PRIVACY POLICY

1. WHO WE ARE

The Website is owned and operated by:

Memory Box Co (the Responsible Party)

Email (Information Officer): admin@memoryboxco.co.za

Country of Operation and Data Storage: Johannesburg, South Africa

2. PERSONAL INFORMATION WE COLLECT

We collect and process the following categories of personal information:

2.1 Information You Provide Directly

• Full name
• Email address
• Phone number
• Delivery address
• Photographs and content uploaded for creation of photobooks or products
• Account registration details (username, password)
• Payment information (including credit card details) via our secure payment processor Paystack
• Communication history with us

2.2 Automatically collected personal information

• IP addresses, device information, and browser data
• Pages viewed, time spent on site, and usage analytics
• Cookies and tracking technologies (see "Cookies" section if needed)

3. PURPOSES FOR COLLECTING YOUR PERSONAL INFORMATION

We collect only the information necessary for these purposes and process it on lawful grounds provided by POPIA.

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to you. We may process your information to provide you with the requested service.
• To facilitate payment. Payment processing via secure third‑party payment providers.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To fulfil and manage your orders. We may process your information to fulfil and manage your orders, payments, returns, and exchanges made through the Services.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see "YOUR RIGHTS UNDER POPIA" below).
• To deliver targeted advertising to you. We may process your information to develop and display personalized content and advertising tailored to your interests, location, and more. For more information see our Cookie Notice.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.
• Legal, regulatory, and compliance requirements. We may process your information when necessary to comply with our legal and regulatory obligations.

4. WHAT LEGAL BASIS DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

POPIA requires us to explain the valid legal basis we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interest of the responsible party or of a third party to whom the information is supplied. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests, and those interests do not outweigh your interests and fundamental rights and freedoms.
• Legitimate interest of the data subject. We may process your information when we believe it is for your interests and/or benefit.
• An obligation imposed by law on the responsible party. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Performance of a public law duty by a public body. We may process your information where we have a public lay duty to do so.

5. THIRD‑PARTY LINKS

• Our Website may contain links to third‑party websites.
• We are not responsible for the privacy practices or content of these external sites.
• We encourage you to review their privacy policies before providing them with personal information.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We may use cookies and other tracking technologies to collect and store your information.

6.1 How We Use Cookies. We use cookies to:

• Ensure the Website functions properly (essential cookies)
• Analyse site usage and performance
• Remember your preferences (like login details or saved items)
• Improve our services and user experience

We may also use trusted third party analytics tools.

6.2 Types of Cookies We Use:

• Essential Cookies: Required for basic site operation.
• Analytics Cookies: Help us understand how visitors use the Website.
• Functional Cookies: Store your preferences to enhance usability.
• Marketing Cookies (if enabled): Deliver relevant content and measure effectiveness.

6.3 Third Party Cookies

• Some cookies may be set by external service providers such as analytics or payment partners. These are governed by their own privacy policies.

7. PAYMENT INFORMATION SECURITY

• We allow users to enter debit/credit card details for purchases. These details are:
  • Processed through PCI‑DSS compliant third‑party payment gateways
  • Not stored on our servers
  • Transmitted securely using encryption technology

8. STORAGE OF PERSONAL INFORMATION

• All personal information is stored securely within South Africa.
• We take appropriate, reasonable, technical, and organisational measures to protect the integrity and confidentiality of your personal information.

9. DISCLOSURE OF PERSONAL INFORMATION

• We only share your information with third parties where necessary:
  • Courier and delivery partners (to fulfil your order)
  • Payment processors (to process card payments)
  • Service providers assisting with website hosting or analytics
  • Legal or regulatory authorities, where required by law
  • With your explicit consent, if applicable
  • Data Analytics Services
  • Data Storage Service Providers
  • Finance & Accounting Tools
  • Data Analytics Services
  • Data Storage Service Providers
  • Finance & Accounting Tools
• We do not sell or rent personal information to third parties.

10. USER REGISTRATION

• When you register on our Website:
  • You provide personal details necessary to maintain an account
  • You agree to safeguard your login credentials
  • You remain responsible for activity conducted through your account

11. YOUR RIGHTS UNDER POPIA

• You may exercise the following rights:
  • Right of Access - request a copy of the personal information we hold
  • Right to Correction - update or correct your information
  • Right to Deletion - request erasure where legally appropriate
  • Right to Object to processing
  • Right to Withdraw Consent (where applicable)
  • Right to Lodge a Complaint with the Information Regulator
• To exercise these rights, please contact our Information Officer at: admin@memoryboxco.co.za

12. RETENTION OF PERSONAL INFORMATION

We keep your information for as long as necessary to fulfil the purposes outlined in this privacy notice unless otherwise required by law.

• We retain personal information only as long as necessary for:
  • Fulfilling orders
  • Legal or regulatory compliance
  • Resolving disputes
  • Maintaining financial and audit records
• Uploaded photographs may be deleted at your request or will automatically expire according to our data retention schedule.

13. CHILDREN'S PRIVACY

• Our services are intended for users 18 years or older.
• We do not knowingly collect personal information from children without consent from a parent or legal guardian.
• By using the Services, you represent that you are at least 18 or older or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services.

14. SECURITY MEASURES

• We implement industry‑standard security practices, including:
  • Encryption
  • Access controls
  • Secure servers
  • Regular security assessments
• However, transmission over the internet can never be guaranteed as 100% secure.

15. CHANGES TO THIS POLICY

We may amend this Privacy Policy from time to time. Updated versions will be posted on this page with a revised "Last updated" date. Continued use of the Website indicates acceptance of any revised terms.

16. CONTACT DETAILS

For questions, concerns, or POPIA‑related requests, contact:

Information Officer: admin@memoryboxco.co.za