POPIA Compliance
POPIA Compliance
Smael South Africa is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This page explains what personal information we collect, why we collect it, how we use and protect it, and what your rights are as a data subject.
1. Who We Are (Responsible Party)
Under POPIA, the entity responsible for processing your personal information is referred to as the Responsible Party. For all transactions and interactions on smael.co.za, the Responsible Party is:
Trading name: Smael South Africa
Website: smael.co.za
Location: Kempton Park, Gauteng, South Africa
Information Officer: Tersius le Roux
Email: support@smael.co.za
WhatsApp: 074 001 6851
2. What Personal Information We Collect
We only collect personal information that is necessary, relevant, and adequate for the purpose of processing your order, delivering your purchase, and communicating with you about your transaction. We do not collect sensitive categories of personal information (such as health data, race, religion, or biometric data).
The personal information we collect includes:
3. Why We Collect Your Personal Information (Purpose)
POPIA requires that personal information is only collected for a specific, explicitly defined, and lawful purpose. We collect and process your personal information for the following purposes only:
- Order fulfilment — to process your purchase, arrange delivery, and confirm your order.
- Delivery and logistics — to share your delivery address with our courier partner in order to deliver your order.
- Customer support — to respond to your questions, handle warranty claims, or process returns.
- Transactional communication — to send you order confirmations, tracking information, and delivery updates.
- Legal compliance — to comply with applicable South African laws including the Consumer Protection Act and tax obligations.
- Marketing (with consent only) — to send you promotional emails or messages about new products or offers, only if you have opted in. You can unsubscribe at any time.
- Fraud prevention — to protect our store and customers against fraudulent orders or chargebacks.
4. Who We Share Your Information With
We only share your personal information with third parties where it is strictly necessary to fulfil your order or comply with the law. All third parties we work with are required to handle your information securely and in accordance with POPIA.
- Shopify Inc. — our e-commerce platform, which stores order data and customer records on secure servers. Shopify is GDPR and POPIA compliant.
- Payment processors — PayFast and/or Shopify Payments process your payment securely. We do not receive or store your card details.
- Courier partners — your name and delivery address are shared with our courier to deliver your order.
- Email marketing platform — if you have opted in to marketing, your email address may be stored in our email platform (e.g. Klaviyo or Shopify Email).
- South African authorities — where required by law, court order, or to prevent fraud.
5. How Long We Keep Your Information
We retain your personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by South African law. Specifically:
- Order records — retained for 5 years in line with South African tax and accounting requirements.
- Customer accounts — retained for as long as your account is active, and for a reasonable period thereafter in case of disputes or returns.
- Marketing opt-in records — retained until you unsubscribe or request removal.
- Support communications — retained for up to 2 years after your last interaction.
- Warranty claims — retained for the duration of the warranty period plus 6 months.
Once retention periods expire, your personal information is securely deleted or anonymised.
6. How We Protect Your Information
We take reasonable and appropriate technical and organisational measures to protect your personal information against loss, theft, unauthorised access, disclosure, alteration, or destruction. These measures include:
- SSL encryption — all data transmitted through smael.co.za is encrypted via HTTPS/SSL.
- Secure payment processing — payments are handled by PCI-DSS compliant processors (PayFast / Shopify Payments). We never see or store your card number.
- Shopify platform security — our store runs on Shopify, which maintains enterprise-level security, regular audits, and ISO-certified data centres.
- Access controls — access to customer data within our store is restricted to authorised personnel only.
- No unnecessary data collection — we collect only what is needed and do not retain data beyond its useful purpose.
7. Your Rights as a Data Subject
Under POPIA, you have the following rights regarding your personal information. You may exercise any of these rights by contacting us using the details at the bottom of this page:
8. Cookies and Website Tracking
Our website uses cookies and similar tracking technologies to improve your browsing experience and to understand how visitors use our site. POPIA does not require a cookie consent banner or pop-up — this is a requirement under European law (GDPR/ePrivacy Directive) and does not apply in South Africa.
The cookies used on smael.co.za are primarily functional (necessary for the store to work correctly) and analytical (to help us understand site usage via Shopify analytics). We do not use third-party advertising cookies to track you across other websites.
- Essential cookies — required for the shopping cart, checkout process, and user session management. Without these, the store cannot function.
- Analytics cookies — Shopify's built-in analytics tracks page views, traffic sources, and visitor behaviour to help us improve the site. This data is aggregated and not linked to your identity.
- Preference cookies — may store your currency or language preferences for a better experience.
You can manage or disable cookies through your browser settings at any time, though this may affect the functionality of the store.
9. Direct Marketing
We only send marketing communications — including promotional emails, SMS messages, or WhatsApp messages — to customers who have explicitly opted in to receive them. This is a firm requirement under POPIA's 2025 regulation amendments, which tightened the rules around electronic direct marketing in South Africa.
Every marketing message we send will include a clear and easy way to opt out or unsubscribe. Once you unsubscribe, we will stop sending marketing communications promptly and update our records accordingly. We maintain a record of all marketing consents as required by POPIA.
10. The Information Regulator
The Information Regulator of South Africa is the independent authority responsible for enforcing POPIA. If you have a concern about how we have handled your personal information and you are not satisfied with our response, you have the right to lodge a complaint directly with the Regulator.
Information Regulator (South Africa)
📧 Email: inforeg@justice.gov.za
🌐 Website: www.inforegulator.org.za
📍 JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
11. Contact Us
If you have any questions about this POPIA Compliance notice, wish to exercise your data subject rights, or have a concern about how your personal information is being handled, please contact us using the details below. We aim to respond to all enquiries within 2 business days and to all formal data subject requests within 30 days.
Smael South Africa — Information Officer
📧 Email: support@smael.co.za
💬 WhatsApp: 074 001 6851
📍 Kempton Park, Gauteng, South Africa
🕐 Monday – Friday, business hours
This POPIA Compliance notice was last updated in April 2026. We reserve the right to update this notice at any time to reflect changes in our practices or applicable law. Any material changes will be communicated via our website. Your continued use of smael.co.za following any update constitutes acceptance of the revised notice.