Privacy Policy
How we handle your personal information, under the Protection of Personal
Information Act (POPIA).
1. Who is responsible
[Registered company name], trading as Pretty Luxe Atelier.
Information Officer: [name] · [email] · [postal address]
2. What we collect
- You give us: name, email, phone, delivery and billing address, engraving
text, order history, support correspondence.
- Automatically: IP address, device and browser type, pages viewed and how long
for, referring site. Behavioural data is collected **only if you accept analytics
cookies**.
- From payment providers: confirmation of payment and a reference. We never see
or store your full card number.
3. Why we use it, and our lawful basis
| Purpose | Basis |
|---|---|
| Fulfilling and delivering your order | Performance of a contract |
| Order updates and delivery notifications | Performance of a contract |
| Accounting, tax and statutory records | Legal obligation |
| Fraud prevention and account security | Legitimate interest |
| Site analytics and improvement | Consent |
| Marketing email | Consent |
4. Marketing
We send marketing email only if you opt in, separately from order email. You can
withdraw at any time from your account or via the unsubscribe link, and we record
the withdrawal. Unsubscribing from marketing does not stop order notifications.
5. Who we share it with
- Payment providers, to take payment.
- Our fulfilment partner and couriers, to make and deliver your order.
- Email and hosting providers, to run the service.
- Accounting software, for South African financial records.
- Authorities, where the law requires it.
We do not sell your personal information.
6. Cross-border transfers
Some providers process data outside South Africa. Where they do, we require
protection comparable to POPIA, as section 72 requires.
7. How long we keep it
- Order and tax records: 5 years, as South African tax law requires.
- Account data: while your account is open, then 12 months.
- Analytics: 14 months, then aggregated.
- Marketing consent records: for as long as we rely on them, plus 3 years.
8. Your rights
You may ask us to confirm what we hold, correct or delete it, object to processing,
withdraw consent, or complain. Write to the Information Officer above. You may also
complain to the Information Regulator (South Africa).
9. Security
Traffic is encrypted in transit. Access to personal information is restricted to
staff who need it. Payment card details never reach our servers.
10. Children
The site is not intended for under-18s and we do not knowingly collect their data.
11. Changes
Material changes are notified and you will be asked to accept the new version. Each
version is retained, and the version in force when you ordered is the one that
applies to that order.