Privacy Policy

1. Who We Are

This privacy policy applies to the Visual Arts Cluster of South Africa NPC (Registration No. 2025/355907/08), trading as VACSA, operating the website vacsa.org (“the Platform”).

VACSA is the designated visual arts cluster under the Department of Sport, Arts and Culture (DSAC) national creative economy framework, operating under a formal Memorandum of Agreement.

Information Officer: Fhumulani Msandiwa (Secretary)
Contact: info@vacsa.org

2. What Information We Collect

When you join the constituency mapping or interact with our platform, we may collect:

Identity information: Name, ID number, email, phone, physical address, province, municipality
Professional information: Artistic disciplines, development tier, years active, portfolio links, practice description, business registration status
Journey information: Challenges, support needs, financial sustainability methods, exhibition participation, mentoring status
Preferences: Communication preferences, language preference, newsletter opt-in
Technical information: IP address, browser type, pages visited, referral source (via cookies and analytics)
Event information: Workshop attendance, event registrations, dietary and accessibility requirements

3. Why We Collect It

We process your personal information for the following purposes:

Constituency mapping: Building a national picture of the visual arts sector to inform policy, funding, and infrastructure
Government reporting: Providing aggregated (not individual) data to DSAC under our Memorandum of Agreement
Opportunity matching: Connecting you with relevant grants, exhibitions, residencies, and development programmes
Communication: Sending you sector updates, event invitations, and opportunity alerts (only if you opt in)
Mentorship: Matching experienced practitioners with emerging artists in the same discipline and province
Research: Contributing to sector-level research (your data is anonymised in publications)

4. Legal Basis (POPIA)

We process your personal information under the Protection of Personal Information Act (POPIA), Act 4 of 2013, on the following grounds:

Consent: You explicitly consent when submitting the constituency mapping form
Legitimate interest: Building sector infrastructure is in the legitimate interest of the visual arts community
Legal obligation: Reporting to DSAC under our Memorandum of Agreement

5. Who We Share With

We share your information only as follows:

DSAC: Aggregated constituency data (counts, demographics, tier distribution) — never individual personal data without your explicit consent
Service providers: Supabase (database hosting), Vercel (website hosting) — bound by data processing agreements
Provincial chapters: Your province and contact details to connect you with your local VACSA chapter

We never sell, rent, or share your personal information for commercial purposes.

6. How Long We Keep It

We retain your constituency mapping data for as long as VACSA operates the national mapping programme, or until you request deletion. Specifically:

Active constituency profiles: retained while you remain part of the mapping
Event registration data: 2 years after the event
Financial records: 5 years (as required by SA tax law)
Communication logs: 1 year

7. Your Rights

Under POPIA, you have the right to:

Access: Request a copy of your personal information
Correction: Request correction of inaccurate information
Deletion: Request deletion of your data (subject to legal retention requirements)
Object: Object to the processing of your personal information
Portability: Request your data in a structured, machine-readable format
Withdraw consent: Withdraw your consent at any time without affecting prior processing

To exercise any of these rights, email info@vacsa.org with the subject “Data Rights Request”.

8. Cookies

We use cookies for essential website functionality and anonymous analytics. See our full Cookie Policy for details.

9. Security

Your data is stored securely on Supabase (PostgreSQL) with row-level security policies. All data transmission uses HTTPS encryption. Access to administrative functions is restricted to authorised VACSA team members via Google OAuth authentication.

10. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Significant changes will be communicated via email to registered constituency members.

11. Complaints

If you are not satisfied with how we handle your personal information, you may lodge a complaint with:

Information Regulator (South Africa)
Email: inforeg@justice.gov.za
Website: justice.gov.za/inforeg