Privacy Policy

1. Who We Are (Responsible Party)

The responsible party for your personal information is:

2. What Personal Information We Collect

We only collect personal information that is necessary to process your order. This includes:

• First name and last name
• Email address
• Phone number (optional)
• Delivery or collection preference and associated notes
• Order details (items purchased, total amount)
• Payment confirmation reference from PayFast (we do not store card or banking details)

3. Why We Collect Your Information (Purpose)

Your personal information is collected and used for the following purposes:

• To process and fulfil your purchase order
• To contact you regarding delivery or collection arrangements
• To send an order confirmation
• To resolve any queries or disputes related to your order
• To comply with our legal and financial record-keeping obligations
• With your explicit consent, to add you to our customer relationship management (CRM) system for the purpose of sending updates about new stock, promotions, and GRSPCA news

We will only use your information for CRM or marketing purposes if you have given your explicit consent. You may withdraw consent at any time by contacting us at charityshop@grspca.co.za.

4. Legal Basis for Processing

We process your personal information on the following grounds under POPIA:

• Contractual necessity - processing is required to fulfil the purchase agreement between you and the GRSPCA Charity Shop.
• Legal obligation - we are required to maintain financial and transaction records in compliance with applicable South African law.
• Legitimate interest - to contact you regarding arrangements related to your order.

5. How We Store Your Information

Your order information is stored securely in a cloud database (Supabase) with access restricted to authorised GRSPCA staff only. We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, disclosure, or destruction.

Payment processing is handled by PayFast (Pty) Ltd, a South African PCI-DSS compliant payment gateway. We never receive or store your card or banking details.

6. Sharing of Personal Information

We do not sell, rent, or trade your personal information. We may share your information only with:

• PayFast (Pty) Ltd - our payment processor, solely to complete your transaction. PayFast's privacy policy is available at payfast.co.za.
• GRSPCA staff - only those who need access to arrange your order.
• Legal authorities - if required to do so by law or a valid court order.

7. Retention of Personal Information

We retain your order information for a period of 5 years from the date of purchase, as required for financial record-keeping under South African law. After this period, your personal information will be securely deleted or anonymised.

8. Your Rights Under POPIA

As a data subject, you have the following rights:

• Right of access - you may request a copy of the personal information we hold about you.
• Right to correction - you may request that inaccurate or incomplete information be corrected.
• Right to deletion - you may request deletion of your personal information, subject to our legal retention obligations.
• Right to object - you may object to the processing of your personal information on legitimate grounds.
• Right to lodge a complaint - you have the right to lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, please contact us at charityshop@grspca.co.za. We will respond within 30 days.

9. Cookies and Website Tracking

Our website uses only essential browser storage (localStorage) to maintain your shopping cart during your session. We do not use tracking cookies, advertising pixels, or third-party analytics tools that collect personal information.

10. Information Regulator Contact Details

If you believe your personal information has been processed unlawfully or your rights have not been respected, you may contact the Information Regulator of South Africa:

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be reflected on this page with an updated date. We encourage you to review this policy periodically.

12. Contact Us

For any privacy-related queries or to exercise your rights, please contact: