What we hold, and why.

Who is responsible

ZEVA is the responsible party for your personal information under POPIA. Our full registered details are in section 1 of our terms and conditions.

Information Officer. Every business in South Africa has one by default, and ours is the company's director. You do not need their name to exercise any right in this policy — write to info@zeva.co.za and it reaches them. Our registered company details are in section 1 of our terms and conditions.

What we collect, and why

To fill your order: your name, email, delivery address and phone number. Without these we cannot deliver to you, so this is information we need to perform our contract with you.

To support you: your order history and anything you write to us, so we can answer without asking you to repeat yourself.

Automatically: your IP address, browser and which pages you visited, so the store works and so we can see what is being read.

We never see your card details. Payment is handled by our payment provider on their own system. Card data does not reach our servers and we cannot store it because we never have it.

We do not collect special personal information, and we do not knowingly collect anything from children.

Marketing

We email you about your order whether or not you opt in, because you need to know where it is. That is not marketing and you cannot unsubscribe from it.

Marketing email is separate. It goes only to people who ticked the box themselves, or to customers who have bought from us before — which section 69(3) of POPIA allows for our own similar products. Every one carries an unsubscribe link that works, and one click is enough.

How long we keep it

Order and tax records for five years from the end of the tax year, which the Tax Administration Act requires of us. Marketing consent until you withdraw it. Support emails for two years. Anything we no longer need, we delete.

Who else sees it

Shopify hosts this store and processes orders on our behalf. Our courier — The Courier Guy or Aramex — receives your name, address and phone number so they can deliver. Our payment provider receives what it needs to take payment. Our supplier receives a delivery address only.

Nobody else. We do not sell your personal information, and we do not share it for anyone else's marketing.

Information that leaves South Africa

Shopify stores data outside South Africa. Section 72 of POPIA permits that where the recipient is bound by rules giving comparable protection, or where the transfer is necessary to perform our contract with you. Both apply here: Shopify is contractually bound to protect it, and we cannot run the store without them.

How we protect it

The store runs over an encrypted connection. Access to the admin is limited to people who need it and protected by a password and two-factor authentication. Card data never reaches us at all.

If there is a breach that affects your information, section 22 of POPIA requires us to tell the Information Regulator and to tell you, as soon as reasonably possible. We will, in plain language, and we will tell you what to do about it.

Your rights under POPIA

You may ask what we hold about you, ask us to correct it, ask us to delete it, object to us processing it, and withdraw a consent you gave. Email info@zeva.co.za and we will respond within one month. It costs you nothing.

Some records must be kept for the tax period above even after you ask us to delete an account. We will tell you which, and delete the rest.

Cookies

This store uses cookies to keep your bag between pages and to understand which pages are visited. You can block them in your browser; the bag will stop working.

Complaints

Tell us first if you can — info@zeva.co.za. You do not have to. You may complain directly to the Information Regulator of South Africa, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or by email to POPIAComplaints@inforegulator.org.za.