with the following third parties in order to fulfil your order. All parties are required to treat your data in accordance with applicable law:

PayFast (payment processor)

Payments on this site are processed by PayFast (Pty) Ltd, a Payment Card Industry Data Security Standard (PCI-DSS) compliant payment gateway registered in South Africa. When you click "Pay via PayFast", you are redirected to PayFast's hosted payment page. We pass them your name, email address, and order amount. PayFast's own privacy policy governs how they handle your card details: payfast.co.za/privacy-policy. We receive back a payment reference number only — we never see your card details.

The Courier Guy (shipping)

Domestic deliveries are arranged through The Courier Guy (Pty) Ltd. To create a waybill and dispatch your parcel we share your name, phone number, and delivery address with them. Shipping rates shown at checkout are calculated in real time using The Courier Guy's published rate schedule (inclusive of VAT, effective 6 May 2026) based on the parcel size and service type you select — no markup is applied. The Courier Guy's privacy policy: thecourierguy.co.za/privacy-policy.

Group / umbrella entities

Handcrafted By Luke may operate alongside other creative and commercial projects under common ownership. Your personal information may be shared with these related entities for the purposes of fulfilling orders, providing customer support, or communicating about products and services that may be of legitimate interest to you. We will only do so where there is a lawful basis under POPIA and, in the case of direct marketing, where you have provided consent or there is an existing customer relationship. You have the right to opt out of such communications at any time.

Meta Platforms — Threads and Instagram publishing

We use the Meta Graph API to publish content (journal articles and gallery images) directly from our admin tools to our Threads and Instagram accounts. When we publish:

  • No visitor data is shared with Meta — publishing happens server-side, between our server and Meta's API, only when an administrator manually triggers it
  • For Instagram posts, Meta's servers fetch the image directly from a publicly accessible URL on this site
  • We store a Meta API access token in our admin settings — this token is private and never exposed to visitors
  • No Meta tracking scripts, pixels, or cookies are loaded on this website — the API integration is entirely back-end. Visitors to this site are not tracked by Meta through our website

When you visit our Threads or Instagram profiles directly, Meta's own privacy policy applies: Instagram Privacy Policy · Threads Privacy.

We do not sell your data

We do not sell, rent, or trade your personal information to unrelated third parties for marketing or any other commercial purpose.

How we store and protect your data

Your data is stored in a password-protected MySQL database hosted on a South African web server. Connections to this site are encrypted via HTTPS/TLS. Access to the database is restricted to the site administrator. We apply reasonable technical and organisational measures to prevent unauthorised access, disclosure, alteration, or destruction.

We retain order records indefinitely for accounting and tax purposes (as required by law). Newsletter subscriber records are retained until you unsubscribe or request deletion. Saved customer profiles are retained until you request deletion.

Your rights under POPIA

As a data subject you have the right to:

  • Access — request a copy of the personal information we hold about you
  • Correction — request correction of inaccurate or incomplete information
  • Deletion — request deletion of your personal information (subject to legal retention requirements)
  • Objection — object to the processing of your personal information for direct marketing
  • Complaint — lodge a complaint with the Information Regulator of South Africa at justice.gov.za/inforeg

To exercise any of these rights, email us at orders@handcraftedbyluke.co.za. We will respond within a reasonable time and no later than 30 days.

Cookies

This site uses the minimum cookies necessary to function:

  • Session cookie — temporary, used only for the admin login. Not set for visitors.
  • ll_customer_email — optional, 12-month lifespan. Set only when you tick "Save my details" at checkout. Used solely to pre-fill your name and address on your next visit. You can delete it by clearing your browser cookies at any time.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking or advertising cookies. No social media tracking scripts from Meta, TikTok, or any other platform are loaded on this website. Our social media presence (Instagram, Threads) is managed via server-side API calls that do not set cookies on your browser or track your visit.

Children

This site is not directed at children under the age of 18. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the site after a change constitutes acceptance of the updated policy.

Contact

For any privacy-related questions or requests: orders@handcraftedbyluke.co.za