Privacy Policy (POPIA) — Candy Bags etc.
> DRAFT — NOT IN FORCE. Support material prepared 2026-07-16 for the
> new platform, revised 2026-08-18 to cover the customer record now built
> from guest orders and the order-tracking page. The legacy site's privacy
> wording predates POPIA good practice; this is a fresh draft. **Must be
> reviewed by a qualified practitioner (POPIA/legal) and signed off before
> publication.**
> Open items are marked ⚠.
Who is responsible for your information
Candy Bags etc. is the "responsible party" under the Protection of
Personal Information Act 4 of 2013 (POPIA).
Contact for privacy matters: sales@candybags.co.za · WhatsApp 082 878 2823.
⚠ Appoint/name the Information Officer (default: the business owner) and
register with the Information Regulator if required.
What we collect, and why
| Information | Why we need it |
|---|---|
| Name and surname | To address you and label your parcel |
| Email address | Order confirmations and status updates |
| Phone number | Delivery coordination and WhatsApp queries |
| Delivery address | To deliver your order |
| Order history | Service, warranty and returns |
| A customer record built from your orders | To recognise you when you come back, and to help with returns without asking you to repeat yourself |
We do not collect or store card numbers — card payments are processed
by PayFast, who handle that data under their own PCI-DSS compliance.
Your customer record
You do not need an account to shop with us, and we do not ask you to
create one before you buy.
When an order is paid we keep a customer record built from that order: your
name, email, phone, the delivery address used, and a list of your orders
with their dates and totals. This is the same information you already gave
us to place the order — we keep it together, under your email address, so
that a second order is recognised as yours rather than treated as a
stranger's.
We use it to serve you: to find your order when you contact us, to handle
a return or a warranty claim, and to see that you are a returning customer.
We do not use it to build a profile of you for advertising, and we do not
share it with anyone beyond the parties listed below.
Checking an order without an account. You can look up an order at
`candybags.co.za/track` using your order number and the email address you
ordered with. We show only what you need to identify your order and see
where it is — the items, the total, the suburb it is going to and its
delivery status. We deliberately do not show the street address or
phone number on that page.
If you create an account (optional, offered after checkout), the
customer record we already hold from your orders is linked to it and
becomes the record you can see and correct yourself. You are not given a
second, separate record.
Who your information is shared with
Only what is needed, only to fulfil your order:
- Couriers (The Courier Guy): name, address, phone, email — to
deliver and to send you tracking notifications.
- Supplier partners: your name and delivery address appear on the
dispatch instruction when an item ships from a supplier's warehouse.
- PayFast: processes your payment; we receive only confirmation.
- We do not sell or rent personal information to anyone. We disclose it
beyond the above only with your consent or where the law requires.
Marketing
We only send marketing (e.g. new-arrivals mails) if you opted in, and
every message includes an unsubscribe. ⚠ Confirm whether the legacy
Mailchimp list migrates (open feature decision) — if it does, consent
status migrates with it.
How long we keep it
- Order records: kept for the periods required by tax and consumer law.
- Customer records (see "Your customer record" above): kept for as long as
the orders they are built from, since they are built from those orders.
They are deleted on request, subject to the records we must keep by law.
- Dormant customers: ⚠ open decision — proposed policy: personal data of
customers with no orders for N years is deleted/anonymised (Pierre to
set N; roadmap "dormant-customer purge policy"). This applies to
customer records whether or not the person ever created an account.
- Supplier stock pages and internal dashboards contain no customer
personal information.
Your rights (POPIA ss 23–25)
You may ask us at any time to:
- confirm what personal information we hold about you,
- correct it,
- delete it (unless we must keep it by law), or
- object to processing/marketing.
Write to sales@candybags.co.za. If you are not satisfied, you may
complain to the Information Regulator (inforeg.org.za).
Cookies
The shop uses cookies strictly needed for the cart and sign-in, plus
⚠ list any analytics actually enabled at launch (decision pending —
legacy used Google Analytics/Facebook pixel; confirm keep/drop).
Security
Access to customer data is limited to named staff accounts, protected by
authentication; data in transit is encrypted (HTTPS); payment data never
touches our servers. The order-tracking page requires both the order number
and the matching email address, gives the same answer whenever either is
wrong so that it cannot be used to discover whether an order exists, and
limits how often it may be tried from one connection. Data is hosted on
Google Firebase ⚠ region: africa-south1 (South Africa) — confirm wording
on offshore sub-processors if any are added.
---
*Draft prepared by Candy Bags AI. Requires POPIA/legal review before
publication.*