Privacy policy

Last updated: 27 December 2025

1. Who we are

Scoops of Whimsy operates this online store and provides related products and services to deliver a curated, joyful shopping experience (the “Services”).
We are a South African small business based in Pretoria, Gauteng, South Africa, and we process personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Personal information we collect

When we refer to “personal information”, we mean data that can reasonably identify or be linked to you. We may collect the following depending on how you interact with our store:

Contact details: name, delivery address, billing address, phone number, email address
Order and transaction data: items viewed, added to cart, purchased, returned, exchanged, or cancelled
Payment data: encrypted and tokenized payment confirmations processed through secure third-party Payment Service Providers (we do not store card or banking details directly)
Account data: username, password, preferences and settings if you create an account
Customer support communications: messages, enquiries, reviews, or feedback you send us
Device and usage data: IP address, browser details, pages visited, time spent on site, cookies and similar analytics technologies

3. How we collect your information

We collect personal information from:

You directly, when you browse our store, create an account, place an order, contact support, or leave reviews
Automatically through Shopify, cookies, and analytics tools that help us improve our store experience
Service providers we work with, such as payment processors, delivery partners, and hosting or analytics platforms
Marketing partners, only where you interact with or consent to advertising tools such as social media pixels

4. How we use your personal information

We use your information to:

Process and fulfil your orders
Arrange delivery via shipping partners
Send updates about your order or account
Provide customer support and respond to enquiries
Improve and personalise your store experience
Send marketing communications (only if you opt-in or do not opt-out via provided unsubscribe options)
Prevent fraud, secure our store, and comply with legal obligations

We will never sell your personal information.

5. Payment processing transparency

All payments are securely processed, encrypted, and tokenized by PCI-DSS compliant South African Payment Service Providers such as:

PayFast
or other licensed PSPs integrated into our store

We only receive payment confirmations and transaction references, not full banking or card numbers.

6. How we share or disclose your information

We may share personal information with trusted third parties only where necessary to provide our services, including:

Shopify, which hosts and powers our store
Payment Service Providers, for secure payment processing
Delivery partners, such as The Courier Guy or Pudo, to fulfil your order
IT and analytics providers, to improve and secure our store
Authorities or legal processes, if required by law

7. Marketing consent

We may use tools such as:

TikTok Pixel
Meta (Facebook/Instagram) Pixel
Shopify Analytics
Google Analytics

These help us understand shopping behaviour and improve advertising relevance.
These tools may collect limited behavioural or device data, but are not used to personally identify you outside Shopify unless you interact with advertising or provide consent.
Marketing emails are opt-in, and you can unsubscribe anytime.

8. Cookies

Our store uses cookies to improve your experience.
You can disable cookies in your browser settings, but some store features may be limited.

9. Data retention

We retain information only as long as reasonably needed:

Data Type	Retention Period
Order and transaction records	Up to 5 years (SARS audit best practice)
Account information	Until you request deletion
Marketing email data	Until you unsubscribe or opt-out
Customer support communications	Up to 5 years if linked to orders, otherwise 12 months

10. Your POPIA rights

Under POPIA, you may request:

Access to your personal data
Correction of inaccurate data
Deletion of your data
Restriction on processing (in some cases)
Objection to direct marketing

To exercise these rights, email us at the contact details below.

We will not discriminate against you for exercising your rights.
We may verify your identity before processing requests.

11. Children’s data

Our store is not intended for children.
We do not knowingly collect data from minors except where a parent or guardian provides it for purchases.
If a minor’s personal information has been submitted, a parent or guardian may request deletion.

12. International data transfers

Some data may be processed or stored outside South Africa via Shopify or our cloud partners (such as analytics or payment infrastructure).
Where this occurs, we ensure data is handled by reputable, encrypted, and POPIA-aligned service providers.