Privacy policy

Last updated: 4 September 2026

Who is responsible and how to contact us

The responsible party for PompPakkie's processing is Daniel Culbert, trading as PompPakkie. Privacy requests can be sent to hello@pomppakkie.co.za, addressed to the Information Officer.

This policy explains how personal information is used for the online store, orders, support and related services. Browsing the website is not blanket consent to every use of information described here.

For delivery, cancellations, product warranties and refunds, see our separate Shipping Policy, Returns and Refunds Policy and Terms of Service. Those purchase terms do not override privacy rights or create marketing consent.

Information we use and where it comes from

Depending on how you use the store, we process:

• Contact and delivery information supplied by you: name, email, telephone number and billing or delivery address.
• Order information: items, amounts, payment status, fulfilment updates, cancellations, returns and correspondence.
• Customer-account information and preferences where you choose to use an account.
• Technical information collected through Shopify and enabled services: device and browser information, IP address, cookies and activity such as page views, cart actions and checkout events.
• Information from our service providers needed to handle the order: payment results and fraud indicators from payment services, and delivery or return updates from couriers and fulfilment partners.

Yoco processes checkout payments. We receive the payment result and information needed to reconcile and support the transaction. Do not email us full card details, passwords or security codes. Yoco privacy policy

We collect information directly when you order or contact us, automatically when your device uses the store, and from the service providers described above. Required checkout fields are needed to process or deliver the order; if you do not supply them, we may be unable to complete it. Optional marketing choices are not a condition of buying.

Purposes and lawful grounds

We use order information to provide the goods and support you request, communicate about delivery and refunds, keep required business records, prevent fraud, secure the store and deal with disputes. Processing must have an applicable lawful ground, such as performing a contract, complying with law, a legitimate interest balanced against your rights, or consent where required. POPIA

Shopify and enhanced services

Our store is hosted by Shopify. Shopify processes information to operate the storefront and checkout, support transactions and provide related services.

Shopify Network Intelligence is enabled. Its enhanced services use information about interactions with this store together with information from Shopify and other merchants to support features including personalisation, fraud protection and advertising. For processing where Shopify acts as a separate responsible party/controller, Shopify handles the corresponding privacy requests. Read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for Shopify's choices and requests. You can still contact us about our own use of your information.

Who receives information

Information is shared as needed with Shopify; payment providers; couriers and fulfilment partners; providers supporting business communications, records and security; and professional advisers or authorities where lawfully necessary. We limit disclosures to information needed for the relevant lawful purpose. If a fulfilment partner dispatches an order for us, it receives the information needed to deliver that order.

Marketing and enhanced-service disclosures, including Shopify's advertising-related processing, are described above. We do not give a courier or fulfilment partner permission to use your delivery details for unrelated marketing.

Meta advertising and purchase measurement

The Facebook & Instagram sales-channel app by Meta connects our product catalogue to Meta. Product names, descriptions, images, prices, availability and product links are synchronised from Shopify. Catalogue syncing is different from sharing a visitor's activity for advertising.

Where you consent to advertising-related processing and we enable these features, Shopify's Meta integration can use the Meta Pixel, advanced matching and Conversions API to measure shopping activity and purchases, match activity to Meta accounts, improve advertising and show relevant ads. Information can include pages and products viewed, cart and checkout actions, purchased items, order value and currency, device and browser information, IP address and cookie identifiers. Where supplied and permitted, matching information can also include your name, email address, telephone number and location/address information. Matching information remains personal information even when transformed or hashed.

Meta may combine the information it receives with information associated with its services. We do not send your payment-card security code or full card number to Meta for advertising. You can refuse optional advertising processing without losing the ability to buy. Read Meta's Privacy Policy and review your choices in Meta's activity-off-Meta settings. Installed-app permissions are separate from a visitor's optional tracking choice.

Cookies, analytics and advertising choices

Cookies and similar technologies support functions such as the cart, checkout, security and preferences. Enabled analytics and enhanced services may also process device and interaction information for measurement, personalisation or advertising.

For visitors in South Africa, our cookie banner asks you to choose before optional analytics, personalisation or advertising tracking is used. Select Decline to refuse optional categories, Accept to allow them, or Manage preferences to choose categories. Essential functions needed for the cart, checkout and security do not depend on marketing consent. Accepting cookies is not consent to promotional emails or messages.

You can use Cookie preferences alongside the store's policy links, or Cookies in the checkout footer, to change or withdraw optional choices. Withdrawal applies to future consent-based processing and does not automatically delete information already lawfully processed. You can contact us to request deletion or exercise another applicable right. Choices can be specific to a browser or device; if you use another browser or clear its storage, you may be asked again. For Shopify's independent processing, use its Privacy Portal. Browser cookie controls alone may not communicate every request to every provider.

Direct marketing

We will send promotional electronic messages only with valid consent or where the limited existing-customer exception in POPIA applies. That exception concerns our own similar products, details obtained during a sale and a free opportunity to object when details are collected and in each message. Each message must identify the sender and provide a way to stop marketing. Silence or simply visiting the store is not marketing consent. Information Regulator guidance on direct marketing

Use the unsubscribe facility or contact hello@pomppakkie.co.za to opt out. Necessary order, delivery, safety or refund messages may still be sent. We keep an appropriate suppression record so your opt-out is respected.

International processing

Information may be processed outside South Africa. Shopify's current hosting setting for this store lists the United States, and Shopify and other service providers may use additional locations. Foreign privacy laws may differ from South African law.

We will transfer information across borders only on an applicable POPIA section 72 ground, including adequate contractual or other recognised protections where required. Contact us for information about the recipient categories, purposes and safeguards relevant to your order. We will not treat this policy as blanket consent to an otherwise unlawful overseas transfer. POPIA, section 72

Retention and security

We keep information only for a justified period: to fulfil orders, provide support and transaction records, meet accounting or other legal duties, resolve disputes and maintain necessary security records. Periods differ by record type, the applicable obligation and any unresolved dispute. Consent and objection records may be kept where needed to demonstrate and respect your choices. We securely delete or de-identify information when there is no continuing lawful reason to retain it.

Our Terms of Service provide a transaction-record copy service for five years after purchase. That service concerns order records; it is not permission to retain every browsing or advertising identifier for five years. A deletion request may therefore be fulfilled for some information while a necessary transaction record is retained for a lawful reason.

We limit access to authorised people and providers who need it and apply reasonable technical and organisational safeguards. No internet system can be guaranteed perfectly secure. We will address a suspected compromise and notify affected people and the Information Regulator where the law requires it. A security disclaimer does not remove our legal duties.

Your rights and requests

You may ask whether we hold your information, request access, seek correction or appropriate deletion, object to processing where allowed, or withdraw consent for future consent-based use. Some records must be retained where a lawful reason continues. We may verify identity proportionately and explain any lawful restriction or applicable access procedure; you do not need to send an identity document with every routine enquiry.

Email hello@pomppakkie.co.za with the request. Where a prescribed or substantially similar form is needed, we will help you obtain it. Requests and complaints will be handled within the applicable legal time limits. Information Regulator request forms

If a significant order-related decision is made using automated fraud screening, you may ask us for a human review and an explanation that we can lawfully provide.

Children and external websites

This store is aimed at adult customers. We do not intentionally seek children's personal information for marketing. If a child has supplied information without the required authorisation, a parent or guardian can contact us so we can investigate and take appropriate action.

Third-party services linked from the store have their own notices. A link does not remove our responsibility for information that we disclose to that service.

Privacy complaints and updates

You may contact us or lodge a complaint with the Information Regulator (South Africa). Its current complaint channels and forms are available on the Information Regulator complaints page; its general telephone is 010 023 5200. You do not have to waive a regulatory complaint to use our support process.

We will revise this notice when practices or requirements change, update the date and give additional notice or obtain fresh consent where required. A revised notice does not retrospectively authorise an incompatible use of information.