1. Who We Are

Pretty as Pie ("we", "us", "our") operates the website prettyaspie.com and is the "responsible party" for your personal information as defined under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the rights you have over it.

By using our website, placing an order, signing up for our newsletter, or otherwise interacting with us, you acknowledge that you have read and understood this policy.

2. Information We Collect

We collect personal information in the following ways:

• When you place an order: full name, email address, delivery address, phone number, and details of the items you purchased.
• When you create an account: your name and email address, and a record of your order history and saved favourites.
• When you sign up for our newsletter: your email address.
• When you contact us: your name, email address, subject, and the content of your message.
• Automatically, as you browse: your IP address, browser type, device type, pages visited, and general usage patterns, via cookies and analytics tools (see Section 5).

We do not collect or store your payment card details. These are entered directly into our payment processor's secure system (see Section 6).

3. How We Use Your Information

We use the personal information we collect to:

• Process, fulfil, and deliver your orders;
• Communicate with you about your order status, including shipping and delivery updates;
• Respond to enquiries, support requests, and messages sent through our Contact page;
• Send you marketing emails about offers, new arrivals, and skincare tips, where you have opted in — you may unsubscribe at any time using the link in any such email;
• Improve our website, products, and customer experience;
• Detect, investigate, and prevent fraudulent transactions and other illegal activity;
• Comply with our legal and regulatory obligations, including tax and consumer protection law.

4. Our Legal Basis for Processing

We only process your personal information where we have a lawful basis to do so, which includes:

• Performance of a contract — to process and deliver an order you have placed with us;
• Consent — for marketing communications, which you can withdraw at any time;
• Legitimate interest — to keep our website secure, prevent fraud, and improve our services, provided this does not override your rights and interests; and
• Legal obligation — where we are required to retain or disclose information by law (for example, financial recordkeeping for tax purposes).

5. Cookies & Tracking

We use cookies and similar technologies to keep you logged in, remember items in your cart, and understand how our website is used so we can improve it. You can manage your cookie preferences at any time using the "Cookie Preferences" link in our website footer, or through your browser settings.

We may use analytics services (such as Firebase Analytics or Google Analytics) which collect anonymised or pseudonymised usage data. These services may set their own cookies in accordance with their own privacy policies.

6. Payments

All payments on our website are processed securely by Yoco, a registered South African payment service provider. When you pay, your card details are entered directly into Yoco's secure, PCI-DSS compliant payment interface — they are never transmitted to, processed by, or stored on our own servers.

We retain a record of the payment reference and amount for your order (for accounting, customer support, and refund purposes), but never your full card number, expiry date, or CVV.

7. Sharing Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We only share what is necessary, and only with the following categories of recipients, to operate our business:

• Payment processing — Yoco, to process your payment;
• Delivery — PUDO, to deliver your order to you;
• Hosting & infrastructure — Google Firebase, which stores our website's data securely on our behalf;
• Legal or regulatory bodies — where required by law, court order, or to protect our legal rights.

Any third party we share information with is contractually required to protect your data and use it only for the purpose we've engaged them for.

8. International Transfers

Some of our service providers (such as Google Firebase) may process or store data outside of South Africa. Where this occurs, we take reasonable steps to ensure your information receives a comparable level of protection to that required under POPIA, including relying on providers with recognised international security and privacy certifications.

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, including:

• Order and transaction records — retained for a minimum of 5 years to comply with South African tax and financial recordkeeping requirements;
• Account information — retained for as long as your account remains active, or until you request deletion;
• Newsletter subscriber data — retained until you unsubscribe;
• Contact form messages — retained for as long as reasonably necessary to resolve your enquiry and for our records.

10. How We Protect Your Data

We implement appropriate technical and organisational security measures to protect your personal information against loss, misuse, unauthorised access, and disclosure, including encrypted data transmission (HTTPS/TLS), access-controlled databases, and restricting access to personal information to those who need it to perform their role. However, no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Under POPIA, you have the right to:

• Be informed that we hold personal information about you;
• Access the personal information we hold about you;
• Request correction of inaccurate or outdated information;
• Request deletion of your personal information, subject to our legal obligation to retain certain records (e.g. transaction records for tax purposes);
• Object to the processing of your personal information for direct marketing purposes at any time;
• Withdraw consent to marketing communications at any time;
• Lodge a complaint with the Information Regulator (see Section 16) if you believe your rights have been infringed.

To exercise any of these rights, please contact us — we will respond within a reasonable time and in accordance with applicable law.

12. Children's Privacy

Our website and products are not directed at, or intended for use by, children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without appropriate parental or guardian consent, we will take steps to delete it.

13. Accounts & Guest Checkout

You may check out as a guest without creating an account. Guest order information is retained for order fulfilment and our legal recordkeeping obligations, but is not linked to a persistent customer profile in the same way an account is. If you create an account, your order history and saved preferences are retained until you request deletion of your account.

14. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Regulator and affected individuals without undue delay, in accordance with our obligations under POPIA.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this page indicates when this policy was last revised. We encourage you to review this page periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.

16. Complaints & the Information Regulator

If you have a concern about how we handle your personal information that we have not been able to resolve directly, you have the right to lodge a complaint with South Africa's Information Regulator:

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za

17. Contact Us

If you have any questions about this Privacy Policy, or would like to exercise any of your rights described above, please get in touch or email us at prettyaspie1@gmail.com.