Privacy Policy

We treat your personal information the way we treat the rugs in our care — with attention, and without carelessness.

This policy explains what personal information Heriz Gallery collects when you visit herizgallery.co.za, use our services, or make a purchase, why we collect it, who we share it with, and the rights you have over it. We process personal information in line with the Protection of Personal Information Act (POPIA).

Please read this policy carefully. By using or accessing the site and our services, you acknowledge the collection, use and disclosure of your information as described here. If you do not agree with it, please do not use the site.

Last updated: 27 August 2026

Who we are

Heriz Gallery CC (registration number 1999/060933/23) is the responsible party for your personal information. We are a Persian and Oriental rug gallery based at The Straight Shopping Centre in Fourways, Johannesburg, from a family business begun in Iran in the 1950s. Our contact details are at the foot of this page.

We will not bother you

Two things on this page are often confused, so we would rather be plain about both.

• Marketing emails and messages are opt-in only. If you have not asked to hear from us, you will not. Every message we do send carries a one-click way to stop them, and we act on it immediately.
• The analytics and advertising tools described below never message you. They help us understand how the site is used and show our rugs to the right people online. Nobody receives an email, an SMS or a call from Heriz Gallery because of them.

We are a gallery, not a mailing list. We would rather send you one message worth reading than a dozen that are not.

What we collect

The information we collect depends on how you deal with us. We collect only what we need to sell you a rug, deliver it, service it, and stay in touch if you want us to.

Information you give us directly

• Contact details — your name, email address, telephone number, and delivery and billing addresses.
• Order information — what you bought, your billing and shipping address, payment confirmation, email address and phone number.
• Account information — if you create an account, your username, password and information used to keep your account secure.
• Service information — details relevant to cleaning, refurbishment, in-home consulting, insurance-claim assistance, and annual carpet-cleaning vouchers, which are part of our long-standing showroom business.
• Customer support information — whatever you choose to include when you contact us by email, WhatsApp, or a form on the site.

Some features may require certain information. You can decline, but we may then be unable to complete that order or provide that service.

Information we collect automatically

When you use the site we automatically collect certain usage data through cookies, pixels and similar technologies. This may include device and browser information, your network connection and IP address, and how you move through and interact with the site. This is described further under Cookies below.

Information we receive from third parties

We may receive information about you from service providers who collect it on our behalf — for example, the payment providers available at checkout, which handle your payment details so we can fulfil your order. Any information we receive from third parties is handled in line with this policy.

How we use your information

We use your personal information only for the purposes for which it was collected and agreed with you.

Providing products and services

To process your payment, fulfil your order, arrange delivery or collection, invoice you, assist with insurance claims, create and manage your account, handle returns and exchanges, and send you notifications about your order. We also use it to understand your requirements and advise you on the right piece, and to provide cleaning, refurbishment and consulting services and issue cleaning vouchers.

Marketing and advertising

Where you have opted in, or where you are an existing customer with whom we have an ongoing relationship, we send news of new arrivals and promotions by email or SMS, and we may show you advertising for our products on other websites. Every marketing message carries a way to unsubscribe, and you may opt out at any time. Opting out of marketing does not affect messages we must send you about an order.

Security and fraud prevention

To detect, investigate and act on possible fraudulent, illegal or malicious activity, and to confirm your identity. If you hold an account, you are responsible for keeping your login details safe — please do not share them, and tell us at once if you believe your account has been compromised.

Support and improvement

To respond to your questions, provide after-sales support, keep our records accurate, run our business responsibly, and meet our legal, audit and record-keeping obligations.

Special personal information

We do not seek or knowingly collect special personal information — such as information about your health, race, religion or beliefs — and we do not use your information to infer characteristics of that kind. We would only ever process such information with your consent or where the law specifically allows it.

Cookies and website tracking

Like most websites, we use cookies and similar technologies to run the site, remember your preferences, understand how the site is used, and measure our marketing. Most browsers accept cookies by default; you can set yours to refuse or remove them, though some features may then stop working.

We use the following third-party tools, which set their own cookies and receive information about your visit:

• Google Analytics — to understand how visitors use the site, so we can improve it.
• Meta Pixel — to measure and target advertising on Facebook and Instagram. This shares certain browsing and purchase activity with Meta.
• Google Maps — the showroom map on our site is embedded from Google, which may collect data about your visit to that page.
• Our email and SMS platform — to send the communications you have opted into, and to see whether messages were opened or clicked.

You can control non-essential cookies through your browser settings and through your ad preferences with Google and Meta directly.

Who we share it with

We share personal information only with the service providers who help us run the gallery and fulfil your order, and only as far as they need it. We put agreements in place requiring them to protect your information to the standard POPIA requires, and to use it only for the purpose we gave it to them.

Who	Why
Shopify	Hosts our online store and processes your order and checkout.
Payfast and other payment providers available at checkout	Processes your payment securely. We do not see or store your full card or banking details.
Our delivery partners and couriers	Delivers your rug to the address you give us.
Google and Meta	Website analytics and advertising, as described under cookies above.
Our email / SMS platform	Sends the marketing you have opted into.

We may also disclose your information: at your direction or with your consent, such as to arrange delivery or through a social-media integration; to our affiliates in the ordinary running of the business; in connection with a business transaction such as a sale, merger or restructuring; and where the law requires or permits it, or where we need to protect our rights or those of our customers. Where we are permitted to, we will tell you.

Third-party websites and links

Our site may link to websites or platforms we do not control — for example, our social-media pages. If you follow a link to another site, please review its own privacy and security terms. We are not responsible for the content, privacy or security of sites we do not operate. Information you post in public or semi-public places, including social media, may be visible to others.

How we keep it safe

We are legally obliged to protect the personal information we hold and to prevent unauthorised access to or use of it. We review our security controls and processes on an ongoing basis. They cover physical security, computer and network security, access control, secure communications, retention and disposal, acceptable use, governance, monitoring, and responding to any security incident.

No system is perfectly secure, and information sent over the internet is never entirely without risk. Please do not send us sensitive information through insecure channels.

How long we keep it

We keep your personal information only as long as we need it for the purpose we collected it, or as long as the law requires us to — for example, tax and accounting records must be kept for a set period. When we no longer need it, we securely delete or de-identify it.

Your rights

Depending on your circumstances, you have the following rights over your personal information. You may exercise any of them by contacting us using the details below, and we will not treat you unfairly for doing so.

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to update or correct information that is wrong or out of date.
• Deletion — ask us to delete information we no longer have a lawful reason to keep.
• Objection — object to our processing of your information in certain circumstances, including for direct marketing.
• Withdraw consent — where we rely on your consent, withdraw it at any time.

To protect you, we will ask for a copy of your ID to confirm your identity before we act on a request about your information.

Children

Our site and services are not intended for children, and we do not knowingly collect personal information about children. If you believe a child has given us their information, please contact us and we will delete it.

Information outside South Africa

Some of our service providers — for example, those hosting the site or sending email — process information on servers outside South Africa. Where we transfer your information out of the country, we rely on providers who offer a comparable level of protection to that required under POPIA.

Complaints

Please raise any concern with us first — we would rather put it right ourselves. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa at complaints.IR@justice.gov.za.

Changes to this policy

We may update this policy from time to time to reflect changes in how we work or what the law requires. We will post the current version here and update the date at the top.