Privacy Policy

1. Responsible Party

For the purposes of POPIA, the responsible party (data controller) is:

2. Information We Collect

We collect personal information directly from you when you interact with our website. This may include:

• Full name and surname
• Email address
• Phone number
• Physical delivery address
• Billing address
• Order history and transaction details
• Communication records (emails, enquiries, support tickets)
• IP address, browser type, and device information (collected automatically)
• Cookies and browsing behaviour on our website

3. Purpose of Collection

In accordance with POPIA's purpose specification principle, we collect your personal information for the following specific and lawful purposes:

• To process and fulfil your orders, including delivery via The Courier Guy or PUDO
• To communicate with you regarding your order status, delivery updates, and customer support enquiries
• To issue invoices, process refunds, and maintain accurate financial records
• To comply with legal and regulatory obligations under South African law
• To improve our website, products, and customer experience
• To send you marketing communications, only with your prior explicit consent, which you may withdraw at any time

4. Legal Basis for Processing

We process your personal information on one or more of the following lawful grounds as defined in POPIA:

• Consent: You have voluntarily provided your information and given consent for its processing
• Contract: Processing is necessary to fulfil a purchase agreement between you and Unlimited Fragrances
• Legal Obligation: Processing is required to comply with applicable laws, such as tax and consumer protection legislation
• Legitimate Interest: Processing is necessary for our legitimate business interests, provided it does not infringe on your rights

5. Sharing of Personal Information

We may share your personal information with the following categories of third parties, solely for the purposes outlined in this policy:

• Payment Processor: PayFast (Pty) Ltd — to securely process your transactions
• Courier Partners: The Courier Guy and PUDO — to deliver your orders (name, phone number, and delivery address are shared)
• Shopify: Our e-commerce platform provider, which hosts our website and processes order data
• Regulatory Authorities: Where required by law, such as SARS for tax compliance

We do not sell, rent, or trade your personal information to any third party for marketing purposes. All third-party service providers are contractually bound to handle your information in compliance with POPIA.

6. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience. Cookies are small text files stored on your device that help us understand how you use our site. We use:

• Essential Cookies: Required for the website to function (e.g., shopping cart, login sessions)
• Analytics Cookies: To understand site traffic and user behaviour (e.g., Google Analytics)
• Marketing Cookies: To display relevant advertisements, only with your consent

You can manage or disable cookies through your browser settings at any time. Disabling essential cookies may affect website functionality.

7. Data Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Order and transaction records are retained for a minimum of 5 years in compliance with South African tax legislation (Tax Administration Act)
• Marketing consent records are retained for the duration of your subscription, and deleted upon withdrawal of consent
• Website analytics data is retained in anonymised form

Once the retention period expires, your personal information will be securely destroyed or de-identified in accordance with POPIA.

8. Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include:

• SSL/TLS encryption on our website (HTTPS)
• Secure payment processing through PayFast's PCI-DSS compliant gateway
• Access controls limiting data access to authorised personnel only
• Regular security reviews and updates

In the event of a personal information security breach, we will notify the Information Regulator and affected data subjects as required under Section 22 of POPIA.

9. Your Rights Under POPIA

As a data subject, you have the following rights under POPIA, which you may exercise at any time by contacting us:

• Right of Access: Request confirmation of whether we hold your personal information, and request a copy of such information
• Right to Correction: Request that inaccurate or incomplete personal information be corrected or updated
• Right to Deletion: Request the deletion or destruction of your personal information where it is no longer necessary for its original purpose
• Right to Object: Object to the processing of your personal information for direct marketing or on reasonable grounds
• Right to Withdraw Consent: Withdraw any previously given consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal
• Right to Lodge a Complaint: File a complaint with the Information Regulator if you believe your rights have been infringed

To exercise any of these rights, please contact us at online@unlimitedfragrances.co.za. We will respond within a reasonable time and may request verification of your identity (such as a copy of your ID document) before processing your request. A prescribed fee may apply for access requests.

10. Direct Marketing

We will only send you marketing communications (such as promotional emails or SMS messages) if you have given us your prior explicit consent, or if you are an existing customer and the marketing relates to similar products you have previously purchased from us (in line with Section 69 of POPIA).

Every marketing communication will include a clear and easy option to unsubscribe or opt out. You may also opt out at any time by contacting us directly.

11. Children's Privacy

Our website and products are not directed at children under the age of 18. We do not knowingly collect personal information from minors without the consent of a parent or legal guardian, in accordance with Section 35 of POPIA. If we become aware that we have inadvertently collected such information, we will delete it promptly.

12. Cross-Border Data Transfers

Some of our service providers (such as Shopify) may store data on servers located outside of South Africa. Where personal information is transferred outside of the Republic, we ensure that the receiving party is subject to a law, binding agreement, or binding corporate rules that provide an adequate level of protection, as required by Section 72 of POPIA.

13. Information Regulator

If you are not satisfied with how we have handled your personal information or addressed your concerns, you have the right to lodge a complaint with the Information Regulator of South Africa:

14. Changes to This Policy

We reserve the right to update or amend this Privacy Policy at any time. Any material changes will be communicated by posting the updated policy on our website with a revised effective date. We encourage you to review this policy periodically.