POPI Act Compliance

Galore De Teddies ("we", "us", "our") is committed to protecting the personal information of our customers and users in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and its regulations. This notice explains how we collect, use, store, and protect your personal information, and describes your rights as a data subject.

1. Information Officer

We have appointed an Information Officer responsible for ensuring our compliance with POPIA. To exercise your rights or raise a privacy concern:

• Email: info@galoredeteddies.co.za
• Country: South Africa

2. Personal Information We Process

We collect and process the following categories of personal information:

3. Lawful Basis for Processing

We only process your personal information where we have a lawful basis to do so under POPIA:

• Contractual necessity: Processing required to fulfil your order and deliver the service you have requested.
• Legal obligation: Processing required to comply with South African law (e.g., tax and accounting requirements).
• Legitimate interests: Fraud prevention, site security, and improving our services, balanced against your rights.
• Consent: Where you have opted in to receive marketing communications. You may withdraw consent at any time.

4. Sharing of Personal Information

We do not sell or rent your personal information. We may share it only with:

• PayFast our payment processor, subject to their own privacy and security standards.
• Courier and delivery partners to fulfil your order within South Africa.
• Technology service providers hosting, email, and analytics platforms, all bound by confidentiality agreements.
• Legal and regulatory authorities where required by South African law, court order, or to protect our legal rights.

5. Retention of Personal Information

We retain your personal information only for as long as necessary for the purposes for which it was collected, or as required by applicable law:

• Account data: For the duration of your account plus 3 years after closure.
• Order and transaction records: 5 years, in compliance with South African tax legislation.
• Marketing consent records: Until consent is withdrawn, then deleted promptly.
• Technical / log data: Up to 12 months for security and diagnostic purposes.

6. Security Safeguards

We implement appropriate technical and organisational measures to safeguard your personal information against unauthorised access, loss, alteration, or disclosure, including:

• SSL/TLS encryption for all data transmitted between your browser and our site
• Role-based access controls limiting internal access to your data
• Secure, PCI-DSS compliant payment processing via PayFast (we never store your card details)
• Regular security reviews and software updates
• Incident response procedures in case of a security breach

In the event of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA.

7. Cross-Border Transfers

Where we transfer your personal information outside South Africa (for example, to cloud hosting or email service providers), we take steps to ensure the recipient provides an adequate level of protection for your data, as required under POPIA section 72.

8. Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

• Right of Access (s23): Request confirmation of whether we hold your personal information and obtain a copy of it.
• Right to Correction or Deletion (s24): Request that inaccurate, misleading, or outdated information be corrected or deleted.
• Right to Object (s11): Object to processing where we rely on legitimate interests or for direct marketing purposes.
• Right to Complain (s74): Lodge a complaint with our Information Officer or the Information Regulator if you believe your rights have been infringed.

To exercise any of these rights, please contact us. We will acknowledge your request within 3 business days and respond fully within 30 days.

9. Information Regulator of South Africa

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with the Information Regulator:

• Website: www.justice.gov.za/inforeg/
• Email: inforeg@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

10. Updates to This Notice

We may update this POPIA compliance notice periodically. We will post the revised notice on this page with an updated effective date. For material changes, we will notify registered users by email.