This Privacy Policy explains how Your Store Name ("we", "us", or "our") collects, uses, stores, discloses, and protects your personal information when you use this website and purchase our products or book our services, in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECT Act), and the Consumer Protection Act 68 of 2008 (CPA).

2. Categories of Personal Information We Collect

In accordance with POPIA Sections 9–12 (minimality and lawfulness), we only collect personal information necessary to process your orders, bookings, and customer support requests:

• Identity & Account Information: First name, surname, email address, and encrypted account credentials.
• Contact & Fulfilment Information: Mobile telephone number, physical delivery address, PUDO locker selection, or service appointment notes.
• Transaction & Billing Records: Products or services purchased, order totals, VAT tax invoice details (where applicable), and gateway payment references. We never store raw payment card numbers, CVV codes, or bank PINs on our servers.
• Technical & Security Telemetry: IP address, browser user-agent, device type, shopping cart session tokens, and audit logs.
• Consent & Preference Records: Timestamps of your cookie consent and marketing opt-in/opt-out preferences.

3. Purpose of Processing (POPIA Section 13)

We process your personal information strictly for specific, explicitly defined, and lawful purposes:

• To process, fulfil, and deliver your physical product orders or confirm your bookable service appointments.
• To process secure online payments through our PCI-DSS Level 1 certified payment gateways.
• To send transactional order confirmations, courier tracking links, and SMS/email status updates.
• To issue statutory invoices, process returns/refunds under the Consumer Protection Act, and provide customer support.
• To prevent fraudulent transactions and maintain the security of our online store (POPIA Section 19).
• To send promotional offers or newsletters only where you have given explicit opt-in consent (POPIA Section 69). You may unsubscribe at any time.

4. Lawful Basis for Processing (POPIA Section 11)

• Contractual Performance — s11(1)(b): Necessary to conclude and perform the contract of sale or service booking with you.
• Legal Obligation — s11(1)(c): Required to comply with South African tax (SARS), Consumer Protection Act (CPA), and ECT Act record-keeping obligations.
• Data Subject Consent — s11(1)(a): For optional analytics/marketing cookies and promotional communications.
• Legitimate Interest — s11(1)(f): For fraud prevention, network security, and service improvement.

5. Operators & Third-Party Service Providers (POPIA Sections 20–21)

We do not sell, rent, or trade your personal information to third parties. We only share minimum necessary data with trusted third-party Operators bound by confidentiality and security mandates:

• Payment Gateways (PCI-DSS Level 1 Certified): Paystack, PayFast, Yoco, Ozow Instant EFT, Apple Pay, and/or Google Pay (as enabled at checkout) to process your payments securely.
• Courier & Fulfilment Partners: The Courier Guy, PUDO Smart Lockers, and/or designated local couriers to generate waybills, dispatch parcels, and send delivery PIN notifications.
• Cloud Hosting & E-Commerce Platform Operator: Our store runs on isolated cloud infrastructure powered by Shopnik™ (Sputnik Devs Studio (Pty) Ltd), acting strictly as a technical Operator under POPIA Sections 20–21.
• Transactional Email & SMS Gateways: To deliver order receipts, password resets, and shipment alerts.

6. Cross-Border Data Transfers (POPIA Section 72)

Where any cloud infrastructure, content delivery network (CDN), or payment sub-processor processes data outside the Republic of South Africa, we ensure that such transfer complies with Section 72(1) of POPIA—meaning the recipient is subject to laws or binding corporate/contractual rules that provide an adequate level of data protection substantially similar to POPIA.

7. Data Retention (POPIA Section 14)

We retain personal information only for as long as necessary to fulfil the purposes set out in this policy or to satisfy statutory retention periods:

• Order & Tax Invoice Records: Retained for at least 5 years from the date of transaction in compliance with the SARS Tax Administration Act 28 of 2011.
• Customer Accounts: Retained while your account remains active. You may request account deletion at any time.
• Marketing Consents: Retained until you withdraw consent or unsubscribe.

8. Your Statutory Rights Under POPIA (Sections 5, 11, 23 & 24)

As a Data Subject under South African law, you have the right to:

• Right of Access (Section 23): Request confirmation of whether we hold personal information about you and request a copy of your data.
• Right to Correction or Deletion (Section 24): Request correction, destruction, or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, or unlawfully obtained.
• Right to Object (Section 11(3)): Object on reasonable grounds to the processing of your personal information, or object at any time to processing for direct marketing purposes.
• Right to Withdraw Consent (Section 11(2)(b)): Withdraw any previously granted consent at any time.
• Right to Data Portability: Export your personal data and order history in a structured, machine-readable format from your Account Settings page.

You can exercise these rights directly from your Account Privacy & Consent Settings page or by contacting our Information Officer.

9. Security Safeguards & Breach Notification (POPIA Sections 19 & 22)

We secure the integrity and confidentiality of your personal information through HTTPS/TLS encryption in transit, encrypted database storage, salted cryptographic password hashing, anti-forgery tokens, and role-based access controls. In the event of any security compromise where unauthorised persons may have accessed your personal information, we will notify you and the Information Regulator (South Africa) as soon as reasonably possible in accordance with Section 22 of POPIA.

10. Cookies & Children's Privacy (POPIA Sections 34–35)

We use essential cookies for shopping cart sessions, authentication, and security, and optional analytics cookies only with your consent. Please read our Cookie Policy for full details. Our online store is intended for customers aged 18 and older (or minors acting with the explicit consent of a parent or legal guardian in accordance with POPIA Section 35).

11. Lodging a Complaint with the Information Regulator

If you believe your personal information has been processed in contravention of POPIA, please contact us first so we can resolve your concern promptly. You also have the statutory right to lodge a complaint with the South African supervisory authority:

12. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or regulatory changes. The revised policy will be published on this page with an updated effective date.