Privacy Policy

Effective Date: 07 July 2026

At Crystal Candy (“we”, “us”, “our”), we are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (crystalcandy.co.za), purchase our products, or interact with us.

This policy is designed to comply with the Protection of Personal Information Act (POPIA) of South Africa and other applicable data protection laws.

1. Information We Collect

We collect information that you provide directly to us when you use our website. This includes:

• Personal and Contact Details: Name, email address, physical billing and shipping addresses, and phone numbers.
• Account Information: Username, password, order history, and saved wishlist items if you choose to create an account with us.
• Order Details: Information relating to your purchases, including custom order requirements, cart contents, and preferences.
• Payment Information: We use Yoco as our secure payment gateway. We do not store your credit card numbers or sensitive payment details on our servers. All transactions are encrypted and processed directly by Yoco.
• Communication Data & Form Submissions: Information you provide when contacting us via our contact forms. These submissions are stored securely within our website’s database as well as in our business email accounts to ensure we can respond to your customer service inquiries efficiently.

Automatically Collected Information

When you visit our website, our server automatically collects standard access information about your device and interaction with our site, including your IP address, browser type, pages viewed, and the dates/times of your visits. We also utilize basic analytics tools to collect anonymous data, such as overall page views and visitor numbers, to monitor website performance. Additionally, if you use our on-site search function, we may log your search queries. This data is used strictly for internal website security, performance monitoring, and improving our shopping experience.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Order Processing and Fulfilment: To process transactions, generate electronic invoices and packing slips, prepare your orders (including custom configurations), and coordinate delivery.
• Customer Service & Account Management: To provide support, respond to your inquiries, maintain your saved wishlists, and manage your account (e.g., password resets).
• Shipping and Tracking: To generate waybills and provide you with accurate order tracking notifications via our automated shipment tracking system.
• Marketing and Communications: To send you promotional emails, newsletters, and abandoned cart reminders. We send these communications to existing customers and individuals who have explicitly opted in via our signup forms. We use trusted third-party marketing platforms to manage these communications. You can opt out of marketing communications at any time by clicking the “unsubscribe” link at the bottom of any promotional email.
• Website Improvement & Security: To understand how users navigate our store, prevent fraudulent activity, and ensure our website functions correctly and securely.

3. Sharing Your Information

We do not sell, trade, or rent your personal information to third parties. We only share your information with trusted third-party service providers who directly assist us in operating our business, including:

• Payment Processors: Such as Yoco, to securely facilitate and authorise your payments.
• Shipping and Courier Partners: We share your name, delivery address, and phone number with our logistics partners to deliver your orders.
• Marketing Platforms: Trusted third-party services which we use to securely manage our newsletter subscriber lists and send marketing emails.
• Website Security, Maintenance and Backup Providers: Trusted third-party tools used to securely back up our website database, monitor site security, block malicious traffic, and maintain server health.
• Legal Compliance: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

4. Cross-Border Data Transfers

Some of the third-party service providers we use (such as our marketing platforms and website backup services) may be located or process data outside of South Africa, including in the United States and the European Union. By providing your personal information to us, you consent to the transfer of your data to these regions. We ensure that our service providers are subject to binding agreements or international data protection laws (such as the GDPR) that provide an adequate level of protection for your personal information as required by POPIA.

5. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to function effectively and enhance your experience.

• Essential & Security Cookies: Strictly necessary cookies used by our e-commerce platform to keep track of cart data, store items in your basket, manage your logged-in session securely, and provide essential website security against malicious attacks.
• Functional Cookies: Used to remember your preferences (like applied store filters, sorting options, or items saved to your wishlist).

You can choose to disable cookies through your browser settings, but please note that core features of our store (like the shopping cart, wishlists, or account login) may not function properly without them.

6. Data Security & Breach Notification

We implement reasonable technical and organisational security measures, including active security monitoring software and firewalls, to protect your personal information against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. Your data is stored securely on our website servers. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Security Compromise: In the event of a data breach or security compromise that impacts your personal information, we will promptly notify you and the Information Regulator as required by POPIA.

7. Data Retention

We retain your order history and account information for as long as your account is active to provide you with a continuous shopping experience and historical purchase records. We will also retain personal information for as long as necessary to comply with our legal business obligations (e.g., retaining invoices for tax and accounting laws in South Africa), resolving disputes, and enforcing our agreements. You may request the deletion of your account and personal data at any time, subject to these legal retention requirements.

8. Your Data Protection Rights

Under POPIA and applicable data protection laws, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct or update any inaccurate or incomplete information.
• Deletion: Request that we delete your personal information (subject to certain legal exceptions, such as transaction records needed for tax purposes).
• Opt-Out: Unsubscribe from marketing communications at any time.
• Lodge a Complaint: You have the right to lodge a complaint regarding the processing of your personal information with the Information Regulator of South Africa.
  • Email: POPIAComplaints@inforegulator.org.za
  • Website: https://inforegulator.org.za/

To exercise any of your direct rights with us, please contact us using the details provided below.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. The updated policy will be posted on this page, and the “Effective Date” at the top will be updated accordingly.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us at:

Email: info@crystalcandy.co.za

Phone: +27742600566

Address: 41 Ysterberg Street, Noordheuwel, Krugersdorp, 1739