Privacy Policy — The Velvet Hour

Last updated: [insert date you publish]

This Privacy Policy describes how The Velvet Hour ("the Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from thevelvethour.co.za (the "Site") or otherwise communicate with us (collectively, the "Services"). This Policy is provided in accordance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa. For purposes of this Policy, "you" means the user of the Services, and "personal information" has the meaning given to it in POPIA.

We are the responsible party for the processing of your personal information under POPIA.

Please read this Privacy Policy carefully. By using the Services, you agree to the collection, use, and disclosure of your information as described here. Our Services are strictly for persons aged 18 and older. If you do not agree to this Policy, please do not use the Services.

---

A note on the nature of our products

Because we sell intimate and adult-lifestyle products, some information we process (such as your orders) may relate to your sex life, which is special personal information under section 26 of POPIA. We process such information only with your consent, only as necessary to fulfil your order and provide the Services, and with additional care and safeguards. We keep your orders and communications confidential, use plain, unbranded packaging, and use a discreet billing descriptor.

---

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal, or regulatory reasons. We will post the revised Policy on the Site, update the "Last updated" date, and take any other steps required by law.

How We Collect and Use Your Personal Information

To provide the Services, we collect personal information from a variety of sources. What we collect varies depending on how you interact with us. In addition to the specific uses below, we may use your information to communicate with you, provide the Services, comply with legal obligations, enforce our terms, and protect our rights and those of our users.

Lawful basis (section 11 of POPIA). We only process your personal information where: you have consented; processing is necessary to conclude or perform a contract with you (e.g. your order); processing is required by law; or processing is necessary for our (or a third party's) legitimate interests, balanced against your rights.

Information We Collect Directly from You

• Contact details — name, address, phone number, email.
• Order information — name, billing and shipping address, payment confirmation, email, phone number.
• Account information — username, password.
• Shopping information — items you view, add to cart, or add to a wishlist.
• Customer support information — anything you include when you contact us.
• Age confirmation — confirmation that you are 18 or older.

Some features may require this information; you may choose not to provide it, but that may prevent you from using those features.

Information We Collect through Cookies

We automatically collect certain information about your interaction with the Services ("Usage Data") using cookies, pixels and similar technologies. Usage Data may include device and browser information, network and IP information, and other information about your interaction with the Services. Most browsers accept cookies by default; you can set your browser to remove or reject cookies, though this may affect how the Services work.

Information We Obtain from Third Parties

We may obtain information from third parties who collect it on our behalf, such as our e-commerce platform (Shopify) and our payment processor (Yoco), who collect payment information to process your payments and fulfil your orders. Any information we obtain from third parties is treated in accordance with this Policy. We are not responsible for third parties' own policies or practices.

How We Use Your Personal Information

• Providing products and services — to process payments, fulfil orders, manage your account, arrange shipping, handle returns and exchanges, and send you related notifications (performance of our contract with you).
• Marketing and advertising — to send you marketing communications and show you relevant advertising. In line with POPIA, we send electronic direct marketing (e.g. email or SMS) only where you have consented (opted in), and you may withdraw consent or opt out at any time using the unsubscribe link or by contacting us.
• Security and fraud prevention — to detect, investigate and act on possible fraudulent, illegal or malicious activity, and to keep your account secure.
• Communicating with you — to provide customer support and improve our Services (our legitimate interest in being responsive and maintaining our relationship with you).

How We Disclose Personal Information

We may disclose your personal information to third parties for legitimate purposes subject to this Policy, including:

• Operators / service providers who process on our behalf (e.g. IT, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping), under agreements requiring them to protect your information.
• Business and marketing partners (such as Shopify), who use your information in accordance with their own privacy notices.
• Where you direct or consent, such as to ship your products or through social media or login integrations.
• In connection with legal obligations or a business transaction (such as a merger), to comply with the law, respond to lawful requests, enforce our terms, and protect our rights and those of others.

We do not sell your personal information, and we do not process special personal information to infer characteristics about you beyond what is necessary to provide the Services.

User-Generated Content

The Services may let you post reviews or other content. Anything you post to a public area is public and accessible by others; we cannot control who accesses it or ensure its security.

Third-Party Websites and Links

Our Site may link to third-party websites. We are not responsible for their privacy or security practices. Please review their policies before providing information.

Children's Information

Our Services are intended only for persons 18 years or older and are not directed at children. Under POPIA a "child" is a person under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, please contact us and we will delete it.

Security and Retention

No security measures are perfect, and we cannot guarantee absolute security; information sent to us may not be secure in transit. We take reasonable technical and organisational measures to protect your information. In the event of a security compromise, we will notify you and the Information Regulator as required by section 22 of POPIA. We retain your personal information only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

Your Rights Under POPIA

Subject to the conditions and exceptions in POPIA, you have the right to:

• Be notified that your information is being collected or has been accessed by an unauthorised party.
• Access the personal information we hold about you.
• Correct or delete inaccurate, irrelevant, excessive, or unlawfully obtained information.
• Object to the processing of your personal information on reasonable grounds (free of charge, through accessible channels).
• Object to direct marketing and withdraw any consent you have given.
• Not be subject to a decision based solely on automated processing.
• Lodge a complaint with the Information Regulator (details below).

To exercise any of these rights, contact our Information Officer using the details below. We may need to verify your identity first, and we will respond as required by law. We will not discriminate against you for exercising your rights.

International Transfers

We may transfer, store and process your personal information outside South Africa (for example, through service providers such as Shopify). Where we do, we do so in accordance with section 72 of POPIA — only where the recipient is subject to laws, binding rules or agreements that provide adequate protection, where you have consented, or where the transfer is necessary to perform our contract with you.

Complaints

If you have a complaint about how we process your personal information, please contact our Information Officer first. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• POPIA complaints email: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za

Contact — Responsible Party & Information Officer

Responsible party: The Velvet Hour Information Officer: Christopher Burger Email: info@velvethour.co.za, Address: South Africa