Privacy and Cookie Policy
Last updated: 28 July 2026
This policy explains what we do with your personal information. We process it under the Protection of Personal Information Act (POPIA).
We have written it in plain language on purpose. A privacy policy you cannot read is not a privacy policy.
1. Who is responsible for your information
| Responsible party | MABALINGWE 215 CC, trading as Homeware & Tech |
| Registration number | 2000/075802/23 |
| Registered address | 31 Monument Avenue, Lyttelton, Gauteng, 0157 |
| Information Officer | Karl Horak |
| Contact for privacy matters | az.oc.hceterawemoh@selas · 063 287 0102 |
2. What we collect, and why
Section 11 of POPIA says we may only process your information where we have a lawful basis for it. Here is everything we collect and the basis for each.
| What | Examples | Why we have it | Basis under section 11 |
|---|---|---|---|
| Who you are | Name, email address, phone number | To take your order, contact you about it, and prove your purchase if you return something | Necessary to perform our contract with you |
| Where things go | Delivery address, collection store | To deliver or hold your order | Necessary to perform our contract with you |
| What you bought | Order history, invoices, returns and warranty claims | To honour returns and warranty, and because tax law requires us to keep records | Contract, and compliance with a legal obligation |
| Payment | The fact and amount of payment, and the result | To take payment and to refund you. We never see, receive or store your card number, expiry date or CVV — those go straight to our payment provider | Necessary to perform our contract with you |
| How you use the website | Pages viewed, device and browser, approximate location from your IP address, referring site | To keep the site working, spot fraud, and understand what people are looking for | Our legitimate interests, and your consent where cookies are involved — see section 9 |
| Marketing | Your email address, whether you have objected, and whether you opened or clicked | To send you offers on products like the ones you bought | Our legitimate interests (section 11(1)(f)), within the limits section 69 sets — see section 3. Your consent (section 11(1)(a)) if you have not bought from us |
| Talking to us | Emails, WhatsApp messages, call notes | To answer you and keep a record of what was agreed | Our legitimate interests |
| Signed condition notes | Your signature accepting the condition of an ex-rental item bought in store | To prove what condition was disclosed and accepted, as section 55(6) of the Consumer Protection Act requires | Compliance with a legal obligation, and our legitimate interests |
Our website is not aimed at children and we do not knowingly collect the personal information of anyone under 18. Under South African law a person under 18 needs a parent or guardian’s assistance to buy from us. If you believe we hold a child’s information, email az.oc.hceterawemoh@selas and we will delete it.
Some of what we ask for is required rather than optional. We cannot complete a sale without your name, contact details and — for a delivery — your address; and tax law (the Tax Administration Act and the VAT Act) requires us to record and keep invoice details for five years. Everything else is voluntary, and leaving it out only means we cannot do the thing it was for.
We do not sell your personal information to anyone.
3. Marketing emails
If you buy from us, we may contact you by email about products like the ones you bought. Section 69 of POPIA allows this without asking you first, because you gave us your address in the course of a sale and we are only marketing our own similar products. That is the only reason we may do it, and it comes with conditions we keep:
- You can say no at the point you give it to us. There is a box at checkout to tell us not to send you marketing. Tick it and we do not add you.
- Every marketing email has an unsubscribe link, and it works immediately. Section 69 requires that we identify ourselves and give you a way to tell us to stop.
- You can object at any time, not only at checkout. Email az.oc.hceterawemoh@selas and we will remove you.
- If you have not bought from us, we will only email you marketing if you have actively asked us to.
We use Resend to send our email. We send them your email address and your name, nothing more.
You may also register on the National Consumer Commission’s opt-out registry, which records a general objection to direct marketing across all companies. We check our list against that registry every month and remove anyone who has registered a block.
4. Who else sees your information
We share only what each of these needs to do its job.
| Who | What they get | Why |
|---|---|---|
| SnapScan — payment provider | Your payment details, entered directly on their systems | To take and refund payments |
| The Courier Guy — courier | Your name, delivery address and phone number | To deliver your order |
| Resend — email platform | Your email address and name | To send order emails and marketing you have not objected to |
| Google — analytics and advertising | Website usage data, and advertising identifiers only if you consent to marketing cookies | To measure the website and to show our ads |
| Meta (Facebook and Instagram) — advertising | Website usage data and advertising identifiers only if you consent to marketing cookies | To show our ads |
| Our website hosting provider | Whatever is stored on the website | To run the website |
We will also share information where the law requires it — for example with SARS, or with the police under a valid instruction.
5. Sending information outside South Africa
Section 72 of POPIA limits when we may send your information out of the country. Three of the companies above process information outside South Africa:
- Google and Meta — both are bound by contractual terms requiring an adequate level of protection, upholding principles for lawful processing substantially similar to POPIA’s, and restricting any onward transfer on substantially the same conditions.
- Resend (Resend, Inc., United States) — under its published data processing agreement at resend.com/legal/dpa, on the same terms, with its own subprocessors listed at resend.com/legal/subprocessors.
We rely on section 72(1)(a) — a binding agreement providing adequate protection, including for any further transfer. For the emails needed to fulfil your order we also rely on section 72(1)(c), because that transfer is necessary to perform our contract with you. For advertising we transfer only after you have consented to marketing cookies, so section 72(1)(b) applies as well.
Those binding agreements are what allow us to send your information out of the country.
6. How long we keep it
| What | How long |
|---|---|
| Order, invoice and payment records | 5 years, because tax law requires it |
| Returns and warranty records | 5 years, so that we can evidence what was agreed if a claim is disputed |
| Marketing contact details | Until you unsubscribe or object, and then we keep only enough to remember not to contact you again |
| Website and analytics data | Until you change or withdraw your cookie choice, and in any event no longer than 14 months in Google Analytics — see section 9 |
| Emails, WhatsApp messages and call notes | 3 years |
7. How we protect it
- The website runs over TLS, so information you send us travels encrypted.
- We never see, receive or store your card number, expiry date or CVV — they go to our payment provider on their own secured systems.
- Access to customer records is limited to staff who need it to do their job.
- If we have reasonable grounds to believe someone has accessed or obtained your personal information without authorisation, section 22 of POPIA requires us to notify both you and the Information Regulator as soon as reasonably possible after we find out — and to tell you what happened, what we are doing about it, and what you can do. We will.
8. Your rights
Under POPIA you may:
- Ask what we hold about you, and get a copy.
- Have it corrected or deleted if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully — or if we no longer have a reason to keep it.
- Object to us processing it, including for marketing.
- Withdraw consent you have given, at any time — for cookies, see section 9.
- Complain — to us first, and to the Information Regulator if we do not resolve it.
To exercise any of these, email az.oc.hceterawemoh@selas or call 063 287 0102. We will respond as soon as we reasonably can. We may ask you to confirm who you are first, so that we do not hand your information to someone else.
9. Cookies and advertising tags
A cookie is a small file a website stores on your device. Some are needed for the site to work at all. Others measure how the site is used, or let us advertise to you.
We do not set anything except the strictly necessary cookies until you tell us we may. When you first visit, you will see a banner where you can accept all, reject all, or choose. Rejecting is as easy as accepting. Nothing in the analytics or marketing rows below runs before you consent.
| Category | What it does | Examples | Runs before consent? |
|---|---|---|---|
| Strictly necessary | Keeps you logged in, remembers your basket, processes checkout, keeps the site secure | Session and basket cookies, security cookies, your cookie choice itself | Yes — the site cannot work without these |
| Functional | Remembers preferences such as your chosen store | Preference cookies | No |
| Analytics | Tells us which pages people visit and where they get stuck, so we can improve the site | Google Analytics via the Google tag | No |
| Marketing | Lets us show our products to people who have visited us, and measure whether our ads work | Google Ads remarketing tags, Meta Pixel, and Meta’s Conversions API | No |
Changing your mind. You can change or withdraw your cookie choice at any time using the cookie settings link in the footer of every page. We will ask you again after 12 months in any case, so a choice you made a year ago does not stand forever.
You can also block or delete cookies in your browser settings. If you block the strictly necessary ones, parts of the website will stop working.
10. Complaining to the regulator
If you are not satisfied with how we have handled your information, you may complain to the Information Regulator:
- Complaints are lodged through the Regulator’s eServices Portal — you register a profile at eservices.inforegulator.org.za and submit the complaint there
- General enquiries: az.gro.rotalugerofni@seiriuqne
- Telephone 010 023 5200 · toll-free 0800 017 160
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- inforegulator.org.za
We would rather you told us first, but you are not obliged to.
11. Changes to this policy
We will update this page when what we do changes. The date at the top tells you when it was last reviewed. If we make a change that materially affects how we use your information, we will tell you rather than rely on you checking.