Privacy policy

This policy explains what personal information Ivana Sofia collects, why we collect it, who we share it with and what you can do about it. It is written to meet the Protection of Personal Information Act 4 of 2013, which South Africans call POPIA.

Who is responsible for your information

The responsible party is Ivana Sofia, 57 Cayman Road, Eikenhof, Johannesburg, Gauteng, 1872. As POPIA provides, the head of the business is our information officer, and you can reach that office at hello@ivanasofia.co.za or on 011 012 3156 between 9am and 4pm on working days.

What we collect and why

We ask for as little as the job requires, and we use it for the purpose it was given.

Information	Why we hold it
Name, email address, telephone number, delivery address	To process your order, hand the parcel to the courier and keep you informed about it
Order and payment history	To fulfil the sale, handle returns and refunds, and keep the accounting and tax records the law requires of us
Account password, stored in encrypted form	To let you sign in and see your own orders and addresses
Reviews, ratings and any photographs you submit	To publish your review, with your first name and town, on the product page
Scent finder answers and wishlist items	To give you a recommendation and to remember what you liked
Email address given to the newsletter	To send you the newsletter until you unsubscribe
Website usage data, such as pages viewed and the device used	To understand how the site is used and improve it, where you have allowed analytics cookies

We do not ask for and do not want your identity number, your card number or any information about your health, religion, politics or race. Card details are entered on PayFast's own secure pages and never reach us.

The lawful basis for using it

Section 11 of POPIA requires a justification for every use of personal information. Most of what we hold is necessary to perform the contract you entered into when you ordered, since we cannot deliver a parcel without an address. Some we keep to comply with a legal obligation, such as retaining invoices for tax. A little serves our legitimate interests, such as preventing fraud and keeping the site working. Newsletters, non-essential cookies and the publication of your review rest on your consent, which you may withdraw at any time.

On direct marketing, section 69 of POPIA allows us to email existing customers about similar products, with an unsubscribe link in every message. If you have not bought from us, we email you only if you asked us to.

Who we share it with

We do not sell personal information, ever. We share only what a service provider needs to do its part of the job, and each is bound to use it only on our instructions.

• PayFast, our South African payment provider, processes your payment and receives your name, email address and order amount.
• Bob Go and the courier that carries your parcel receive your name, delivery address and contact number so the parcel can be delivered and tracked.
• Our email provider sends order confirmations, tracking notices, review invitations and the newsletter, and holds your name and email address to do it.
• Google Analytics, through Google Tag Manager, gives us aggregate statistics about how the site is used. It runs only after you accept analytics cookies.
• Our hosting provider stores the site and its database on our behalf.

We may also disclose information where the law requires it, or where it is necessary to establish or defend a legal claim.

Cookies and consent

Essential cookies keep your session and your shopping bag working and cannot be switched off without breaking the site. Analytics stay switched off until you choose to accept them on the banner, and you can change your mind at any time. Everything we set is listed on our cookies page.

How long we keep it

Order, invoice and payment records are kept for five years from the end of the tax year they fall in, because South African tax law requires it. Account details are kept while your account is open and for a year afterwards. Newsletter records are kept until you unsubscribe, plus a suppression record so that we do not email you again by mistake. Published reviews stay up until you ask us to remove them. When information is no longer needed, we delete or de-identify it, as section 14 of POPIA requires.

Your rights

Under sections 23 to 25 of POPIA, and section 11(3) as well, you may:

• ask whether we hold information about you, and ask us to provide it to you;
• ask us to correct anything that is inaccurate, misleading or out of date;
• ask us to delete information we no longer have grounds to keep;
• object, on reasonable grounds, to our processing of your information; and
• withdraw a consent you gave, including for marketing, at any time.

Write to hello@ivanasofia.co.za and we will respond within a reasonable period. We may ask you to confirm your identity first, so that nobody obtains your information by pretending to be you. There is no charge for a correction or for unsubscribing, although a formal access request under the Promotion of Access to Information Act may carry the prescribed fee.

Complaining to the Information Regulator

If you are not satisfied with how we have handled your information, you may complain to the Information Regulator of South Africa on the prescribed form. The Regulator is at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Complaints go to complaints.IR@justice.gov.za, enquiries to enquiries@inforegulator.org.za, and the forms are published at inforegulator.org.za. We would rather you told us first, but the right is yours either way.

Information sent outside South Africa

Some of our service providers, including Google and certain email and hosting services, process information on servers outside South Africa. Section 72 of POPIA allows this where the recipient is subject to a law or a binding agreement protecting your information to a standard comparable with POPIA, or where the transfer is necessary to perform the contract with you. We rely on the data-protection terms in our agreements with those providers.

Security

The site runs over an encrypted connection, passwords are stored hashed rather than in plain text, and access to the order database is limited to the people who need it. No system is perfect. If a breach ever affected your information, we would notify you and the Information Regulator as section 22 of POPIA requires.

Children

The site is meant for adults. We do not knowingly collect information about children under 18 without the consent of a parent or guardian.

Changes

We will update this page when our practices change. The date at the foot of the page tells you when it was last revised. Our terms and conditions sit alongside this policy.