Privacy Policy

The responsible party is [TEHAN TO CONFIRM: registered business name], trading as LICENSD, registration number [TEHAN TO CONFIRM: CIPC registration number], of [TEHAN TO CONFIRM: registered address].

Our Information Officer is [TEHAN TO CONFIRM: Information Officer name — must be registered with the Information Regulator] and can be reached at [TEHAN TO CONFIRM: privacy email address].

We collect the minimum we need to run a drop and get a parcel to your door. Specifically:

Waitlist signups

• Your email address, the date you signed up, and which page you signed up from.
• Purpose: to email you when a drop goes live. That is the only thing we use it for.
• Legal basis: your consent, given when you submit the form. You can withdraw it at any time.

Orders

• Your name, email address and phone number.
• Your delivery address: street address, complex or unit, suburb, city, province and postal code.
• What you bought, the sizes, the amount paid and the time of the order.
• A payment reference from our payment provider. We never receive or store your card number, CVV or bank login.
• Purpose: to process the order, take payment, deliver the goods, handle returns, and keep the accounting records the law requires.
• Legal basis: performance of our contract with you, and compliance with our legal obligations.

Technical information

• Your cart contents and a randomly generated cart identifier, stored in your browser so your cart survives a page refresh and so we can hold stock for you during checkout.
• A cookie recording which orders your browser is allowed to view, so a stranger with your order number cannot read your address.
• Standard server logs (IP address, browser type, pages requested) kept for security and troubleshooting.

[TEHAN TO CONFIRM: whether analytics (e.g. Google Analytics, Plausible) will be added — if so this section must be updated]

• We do not sell your personal information. Ever.
• We do not share your details with advertisers or data brokers.
• We do not send marketing to people who have not asked for it.
• We do not collect special personal information (health, religion, biometrics, political views) or knowingly collect information from children under 18.

We share only what each of these operators needs to do their job, and only for that purpose:

• Our hosting and database provider (Supabase), which stores the data described above.
• Our payment provider (PayFast), which receives your name, email and the amount due in order to take payment. [TEHAN TO CONFIRM: final payment provider before launch]
• Our courier, [TEHAN TO CONFIRM: courier name], which receives your name, delivery address and phone number in order to deliver your parcel.
• Our email provider, [TEHAN TO CONFIRM: email provider, e.g. Resend], which handles order and drop notification emails.

Some of these providers store data outside South Africa. Where that happens we rely on section 72 of POPIA — the receiving country or the contract with the provider must give a level of protection substantially similar to POPIA. [TEHAN TO CONFIRM: confirm hosting region and cross-border transfer basis]

We will also disclose information where the law requires it, or to establish or defend a legal claim.

• Order records: 5 years from the end of the financial year in which the order was placed, as required by tax and company law.
• Waitlist emails: until you unsubscribe or ask us to delete them, and in any event no longer than we are actively running drops.
• Server logs: [TEHAN TO CONFIRM: log retention period].
• Expired stock reservations and abandoned carts: cleared automatically as they lapse.

• All traffic to and from this site is encrypted in transit (HTTPS).
• Order and customer data sits behind row-level security in our database — the public website has no read access to it at all. Orders can only be read by our own server processes and by named administrators.
• Reading an order requires either the browser that placed it, or the order number together with the email address it was placed with.
• Administrator access requires an individual login. Card data never touches our systems.

If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.

Under POPIA you have the right to:

• ask what personal information we hold about you, and receive a copy;
• have information that is inaccurate, irrelevant, excessive or out of date corrected or deleted;
• object to us processing your information, on reasonable grounds;
• withdraw consent for marketing at any time — every drop email has an unsubscribe link;
• complain to the Information Regulator.

To exercise any of these, email [TEHAN TO CONFIRM: privacy email address]. We respond within 30 days. Requests for access are made on Form 2 under the Promotion of Access to Information Act; we will send you the form if you need it.

Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Complaints: complaints.IR@justice.gov.za. General enquiries: enquiries@inforegulator.org.za.

We use only what the site needs to function: your cart, your cart identifier and the order-access cookie described in section 2. We do not use advertising or tracking cookies. If that changes, this page will be updated and a cookie notice added.

We will post any changes to this policy on this page and update the date at the top. Questions go to [TEHAN TO CONFIRM: privacy email address] or through our contact page.