Effective date: 25 October 2026
This policy explains what personal information we hold, why we hold it, who sees it and what you can ask us to do about it. By "personal information" we mean anything that identifies you or can be linked to you, such as your name, email address, phone number or the IP address your device uses on the internet.
It covers our website, www.highveldtaxidermists.com, and everyone who enquires about our work or becomes a client, however they reach us. If anything here is unclear, ask us and we will explain.
Highveld Taxidermists (Pty) Limited, registration number 1981/007121/07 ("Highveld Taxidermists", "we" or "us"), is responsible for your personal information. Under South Africa's Protection of Personal Information Act (POPIA) we are the "responsible party". Under UK and European data protection law (the GDPR) we are the "controller".
We are a family studio, founded in 1981, and all our taxidermy work is done here. Our client-liaison office in Charlotte, North Carolina, which serves our American clients, will have its own privacy policy.
Our Information Officer makes sure we follow POPIA and handles any request you make under this policy. You can reach them at info@highveld.biz.
Most of what we hold you give us yourself. Some arrives automatically when you use our website, and some comes from other people, as explained below.
The form asks for your name, email address, phone number, country and message. A Cloudflare Turnstile check runs on the form to tell people from bots. It looks at signals from your browser and connection, such as your IP address, and does not read what you type. Cloudflare also uses these signals to improve its own bot detection.
When you press send, our website emails your enquiry to two of our mailboxes, which are hosted on Microsoft 365. The website itself keeps no copy, and its logs record only your country and a request reference, never your name, contact details or message. We then add your enquiry to our customer records so that we can follow it up.
If you fill in our "Book Your Consultation" form inside a Google ad, Google collects your first and last name, email address, phone number and location and passes them to us. We use them to reply and to arrange your consultation, exactly as we would a website enquiry. The form sits on Google's own pages, so Google's privacy policy also applies to it.
The WhatsApp button opens a chat with the studio's business number, and nothing is sent to WhatsApp until you tap it. Messages you send us are handled under WhatsApp's terms and kept on our WhatsApp business account. Phone and email links open your own apps, and emails reach our Microsoft 365 mailboxes. We keep what you send us so that we can answer you and, if you go ahead, do your work.
When you become a client we hold your name, address and contact details, your quotes, invoices and payment records, your instructions and the history of your job. Every trophy carries your five-digit job number from intake to crate. We may invite you to leave a review of our work on Google.
Every client gets a login to our photo portal at photos.highveld.biz. Each job has a gallery of photographs of your trophies in date order, from the intake photographs of skulls and skins to regular progress photographs. We email you when new photographs arrive, and you can download and comment on them. The portal holds your name and email address, your login and your comments.
The professional hunter or outfitter who referred you can see your jobs on the portal and receives a regular summary of progress on them.
Trophies need permits and veterinary paperwork before they can leave South Africa or enter your country, and some permits must be issued in the hunter's name. For these we use your name and address. We do not collect identity numbers or any other sensitive information.
Our sister company, Oxi Logistics, builds the crates and handles export paperwork and shipping. Customs brokers handle import clearance in your country, for example the US Fish & Wildlife Service declaration at the US port of entry.
Some information reaches us from someone other than you:
You can browse the site without giving us anything. To answer the contact form we need your name, email address, phone number, country and message. For a taxidermy job, and to export your trophies, we need your name and address; without them we cannot start the work or obtain the permits. Some of this is required by law: the Tax Administration Act 28 of 2011 for our tax records, and the wildlife, veterinary and customs rules for the permit details the authorities ask for. Analytics and advertising cookies are always optional.
The law lets us use personal information only for a stated purpose and on a lawful ground. This is how each use fits.
| What we do | Information used | Lawful ground |
|---|---|---|
| Reply to enquiries and prepare quotes | Your enquiry and contact details | Steps you asked us to take before a contract |
| Carry out your job: job number, portal photographs, progress emails | Contact details, instructions, photographs, comments | Our contract with you |
| Keep the outfitter who referred you up to date | Job details and portal photographs | Our legitimate interest in working with the outfitter who sent you to us. You can ask us to stop |
| Invoices, accounts and tax records | Name, address, quotes, invoices | Our contract with you, and legal obligation |
| Permits, export paperwork, crating and shipping | Name and address | Legal obligation, and our contract with you |
| Deliver and protect the website (Cloudflare, Turnstile) | IP address, browser and connection details, country | Our legitimate interest in a secure, working website |
| Show fonts, reviews, videos and our map (Google Fonts, Elfsight, Vimeo, Google Maps) | IP address, browser details | Our legitimate interest in showing our work |
| Show public Google reviews and invite clients to review us | Reviewers' public names, photos and words; your contact details | Our legitimate interest in showing what clients think of our work |
| Measure how the site is used (Google Analytics) | Pages, clicks, cookie identifiers, device details | In the UK, the European Economic Area (EEA) and Switzerland, your consent. Elsewhere, our legitimate interest in improving the site |
| Measure and show our advertising (Google Ads, Meta pixel) | Cookie identifiers, pages and clicks, and for Meta, scrambled contact details | In the UK, EEA and Switzerland, your consent. Elsewhere, our legitimate interest in reaching hunters |
You can object to any use based on our legitimate interests, or withdraw your consent, at any time (see "Your rights"). We do not make decisions about you by automated means alone.
Google and Meta help us see how the site is used and show our ads to people who have visited it. For these uses they also make their own use of the information, under their own privacy policies.
Google Analytics records the pages you visit, taps on our phone, WhatsApp and email links, successful contact-form sends, scrolls and clicks to other sites. Google says it does not log or store IP addresses. We keep event data for 2 months and user-level data for 14 months.
We have turned on Google signals and linked Google Analytics to our Google Ads account. This lets Google associate visits with people who are signed in to a Google account and have ad personalisation switched on, so that we can see reports across devices and build advertising audiences. Google explains this in "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites).
We use Google Ads remarketing: third-party vendors, including Google, show our ads on sites across the internet and use cookies to show you ads based on your past visits to our website. Our audience lists keep visitors for up to 540 days. Our conversion tags record when someone sends the contact form, taps our phone number or taps WhatsApp, and Google's conversion-linker cookies connect that action to the ad that led to it.
We use the Meta pixel. Meta uses cookies and similar technologies to record your visit, including the pages you view and taps on our phone, WhatsApp and email buttons. It uses this to measure our ads and to show you ads on Facebook, Instagram and elsewhere, whether or not you have a Meta account. If you fill in a form, the pixel may scramble (hash) your email address or phone number and send it to Meta to match you to a Meta account. Meta calls this "advanced matching".
Google and Meta may collect information about your activity on our site and on other websites over time.
A cookie is a small file a website stores in your browser. Similar technologies include pixels and your browser's local storage. One is needed for the site to work, the analytics and advertising cookies are optional, and a few are set by the companies whose videos, map and reviews appear on our pages.
Needed for the site to work
| Name | Set by | Purpose | How long |
|---|---|---|---|
| hv_consent (browser storage, not a cookie) | Highveld Taxidermists | Remembers your cookie choice | Until you clear your browser's data for our site |
Analytics
| Name | Set by | Purpose | How long |
|---|---|---|---|
| _ga | Google Analytics | Gives your browser a random ID so that visits can be counted | 2 years |
| _ga_SGHTVKVHL6 | Google Analytics | Keeps track of your visit for our analytics | 2 years |
Advertising
| Name | Set by | Purpose | How long |
|---|---|---|---|
| _gcl_au | Google Ads | Measures whether people who click our ads go on to contact us | 90 days |
| _gcl_aw | Google Ads | Remembers the ad you clicked so that a later enquiry can be credited to it | 90 days |
| IDE | Google (doubleclick.net) | Remarketing and ad measurement across sites | 13 months in the UK and EEA; 24 months elsewhere |
| test_cookie | Google (doubleclick.net) | Checks whether your browser accepts cookies | 15 minutes |
| _fbp | Meta | Identifies your browser for Meta's advertising and analytics | 90 days |
| _fbc | Meta | Remembers the Facebook or Instagram ad you clicked | 90 days |
Embedded content
| Name | Set by | Purpose | How long |
|---|---|---|---|
| NID | Google (google.com) | Remembers your Google preferences; may be set or read by the map on our Contact page | 6 months from last use |
| player_clearance, cf_clearance, __cf_bm, _cfuvid | Vimeo (some through Cloudflare) | Protect the video player from bots | From the end of your visit to 1 year |
| elfsight_viewed_recently | Elfsight | Stops one visitor being counted several times by our reviews widget | 15 seconds |
Our Vimeo videos are embedded with Vimeo's do-not-track setting, so Vimeo sets only the security cookies above. If you are signed in to Google, the map may also read the cookies of your Google account.
Visitors in the UK, the EEA and Switzerland see a banner with "Accept all" and "Decline". Until you accept, Google's and Meta's analytics and advertising cookies are not set, and Google's tags send only cookieless signals. If you decline, they stay off. Everywhere else, these cookies are on by default.
Wherever you are, you can change your mind at any time through Cookie preferences at the foot of every page. Declining does not delete cookies already in your browser, so clear them in your browser settings if you want them gone. Google Fonts, our reviews widget, our videos and the map on our Contact page load whatever you choose, and the "Embedded content" cookies are not controlled by the banner.
You can also opt out directly:
Our website does not respond to browser "Do Not Track" signals. To limit tracking, use the choices above.
Some parts of our pages come from other companies. When they load, those companies receive your IP address and browser details and act under their own privacy policies.
Links to other sites, such as Instagram, Facebook, Oxi Logistics and our website agency, take you to pages governed by those sites' own policies.
We share personal information with the people and companies below, for the reasons given.
We do not sell client lists or contact details, and we do not send marketing emails.
Each company's own privacy policy: Google (https://policies.google.com/privacy), Meta (https://www.facebook.com/privacy/policy), Cloudflare (https://www.cloudflare.com/privacypolicy/), Elfsight (https://elfsight.com/privacy-policy/), Vimeo (https://vimeo.com/privacy), WhatsApp (https://www.whatsapp.com/legal/privacy-policy), Microsoft (https://www.microsoft.com/en-us/privacy/privacystatement), Amazon Web Services (https://aws.amazon.com/privacy/).
Some of these companies store or process information outside South Africa. Our photo portal runs on Amazon Web Services in London. Google, Meta, WhatsApp, Cloudflare, Vimeo and Microsoft operate worldwide networks, including in the United States and Europe, and our customer-records and accounting software may also store information abroad. Elfsight, SL is an Andorran company bound by Andorra's data protection law, which the European Commission recognises as adequate. Our American clients' details go to our Charlotte office in the United States, and export and import paperwork goes to the authorities and brokers in your own country.
Countries protect personal information to different standards. The UK and the countries of the EEA have data protection laws comparable to POPIA. The United States has no general federal privacy law of that kind. So we rely on the following safeguards. Where a company has binding data-protection terms, or is subject to a law that gives adequate protection, we rely on that (POPIA section 72(1)(a)). Where we send your details abroad to carry out your job, serve you through our Charlotte office or export your trophies, the transfer is needed for our contract with you (section 72(1)(c)).
We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires. Then we delete it or remove anything that identifies you.
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to a job, including WhatsApp messages and emails | 2 years from our last contact |
| Client records, quotes, permit and export documents, job correspondence and your photo portal account | 5 years after your last transaction with us |
| Tax records, including invoices and payment records | 5 years from the submission of the relevant tax return (Tax Administration Act 28 of 2011, section 29), or longer while an audit or objection is open |
| Google ad form leads, on Google's side | 60 days |
| Google Analytics | Event data 2 months; user-level data 14 months |
| Google Ads audience lists | Up to 540 days |
| Website logs (country and request reference only) | Up to 7 days |
| Cookies and your cookie choice | See the cookie tables above |
We take reasonable technical and organisational steps to protect personal information, and we limit access to the people and companies who need it for their work. If a security breach puts your information at risk, we will tell you and the Information Regulator as the law requires.
Wherever you live, you can:
To use any of these rights, email our Information Officer at info@highveld.biz. We will ask you to confirm your identity first. If a fee applies to a copy of your records, we will tell you in advance. You may also use the Information Regulator's forms, but an email is enough.
If you are unhappy with how we handle your information, please tell us first so that we can put it right. You also have the right to complain to the Information Regulator (South Africa):
Everything above applies to you, and the data protection law where you live adds the following.
Lawful bases. We rely on:
Transfers. We are based in South Africa, which has no EU or UK adequacy decision. Where our providers move information onward, most use safeguards such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, as set out in their own terms. You can ask us for details of these safeguards.
Your rights. You also have the right to restrict our use of your information and to receive it in a usable format or have it sent to someone else (data portability). Withdrawing consent does not affect what we did before.
Your right to object. You may object at any time, on grounds relating to your situation, to our use of your information based on our legitimate interests. If you do, we will stop unless we have compelling legitimate grounds that override your interests, or need the information for a legal claim.
Complaints. You can complain to the data protection authority where you live or work. In the UK that is the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/). In the EU, see the list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In Switzerland, it is the Federal Data Protection and Information Commissioner.
The rights under "Your rights" are open to everyone, including American visitors and clients. To review or correct the information we hold about you, email our Information Officer at info@highveld.biz.
Our website and services are meant for adults. We do not knowingly collect information about children. If you think a child has sent us information, tell us and we will delete it.
We may update this policy when our website, our services or the law change. When we do, we will change the date at the top of this page.
For any question about this policy, or to use your rights, contact our Information Officer:
