Legal Framework
Your privacy is not a commodity. Candy Venom operates under the Protection of Personal Information Act (POPIA), South Africa's comprehensive data protection legislation, and we treat compliance as the floor, not the ceiling. This policy outlines what we collect, how we use it, who has access to it, and the rights you hold over your own information. Read it carefully. It was written with the same precision we bring to everything else.
Last Updated: March 2025
When you place an order, create an account, or subscribe to our newsletter, we collect your full name, email address, shipping address (including postal code), and phone number. This information is necessary to fulfil your order, communicate delivery updates, and provide the level of service that Candy Venom customers expect. We do not collect personal information that is not directly relevant to these purposes. We do not ask for your date of birth, your ID number, or your mother's maiden name. We are a fashion house, not a bureaucracy.
We do not store your payment details. Not ever. Not partially. Not encrypted on a server we promise to guard. When you make a purchase, your card data and banking information are processed exclusively by Paystack, our PCI-DSS Level 1 compliant payment partner. Paystack handles the transaction end-to-end, and we receive only a confirmation of payment — no card numbers, no CVV codes, no bank account details. This is not just best practice; it is the only practice we consider acceptable. If a breach occurs, it will not happen on our infrastructure, because there is nothing on our infrastructure to breach.
Like virtually every website on the internet, we collect non-personal information about how you interact with our site. This includes pages visited, time spent on each page, referral source, browser type, device type, and general geographic location (country/city level, never street-level). This data is collected via Google Analytics with IP anonymization enabled and is used exclusively to understand how our site is being used so we can improve it. We do not track you across other websites. We do not build a shadow profile of your interests. Your browsing behavior on candyvenom.co.za stays on candyvenom.co.za.
To process, fulfil, and deliver your orders. Your name and address go to our courier partners (RAM and CourierGuy for domestic; DHL or national postal services for international) for the sole purpose of shipping your package. We share only what is necessary for delivery — no order contents, no payment details, no supplementary data. The courier knows where to deliver, not what they are delivering.
To send you our newsletter — collection announcements, editorial features, and occasional behind-the-scenes transmissions from the atelier. This is opt-in only. You will never receive promotional emails from us unless you explicitly consented, and you can withdraw that consent at any time by clicking the unsubscribe link at the bottom of every email. We send a maximum of two newsletters per month. We do not flood inboxes. We do not sell or rent our email list to third parties under any circumstances. Not for money, not for exposure, not for “strategic partnerships.”
To improve the experience on candyvenom.co.za. Browsing data helps us understand which pages resonate, which garments attract the most attention, and where users encounter friction. This data is aggregated and anonymized — it tells us that 2,000 people in Johannesburg looked at a particular jacket, not that you specifically spent eleven minutes on the product page before leaving. We use this information to make design and content decisions. We do not use it to manipulate pricing, create urgency, or exploit behavioral patterns.
We share your personal information with exactly two categories of third parties, and we are transparent about both:
Paystack processes all transactions on candyvenom.co.za. When you pay, your financial data flows directly to Paystack's PCI-DSS Level 1 compliant systems — the highest security certification in the payments industry. We never see, touch, or store your card details. Paystack's privacy policy governs the handling of your payment data, and it is available on their website. We chose Paystack precisely because their security standards are the most rigorous on the African continent. Your money deserves nothing less.
We use Google Analytics with IP anonymization enabled to understand how visitors interact with our site. Google Analytics collects data about your browsing session — pages viewed, session duration, device type, and approximate geographic location. We have configured Analytics to anonymize IP addresses before any data is processed, which means Google cannot identify you personally through our analytics data. We do not link Analytics data to any personally identifiable information. We do not use Google's advertising or remarketing features. We use Analytics for one purpose: to make this website better.
This deserves its own section because the industry practice is so common that it requires explicit refutation. Candy Venom does not sell, rent, lease, trade, barter, or otherwise transfer your personal information to any third party for their promotional or commercial purposes. Not now. Not ever. Not if the price is right, because there is no right price for something that was never ours to sell. Your data is yours. We are custodians, not merchants of your identity.
The Protection of Personal Information Act (POPIA) grants every South African — and any person whose data is processed within South Africa — specific, enforceable rights over their personal information. Candy Venom respects these rights not because the law compels us, but because they align with our principles. You are entitled to the following:
You have the right to request a complete copy of the personal information we hold about you. We will provide it within 30 days of your written request, in a readable format, free of charge. You should not have to wonder what a company knows about you — you should be able to see it, clearly and completely.
If any personal information we hold is inaccurate, incomplete, or outdated, you have the right to request that it be corrected. Email us with the specific correction and supporting information, and we will update our records within 14 business days. It is in our interest that your data is correct — incorrect addresses mean undelivered packages, and undelivered packages mean unhappy customers. We are motivated by both ethics and self-interest here.
You have the right to request the deletion of your personal information, subject to certain legal retention requirements. When you request deletion, we will erase your data from all active systems within 30 days. Transactional records required by South African tax and consumer protection law may be retained for the mandatory period (typically five years), but these records will be anonymized wherever possible and inaccessible for any purpose other than legal compliance.
You have the right to object to the processing of your personal information on reasonable grounds relating to your particular situation. If you object, we will cease processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms — or if the processing is necessary for the establishment, exercise, or defence of legal claims. We do not anticipate this scenario, but the right exists and we honour it.
Our site uses two categories of cookies, and we are specific about both:
These are necessary for the site to function at all. They maintain your shopping cart between pages, remember your session state, and ensure the checkout process works correctly. Without essential cookies, you could not complete a purchase. These cookies do not track you, profile you, or follow you beyond the boundaries of candyvenom.co.za. They are the digital equivalent of a sales assistant remembering what you picked up — functional, transient, and entirely in your service.
These are set by Google Analytics and help us understand how visitors use the site — which pages are most visited, where users drop off, what devices they use. Analytics cookies are non-essential and are only activated with your explicit consent, which is collected via our cookie consent banner when you first visit the site. You can withdraw this consent at any time by clearing your cookies or adjusting your browser settings. We use the data from analytics cookies exclusively to improve the site experience, never to target advertising or build behavioral profiles.
Our cookie consent banner appears on your first visit and allows you to accept or decline non-essential cookies. Your preference is remembered for 12 months, after which you will be asked again. We believe consent should be informed, specific, and revocable — not buried in a 4,000-word terms-of-service document that nobody reads.
For any questions, requests, or complaints regarding this privacy policy or the handling of your personal information, contact our Information Officer:
Email: privacy@candyvenom.co.za
Response: Within 30 business days (POPIA requirement)
If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa, the statutory body established under POPIA to oversee and enforce compliance with data protection law. The Regulator can be reached at inforegulator.org.za. We take this seriously, and we expect you to hold us accountable if we fall short.