This Privacy Policy applies to personal information processed by BONTRAK (PTY) LTD trading as ShopyTide in connection with:

• The ShopyTide website.
• Customer accounts.
• Seller accounts.
• Orders and transactions.
• Customer support.
• Marketing communications.
• Product and marketplace activities.
• Dropshipping and fulfilment activities.
• Website analytics and security.
• Other ShopyTide services.

This Policy should be read together with ShopyTide's Terms and Conditions, Return Policy, Support Policy and Seller Policy.

For purposes of POPIA, BONTRAK (PTY) LTD trading as ShopyTide may act as a responsible party in respect of personal information for which it determines the purposes and means of processing.

Depending on how you interact with ShopyTide, we may collect different categories of personal information.

We may collect personal information:

• Directly from you when you register.
• When you place an Order.
• When you communicate with support.
• When you become a Seller.
• When you submit a form.
• Through cookies and similar technologies.
• Through payment or delivery processes.
• From Sellers, suppliers or service providers where reasonably necessary.
• From fraud-prevention or security systems.

Where POPIA requires notification concerning the collection of personal information, ShopyTide will take reasonable steps to provide the required information.

We may process personal information for purposes including:

• Creating and managing accounts.
• Processing and fulfilling Orders.
• Processing payments.
• Delivering Products.
• Processing returns and refunds.
• Providing customer support.
• Managing Seller accounts.
• Preventing fraud and abuse.
• Maintaining Platform security.
• Improving our website and services.
• Sending permitted communications.
• Complying with legal obligations.
• Resolving disputes.
• Protecting the rights and property of ShopyTide and other persons.

POPIA permits processing where one or more lawful grounds applies.

Depending on the circumstances, ShopyTide may process personal information because:

• You have provided consent.
• Processing is necessary to conclude or perform a contract.
• Processing is necessary to comply with a legal obligation.
• Processing protects a legitimate interest of the data subject.
• Processing is necessary for a legitimate interest of ShopyTide or an appropriate third party, where permitted by law.

ShopyTide aims to collect personal information that is adequate, relevant and not excessive in relation to the purposes for which it is processed.

You should not provide sensitive information through ordinary customer-support channels unless specifically requested and appropriate.

ShopyTide takes reasonably practicable steps to ensure that personal information is complete, accurate, not misleading and updated where necessary.

Users are also responsible for providing accurate information and updating their account details where appropriate.

To complete an Order, we may process information required for:

• Order confirmation.
• Payment processing.
• Fraud prevention.
• Delivery.
• Customer communication.
• Returns and refunds.

Where necessary, relevant delivery information may be provided to couriers, Sellers, suppliers or fulfilment partners.

ShopyTide may operate a marketplace involving independent Sellers.

Depending on the transaction, limited information may need to be shared with a Seller to fulfil an Order, process a return, provide customer support or meet legal obligations.

Sellers are required to process personal information only for appropriate purposes and in accordance with applicable law and their obligations under the ShopyTide Seller Policy.

Some ShopyTide Orders may be fulfilled by third-party dropshipping suppliers.

Where necessary to fulfil an Order, relevant customer information may be provided to the supplier, fulfilment provider or courier.

Some suppliers or service providers may operate outside South Africa.

Where personal information is transferred across borders, ShopyTide will take reasonable steps to ensure that the transfer complies with applicable legal requirements.

ShopyTide may use cookies and similar technologies to support website functionality and improve the user experience.

Cookies may be used for purposes including:

• Maintaining login sessions.
• Remembering preferences.
• Maintaining shopping-cart functionality.
• Improving website performance.
• Security and fraud prevention.
• Analytics.
• Marketing where lawfully permitted.

Some cookies may be placed by third-party service providers used by ShopyTide.

ShopyTide may use analytics technologies to understand how visitors interact with the Platform.

Information may include pages visited, device information, approximate geographic information, referral information and interaction patterns.

Analytics information may be used to improve website performance, navigation, security, marketing effectiveness and customer experience.

ShopyTide may send transactional communications necessary for operating the service, such as:

• Order confirmations.
• Delivery notifications.
• Account notifications.
• Security notifications.
• Support communications.

Marketing communications will be handled in accordance with applicable direct-marketing requirements.

Where appropriate, users may opt out of marketing communications using the unsubscribe mechanism provided.

ShopyTide may disclose personal information where reasonably necessary and legally permitted to:

• Sellers.
• Dropshipping suppliers.
• Couriers.
• Payment service providers.
• Technology providers.
• Hosting providers.
• Fraud-prevention providers.
• Customer-support providers.
• Professional advisers.
• Regulators or law-enforcement authorities where legally required.

ShopyTide does not sell personal information merely because it is collected through the Platform.

ShopyTide may use third-party operators to process personal information on our behalf.

Examples include:

• Website hosting providers.
• Payment providers.
• Email providers.
• Cloud service providers.
• Analytics providers.
• Customer-support platforms.
• Security and fraud-prevention providers.

Where required, appropriate contractual and organisational measures will be used to require operators to process information appropriately and confidentially.

Because ShopyTide may use international technology providers, payment services, cloud infrastructure, suppliers or dropshipping partners, personal information may in some circumstances be transferred outside South Africa.

ShopyTide will take reasonable steps to ensure that applicable POPIA requirements governing cross-border transfers are considered before personal information is transferred.

Additional safeguards may be used where required by applicable law.

ShopyTide takes reasonable technical and organisational measures designed to protect personal information against:

• Loss.
• Unauthorised access.
• Unauthorised disclosure.
• Unlawful processing.
• Accidental destruction.
• Accidental damage.
• Unauthorised alteration.

Security measures may include access controls, authentication, encryption where appropriate, monitoring, backups and other technical and organisational safeguards.

No internet-based system can be guaranteed to be completely secure.

If ShopyTide becomes aware of a security compromise involving personal information, we will assess the incident and take appropriate steps required by applicable law.

Depending on the circumstances, this may include:

• Containing the incident.
• Investigating the affected systems.
• Taking remedial security measures.
• Notifying the Information Regulator where required.
• Notifying affected data subjects where required.
• Cooperating with relevant authorities or service providers.

ShopyTide does not intend to retain personal information indefinitely.

Information may be retained for as long as reasonably necessary for the purpose for which it was collected or for other lawful purposes, including:

• Completing transactions.
• Customer support.
• Accounting and financial records.
• Fraud prevention.
• Legal compliance.
• Dispute resolution.
• Enforcement of agreements.
• Security and audit purposes.

When personal information is no longer lawfully required, appropriate deletion, destruction or de-identification processes may be applied.

Subject to applicable law and any lawful limitations, data subjects may have rights including:

To request access to or correction of your personal information, contact the Information Officer.

Certain requests may be subject to lawful refusal grounds, verification requirements or prescribed procedures.

Where POPIA gives you the right to object to processing, you may submit an objection to the Information Officer.

Where processing is based on consent, you may withdraw that consent.

Withdrawal of consent does not automatically make prior processing unlawful and may not prevent ShopyTide from continuing processing where another lawful basis applies.

ShopyTide may use automated systems for purposes such as:

• Fraud detection.
• Security monitoring.
• Product recommendations.
• Personalised content.
• Marketing analysis.

Where automated decision-making has legal or similarly significant consequences for a data subject, ShopyTide will consider and comply with applicable POPIA requirements.

POPIA provides specific protections concerning personal information of children.

ShopyTide does not knowingly seek to collect children's personal information except where permitted by applicable law and with the appropriate authority or consent where required.

If you believe that a child has provided personal information to ShopyTide unlawfully, please contact the Information Officer.

ShopyTide does not ordinarily require special personal information to provide ordinary shopping services.

Where special personal information is processed, ShopyTide will do so only where permitted by applicable law and where an appropriate lawful basis or exception applies.

Customers should not voluntarily provide unnecessary special personal information through ordinary support channels.

ShopyTide may maintain social-media accounts or integrate third-party services into the Platform.

Interactions with third-party social-media platforms may be governed by those platforms' own privacy policies.

ShopyTide is not responsible for independent privacy practices of third-party platforms.

Customers and Sellers should take reasonable precautions to protect their accounts and personal information.

• Use a strong password.
• Do not share your password.
• Do not use the same password across multiple services.
• Log out from shared devices.
• Keep devices and software reasonably secure.
• Report suspected account compromise promptly.

ShopyTide support will not normally request your password, banking PIN, CVV or full payment-card credentials.

We encourage you to contact ShopyTide first so that we can investigate and attempt to resolve your privacy concern.

ShopyTide may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices or applicable law.

The latest version published on the ShopyTide website will contain the applicable effective date.

Where a change materially affects data subjects and applicable law requires additional notification, ShopyTide will take reasonable steps to provide the required notice.