Privacy policy
Last updated: January 10, 2026
Strike Force Studio ("the Studio," "we," "us," or "our") operates this store and website, including all related information, content, features, tools, products, and services, to provide you, the customer, with a curated shopping and artistic experience (the "Services"). Strike Force Studio is powered by Shopify, which enables us to provide these Services to you.
This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. For the purposes of the South African Protection of Personal Information Act (POPIA), Strike Force Studio is the "Responsible Party," and for the EU General Data Protection Regulation (GDPR), we are the "Data Controller."
Governing Law & Fallback: By using and accessing any of the Services, you acknowledge that you have read and understood this Privacy Policy. You further agree that for any unforeseen matters, disputes, or administrative details not explicitly addressed in this policy, the laws of the Republic of South Africa shall apply and take precedence.
If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.
Personal Information We Collect or Process
When we use the term "personal information," we refer to information that identifies or can reasonably be linked to an identifiable, living, natural person, or where applicable, an identifiable, existing juristic person (such as a company or trust) as defined by POPIA.
Personal information does not include data that has been de-identified or anonymized so that it cannot identify you. We collect and process the following categories of information as permitted or required by applicable law:
Contact Details: Name, physical address, billing address, shipping address, phone number, and email address.
Financial Information: Payment card information, transaction details, and payment confirmations.
Studio Note: While we process payments through Paystack, we do not store full credit card numbers. We retain only the transaction data required for SARS tax compliance.
Account Information: Your username, password, security questions, and preferences.
Transaction Information: Items viewed, cart history, wishlists, purchases, returns, exchanges, or cancellations.
Communications: Information included in support inquiries, direct emails to modo@strikeforcestudio.com, or social media interactions.
Device & Usage Information: IP address, browser type, network connection, and interaction patterns within the Services (collected via Shopify cookies and unique identifiers).
Project-Specific Data (Artist Requirement): For bespoke commissions, we may process reference images, descriptions, or physical likenesses provided by you. Insofar as these contain "Special Personal Information" (as defined by POPIA Section 26) or biometric-style data, we process this only to perform the contracted artistic service.
Personal Information Sources
We collect personal information about you from the following sources:
Directly from You: This is our primary source of information. It includes data provided when you create a Zoho or Shopify account, visit or navigate our Services, communicate with us via email (modo@strikeforcestudio.com), or submit artistic references and commission briefs.
Automatically through the Services: When you use our products or visit our website, we automatically collect technical data from your device. This includes the use of cookies and similar tracking technologies to understand your preferences and site interactions.
From Our Service Providers: We engage trusted third parties to perform functions on our behalf. These include:
Payment Processors: Specifically Paystack, which provides us with payment confirmations and transaction details.
Accounting Platforms: Zoho Books, where your invoicing and project data are securely stored for tax and project management.
Shipping Partners: Courier services (e.g., The Courier Guy/Pudo) that provide us with delivery status updates.
From Partners or Other Third Parties: In some cases, we may receive information from third parties, such as:
Gift Purchases: When someone purchases a digital STL or a physical miniature for you as a gift, they provide us with your shipping or contact details.
Social Media: If you interact with Strike Force Studio on Instagram or other platforms, we may receive public profile information based on your privacy settings.
How We Use Your Personal Information
Depending on how you interact with Strike Force Studio, we use your personal information for the following purposes:
Performance of a Contract (Provision of Services): We use your personal information to fulfill our agreement with you. This includes processing payments via Paystack, fulfilling orders for STLs or physical minis, managing bespoke painting commissions, arranging shipping to your address, and managing your Zoho account. This is the primary reason we collect your data.
Marketing and Advertising: With your consent (where required by POPIA and GDPR), we may use your information to send promotional communications or show you targeted advertisements for new DnD tokens or painting services based on your past interests. You may opt-out of these communications at any time.
Security and Fraud Prevention: We process your data to authenticate accounts, provide a secure payment experience, and detect or investigate fraudulent or malicious activity. You are responsible for keeping your account credentials safe; we recommend never sharing your access details.
Communicating with You: We use your details to provide customer support, respond to project inquiries, and maintain our business relationship.
Tax and Legal Compliance: We use your personal information to comply with applicable laws, including:
SARS Compliance: Maintaining accurate financial records and tax invoices as required by the South African Tax Administration Act.
Legal Process: Responding to valid legal requests, law enforcement inquiries, or enforcing our terms and policies.
Governing Law Fallback: In the event of any use-case not specifically listed, we rely on the standards set out in the laws of the Republic of South Africa.
This section is where you describe the "Hand-off" of data. To be a "Business Warrior," you need to show that you don't just throw data around—you only share it with trusted partners under strict legal rules.
I have updated your text to include POPIA Sections 20 & 21 (which require you to have contracts with your "Operators" like Paystack) and GDPR Article 28.
How We Disclose Personal Information
In certain circumstances, we may disclose your personal information to third parties for legitimate business purposes. In all such cases, we ensure that these third parties (referred to as "Operators" under POPIA or "Processors" under GDPR) are bound by strict confidentiality and security obligations.
We may disclose your information:
To Our Service Providers: We share information with trusted vendors who perform services on our behalf. These include:
Shopify: For website hosting and infrastructure.
Payment Gateways: Specifically Paystack, to securely process your ZAR or international payments and prevent fraud.
Accounting & Admin: Zoho Books, where your invoicing data is stored for our 5-year SARS record-keeping requirement.
Logistics: Courier services (e.g., The Courier Guy/Pudo) to ensure your physical miniatures reach your address.
For Marketing and Advertising: With your consent, we use Shopify and social media partners to show you relevant art or new STL releases. You have the right to "Opt-Out" of this sharing at any time.
To Comply with Legal Obligations: We will disclose your information if required to do so by law, such as responding to a subpoena from a South African court or a valid request from the Information Regulator (SA) or an EU Data Protection Authority.
In Business Transactions: If Strike Force Studio undergoes a merger, acquisition, or sale of assets, your personal information may be transferred as a business asset. In such a case, we will notify you, and the new entity will be bound by this Privacy Policy.
With Your Consent: We may share information with other third parties whenever you explicitly direct or request us to do so (e.g., sharing your commission progress on social media).
Governing Law Fallback: All disclosures are managed under the framework of the laws of the Republic of South Africa.
Relationship with Shopify
Our Services are powered by Shopify. In this relationship, the following legal roles apply:
Strike Force Studio as the Responsible Party (POPIA) / Data Controller (GDPR): We decide what art to sell, how to price it, and what information to ask you for. We are responsible for the data we collect to fulfill your orders.
Shopify as the Operator (POPIA) / Data Processor (GDPR): Shopify provides the technical infrastructure to process your personal information on our behalf.
International Transfers: Information you submit is transmitted to and shared with Shopify and its affiliates. This data may be stored or processed in Canada, the United States, and Ireland. We rely on the European Commission's Standard Contractual Clauses (SCCs) and the Data Processing Addendum (DPA) to ensure your data is protected during these transfers, regardless of where it is stored.
Enhanced Features & Shared Data: To improve our business and provide security (like fraud detection), we use Shopify’s enhanced features. In these specific instances (such as when you use Shop Pay), Shopify may act as an independent or joint Data Controller. In these cases, Shopify is directly responsible for responding to your data rights requests.
Governing Law Fallback: While Shopify operates globally, your primary legal agreement with Strike Force Studio for all Services is governed by the laws of the Republic of South Africa.
To learn more about how Shopify manages your data, please visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.
Third Party Websites and Links
The Services may provide links to websites, social media platforms (such as Instagram, Tiktok, or Discord), or other online platforms operated by third parties.
No Control or Liability: If you follow links to sites not affiliated with or controlled by Strike Force Studio, you are leaving our secure environment. We do not guarantee and are not responsible for the privacy or security of such sites. We encourage you to review their specific privacy and security policies before providing any personal data.
Public Forums & Social Media: Information you share on public or semi-public venues—including comments on our social media posts or community DnD forums—may be viewable by other users of those platforms. We have no control over how third parties use information you post in the public domain.
Courier & Payment Portals: When you leave our site to track a package via The Courier portal or to finalize a payment on the Paystack secure portal, those interactions are governed by the respective providers' privacy policies.
Governing Law Fallback: Any disputes regarding our link-sharing practices shall be governed by the laws of the Republic of South Africa.
Children's Data
Age Thresholds: Our Services are not intended for use by children. In accordance with POPIA (South Africa), a child is any person under the age of 18. In the European Union (GDPR), the age of digital consent is 16 (though some member states have lowered this to 13).
No Knowingly Collection: We do not knowingly collect, process, or "sell" personal information from individuals under these ages. If you are under the age of 18 in South Africa, or the age of digital consent in your EU jurisdiction, you may only use our Services with the involvement and express consent of a parent or legal guardian.
Our Commitment to Protection: Strike Force Studio strongly advises the fallback on South African laws (specifically the Children’s Act and POPIA) as our local regulations are exceptionally strict regarding the safety of minors. We do not take any situation involving children lightly and prioritize their digital and physical safety above all commercial interests.
Parental Rights: If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact our Information Officer at modo@strikeforcestudio.com. Upon verification, we will immediately delete such information from our servers (subject to any non-deletable transaction records required by SARS).
Security and Retention of Your Information
Security Measures: In accordance with Section 19 of POPIA and Article 32 of the GDPR, we implement reasonable technical and organizational measures to secure the integrity and confidentiality of your personal information. These include the use of Multifactor Authentication (MFA) for store access, secure encryption via Shopify and Zoho, and restricted access to physical files.
The "Perfect Security" Disclaimer: Please be aware that no security measures are perfect or impenetrable. While we strive to protect your data, we cannot guarantee "perfect security." Any information you send to us (especially via unencrypted email) may not be secure while in transit. We recommend using our secure website portal for all sensitive transactions.
Data Retention Principles: We retain your personal information only for as long as is necessary to achieve the purpose for which it was collected, or as required by law.
Statutory Retention Periods (The "Longest Law Wins" Rule): * SARS Compliance: Under the South African Tax Administration Act, we are legally required to retain all financial records, including invoices and payment confirmations, for a minimum of 5 years from the date of your tax invoice.
Companies Act: Where applicable, certain business records are retained for 7 years to comply with the South African Companies Act.
Bespoke Commissions: We may retain project-specific references and communication for the duration of the artistic project plus 3 years to resolve any potential disputes or future touch-up requests.
Secure Destruction: Once the legal retention period has lapsed, or the data is no longer required, we will delete, destroy, or de-identify your information in a manner that prevents its reconstruction, as required by Section 14 of POPIA.
Governing Law Fallback: Our security standards and retention schedules are primarily guided by the laws of the Republic of South Africa..
Your Rights and Choices
Depending on where you reside, you have specific rights regarding your personal information. These rights are not absolute and may be limited by legal obligations (such as tax laws).
Right to Access / Know (POPIA Sec 23 / GDPR Art 15): You have the right to confirm, free of charge, whether we hold your personal information and to request a record of that information. In South Africa, this is facilitated through the Promotion of Access to Information Act (PAIA).
Right to Correct (POPIA Sec 24 / GDPR Art 16): You may request that we update or correct any personal information that is inaccurate, irrelevant, excessive, or out of date.
Right to Deletion / Destruction (POPIA Sec 24 / GDPR Art 17): You may request that we delete your personal information.
The Exception: Please note that we cannot delete information that we are legally required to retain. This includes financial transaction data and tax invoices which must be kept for 5 years for SARS compliance.
Right of Portability (GDPR Art 20): For our EU/UK customers, you have the right to receive your data in a structured, machine-readable format. While POPIA does not explicitly mandate portability in the same way, we strive to provide this to all customers upon request.
Right to Object (POPIA Sec 11 / GDPR Art 21): You have the right to object to the processing of your data for direct marketing purposes at any time.
Managing Communications: You may opt out of promotional emails via the "unsubscribe" link. We will still send essential non-promotional emails regarding your active orders, painting commissions, or account security.
Exercising Your Rights: To exercise these rights, please contact our Information Officer at modo@strikeforcestudio.com. We must verify your identity before processing requests. You may designate an authorized agent, but we will require written proof of their authority and direct verification of your identity.
Governing Law Fallback: All requests, including the timelines for response and any applicable fees (as permitted by PAIA), are governed by the laws of the Republic of South Africa.
Complaints
If you have any concerns or complaints about how we process your personal information, please contact us directly so that we can resolve the matter:
Internal Resolution: Contact our Information Officer, Kimon Kramvis, at modo@strikeforcestudio.com. We commit to investigating all complaints and providing a formal response within 30 days.
Right to Lodge a Complaint with a Supervisory Authority: If you are not satisfied with our response, or if you believe our processing of your personal information does not comply with the law, you have the right to lodge a complaint with the relevant data protection authority:
In South Africa: You may contact the Information Regulator (South Africa).
Physical Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Email (POPIA Complaints): POPIAComplaints@inforegulator.org.za
Email (General Enquiries): enquiries@inforegulator.org.za
Website: https://inforegulator.org.za/
In the European Union: You have the right to lodge a complaint with the Data Protection Authority in the member state where you reside or where the alleged infringement occurred. You can find a list of EU authorities here.
Governing Law Fallback: While we respect the jurisdiction of international authorities, all initial complaints and internal dispute resolutions shall be handled in accordance with the laws of the Republic of South Africa.
International Transfers
Strike Force Studio is a global business. Please note that we may transfer, store, and process your personal information outside of the country in which you live, including to Canada, the United States, India, and the European Union.
POPIA Compliance (South Africa): In accordance with Section 72 of POPIA, we only transfer personal information to a third party in a foreign country if:
The recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA; or
The transfer is necessary for the performance of our contract with you (e.g., to process your payment via Paystack’s global infrastructure or host your data on Shopify); or
You have consented to the transfer.
EU/UK Compliance (GDPR): If we transfer your personal information out of the European Economic Area (EEA) or the United Kingdom, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or equivalent contracts issued by the UK authorities, unless the destination country has been officially deemed "adequate" by the relevant commission.
Governing Law Fallback: While we utilize international frameworks to move data safely, any dispute regarding our cross-border data practices shall be governed by the laws of the Republic of South Africa.
Changes to This Privacy Policy
Strike Force Studio is a dynamic entity, and we may update this Privacy Policy from time to time to reflect changes in our artistic practices, service providers (such as updates to Shopify or Paystack), or for other operational, legal, or regulatory reasons.
Notification of Changes: We will post the revised Privacy Policy on this website and update the "Last updated" date at the top of the page. For significant changes that materially affect your rights, we will provide a more prominent notice (for example, via a banner on the store homepage or an email notification to your registered address).
Consent Refresh: In accordance with POPIA and GDPR, if an update to this policy involves using your personal information for a new purpose that requires your consent, we will reach out to obtain that consent before the new processing begins.
Review Encouragement: We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.
Governing Law Fallback: Any procedural disputes regarding how we notify you of these changes shall be governed by the laws of the Republic of South Africa.
Contact
Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your legal rights, please contact our Information Officer directly.
Responsible Party: Strike Force Studio
Information Officer: Kimon Kramvis
Email: modo@strikeforcestudio.com
Physical Address: 38 Berg en dal, 28 6th Road West,
Northcliff, Johannesburg,
Gauteng, 2195,
Republic of South Africa
Studio Operating Hours: Monday – Friday: 09:00 – 17:00 (SAST)
Governing Law Fallback: Kimon Kramvis, in his capacity as Information Officer, confirms that Strike Force Studio operates under the primary jurisdiction of the Republic of South Africa. Any formal legal notices or requests for information are governed by the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA).
