Privacy Policy

This Privacy Policy applies to the website creativebooks.co.za and to the self-publishing, book printing, typesetting, design and editorial services offered by Creative Books SA (“Creative Books SA”, “we”, “us” or “our”).

For the purposes of POPIA, Creative Books SA is the responsible party for the personal information described in this policy.

• Responsible party: Creative Books SA
• Physical address: 1 Ruby Cl, Fourways, 2191, South Africa
• Contact for privacy matters: info@creativebooks.co.za · 010 500 3331

We use a few terms from POPIA in this policy:

• Personal information: Information that identifies or relates to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person (a company or other entity).
• Processing: Anything done with personal information — collecting, storing, using, sharing, updating or deleting it.
• Data subject: The person to whom the personal information relates — for example, you.
• Operator: A third party that processes personal information on our behalf and under our instruction (for example, our hosting or accounting providers).
• Special personal information: Sensitive categories such as health, religious or philosophical beliefs, race or ethnic origin, and criminal behaviour, which POPIA protects more strictly.

Depending on how you interact with us, we may collect the following categories of personal information:

• Identity and contact details: Your name, email address, telephone or WhatsApp number, business name (if any) and postal or delivery address.
• Project and quote information: Details you provide through our get-a-quote form or in correspondence — such as page count, word count, trim size, quantity, format, finishing options and other specifications needed to price and produce your work.
• Manuscript and content: The manuscripts, text, images, artwork and files you send us for editing, typesetting, design or printing. These may themselves contain personal information about you or about third parties (see section 9).
• Transaction and billing information: Invoicing details, amounts, payment status and correspondence relating to your orders. Card and banking details are handled by our payment and accounting providers — we do not store full card numbers ourselves.
• Communications: The content of emails, WhatsApp messages, quote correspondence and support enquiries between you and us.
• Technical and usage information: Information collected automatically when you visit our website, such as your IP address, browser type, device information, referring pages and how you use the site. See our Cookie Policy.

• Directly from you — when you complete our quote form, request a service, email or message us, place an order, or send us a manuscript.
• Automatically — through cookies and similar technologies when you use our website.
• From third parties — occasionally from our service providers (for example, payment confirmations from our accounting or payment provider) or from someone who refers you to us.

We process personal information for the following purposes:

• To respond to enquiries and prepare and send you quotes.
• To provide our services — editing, typesetting, design, printing, publishing and delivery of your books.
• To communicate with you about your project, proofs, timelines and approvals.
• To invoice you, take payment and keep proper accounting and tax records.
• To manage our relationship with you and provide support.
• To operate, secure and improve our website and services.
• To comply with our legal, regulatory and tax obligations.
• With your consent, or where the law otherwise allows, to send you information about our services (see section 11).

POPIA requires us to have a lawful basis for processing your personal information. We rely on one or more of the following:

• Performance of a contract — where processing is necessary to provide a quote or carry out the services you have asked for.
• Your consent — for example, for certain marketing communications, which you may withdraw at any time.
• Legal obligation — where we must process information to comply with the law (for example, keeping tax and accounting records).
• Legitimate interests — for the proper running, security and improvement of our business, provided this does not override your rights and interests.

To help us work quickly, we use an artificial-intelligence service (Anthropic’s Claude) to help draft quote and email correspondence. We want to be transparent about how this works:

• Pricing is calculated by our own systems and rate tables — not by the AI. The AI does not set, change or invent prices.
• The AI is used only to help draft wording around information we have already prepared.
• A member of our team reviews every AI-assisted draft before it is sent to you. No quote or communication is sent automatically without human review.
• We do not use the AI to make decisions about you that produce legal or similarly significant effects for you based solely on automated processing.

Where information is processed by this service, that processing is covered by the safeguards described in sections 12 and 13.

We do not sell your personal information. We share it only where necessary, and only with parties who are bound to protect it. These include:

• Platform & hosting provider: Base44, which hosts our website and business application.
• Accounting & payment providers: Zoho Books, which we use for invoicing, record-keeping and to process payments.
• Communication tools: Our email provider and WhatsApp (Meta) where you choose to contact us that way.
• Analytics & advertising providers: Google (Google Analytics, via Google Tag Manager) and Meta (the Facebook Pixel), which help us understand how our website is used and measure our marketing. See our Cookie Policy.
• AI drafting service: Anthropic (Claude), as described in section 7.
• Production & delivery partners: The Courier Guy and any print or finishing partners we use to produce and deliver your order.
• Professional advisers & authorities: Our advisers (such as accountants or lawyers) and regulators, courts or authorities where we are legally required to disclose information.

Where these parties process personal information on our behalf, they do so as our operators under written agreements requiring them to keep it confidential and secure and to process it only on our instructions.

We take reasonable and appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure, as required by section 19 of POPIA. These include access controls, use of reputable service providers, and encryption of data in transit where appropriate.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and any transmission is at your own risk. If we become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by law.

We will only send you electronic marketing (such as emails or messages about our services) where you have consented, or where the law otherwise permits — for example, to existing customers about similar services. Every marketing message will give you a simple way to opt out, and you can ask us to stop at any time by contacting us using the details in section 16.

We keep personal information only for as long as necessary for the purposes described in this policy, and to meet our legal, accounting and tax obligations (for example, financial records are generally retained for at least five years under South African tax law). When we no longer need your information, we will securely delete or de-identify it. We may keep manuscript files for a reasonable period after a project to allow for reprints or corrections, unless you ask us to delete them sooner.

Some of the service providers described in section 8 (for example, our hosting, accounting, AI and communication providers) are located outside South Africa, which means your personal information may be transferred to, and stored in, other countries.

Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA — that is, where the recipient is subject to laws, binding rules or agreements that provide an adequate level of protection, where the transfer is necessary to perform our contract with you, or where you have consented. We take reasonable steps to ensure your information remains protected wherever it is processed.

Subject to POPIA, you have the right to:

• Ask what personal information we hold about you and request access to it.
• Ask us to correct or update information that is inaccurate or incomplete.
• Ask us to delete information we are no longer entitled to keep.
• Object, on reasonable grounds, to the processing of your information.
• Object to your information being used for direct marketing.
• Withdraw a consent you have given (this will not affect processing that already took place).
• Complain to the Information Regulator (see section 15).

To exercise any of these rights, contact us using the details in section 16. We may need to verify your identity before acting on a request. Requests for access may, where applicable, be made on the prescribed POPIA form.

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with the Information Regulator:

We would appreciate the chance to address your concerns directly first, so please do consider contacting us before approaching the Regulator.

For any question about this policy or your personal information, or to exercise your rights, please contact us:

We may update this Privacy Policy from time to time. The current version will always be available on our website, with the “last updated” date shown at the top. Significant changes will be communicated where appropriate.