Privacy Policy (POPIA) — Candy Bags etc.

> DRAFT — NOT IN FORCE. Support material prepared 2026-07-16 for the

> new platform. The legacy site's privacy wording predates POPIA good

> practice; this is a fresh draft. **Must be reviewed by a qualified

> practitioner (POPIA/legal) and signed off before publication.**

> Open items are marked ⚠.

Who is responsible for your information

Candy Bags etc. is the "responsible party" under the Protection of

Personal Information Act 4 of 2013 (POPIA).

Contact for privacy matters: sales@candybags.co.za · WhatsApp 082 878 2823.

⚠ Appoint/name the Information Officer (default: the business owner) and

What we collect, and why

| Information | Why we need it |

|---|---|

| Name and surname | To address you and label your parcel |

| Email address | Order confirmations and status updates |

| Phone number | Delivery coordination and WhatsApp queries |

| Delivery address | To deliver your order |

| Order history | Service, warranty and returns |

We do not collect or store card numbers — card payments are processed

by PayFast, who handle that data under their own PCI-DSS compliance.

Who your information is shared with

Only what is needed, only to fulfil your order:

Couriers (The Courier Guy): name, address, phone, email — to

deliver and to send you tracking notifications.

Supplier partners: your name and delivery address appear on the

dispatch instruction when an item ships from a supplier's warehouse.

PayFast: processes your payment; we receive only confirmation.
We do not sell or rent personal information to anyone. We disclose it

beyond the above only with your consent or where the law requires.

Marketing

We only send marketing (e.g. new-arrivals mails) if you opted in, and

every message includes an unsubscribe. ⚠ Confirm whether the legacy

Mailchimp list migrates (open feature decision) — if it does, consent

status migrates with it.

How long we keep it

Order records: kept for the periods required by tax and consumer law.
Dormant accounts: ⚠ open decision — proposed policy: personal data of

customers with no orders for N years is deleted/anonymised (Pierre to

set N; roadmap "dormant-customer purge policy").

Supplier stock pages and internal dashboards contain no customer

personal information.

Your rights (POPIA ss 23–25)

You may ask us at any time to:

confirm what personal information we hold about you,
correct it,
delete it (unless we must keep it by law), or
object to processing/marketing.

Write to sales@candybags.co.za. If you are not satisfied, you may

complain to the Information Regulator (inforeg.org.za).

Cookies

The shop uses cookies strictly needed for the cart and sign-in, plus

⚠ list any analytics actually enabled at launch (decision pending —

legacy used Google Analytics/Facebook pixel; confirm keep/drop).

Security

Access to customer data is limited to named staff accounts, protected by

authentication; data in transit is encrypted (HTTPS); payment data never

touches our servers. Data is hosted on Google Firebase

⚠ region: africa-south1 (South Africa) — confirm wording on offshore

sub-processors if any are added.

---

*Draft prepared by Candy Bags AI. Requires POPIA/legal review before

publication.*