1. INFORMATION WE COLLECT
 

We may collect and process the following personal information:
 

• Name and surname

• Email address

• Contact number

• Delivery and billing address

• Order and payment information

• Any information you voluntarily provide through contact forms, custom order requests, or email correspondence
   

2. HOW WE USE YOUR INFORMATION
 

Your personal information is collected and used only for the following purposes:
 

• To process and fulfil orders

• To communicate with you regarding enquiries, orders, or custom requests

• To arrange delivery of your products

• To comply with legal and regulatory obligations

• To improve our products, services, and website experience

We do not sell, rent, or trade your personal information to any third party.
 

3. lAWFUL BASIS FOR PROCESSING 
 

We process your personal information only where:
 

• It is necessary to perform a contract with you (e.g. processing your order)

• It is required by law or a legal obligation

• You have given your consent

• It serves a legitimate business interest, provided that interest does not override your rights and freedoms
   

4. SHARING OF INFORMATION
 

We may share your personal information with trusted third parties only where strictly necessary to fulfil your order or operate our business, including:
 

• Courier and delivery services (for order fulfilment)

• YOCO — as an online payment processing provider, where you choose to pay by card. YOCO processes your payment securely on your behalf. We do not store your card details at any point. If you opt to use YOCO as your payment method, we encourage you to visit www.yoco.com to review their privacy policy and understand how your payment data is handled.

• Website hosting and technical service providers

Payments are accepted via cash, EFT, or YOCO online payment. All third parties with whom we share information are required to safeguard your data and may only use it for the agreed purpose.
 

5. cROSS-BORDER TRANSFERS
 

Karoya operates within South Africa only and does not ship internationally. Your personal information is not transferred to any recipient outside the Republic of South Africa.
 

6. DATA SECURITY
 

We take reasonable technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration, or disclosure. While no system can be guaranteed completely secure, we are committed to handling your data with care and integrity.
 

7. RETENTION OF INFORMATION
 

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Once no longer needed, your information will be securely deleted or anonymised.
 

8. COOKIES

Our website may use cookies to improve functionality and your browsing experience. Cookies are small text files stored on your device. We may use:
 

• Essential cookies — required for the website to function correctly

• Analytics cookies — to help us understand how visitors use our site (e.g. pages visited, time spent)
   

You may disable or manage cookies through your browser settings at any time. Please note that disabling certain cookies may affect website functionality.
 

9. YOUR RIGHTS
 

In terms of POPIA, you have the right to:

• Access — request a copy of the personal information we hold about you

• Correction — request that incorrect or outdated information be corrected

• Deletion — request that your personal information be deleted, subject to legal obligations

• Objection — object to the processing of your personal information

• Withdrawal of consent — withdraw any consent previously given

To exercise any of these rights, please contact our Information Officer using the details at the top of this policy. We will respond within a reasonable time and in accordance with POPIA.
 

10. COMPLAINTS
 

If you believe your personal information has been processed in a manner that violates POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:
 

Website: www.inforegulator.org.za Email: inforeg@justice.gov.za Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
 

11. CHANGES TO THIS POLICY
 

Karoya reserves the right to update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be published on this page with a revised date. We encourage you to review this policy periodically.
 

12. CONTACT INFORMATION
 

For any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal information, please contact:
 

Information Officer: Lelani Smit Email: Karoyasoaps@gmail.com Location: Somerset East, South Africa
 

This Privacy Policy is governed by the laws of the Republic of South Africa.