Who is responsible for your information
Express Photo and Gifts, 135 Scott Street, Scottburgh, KwaZulu-Natal, 4180, is the responsible party for the personal information described here.
Our Information Officer is [Information Officer’s name: to be supplied by the shop]. You can reach them at info@expressphotoandgifts.com or on 076 491 2300 about anything in this policy.
What we collect
What you give us
- Your contact details: first name, surname, email address and mobile number, for every order.
- Delivery details, when you choose courier delivery: the street address, suburb, town, province, postal code and any delivery notes.
- A gift recipient’s name and mobile number, when you send an order straight to someone else. Please only give us these if the person would expect it; we use them only to deliver to them.
- Your photos, and any words or notes you add to be printed or to tell us about an item. Photos can show people, including children, and places. We look at them only to print them and check the print.
- Account details, if you make an account: your email, a password (held by Firebase, never readable by us) and the contact and delivery details you saved.
- What you tell us when you email, phone, WhatsApp or visit the shop.
What we keep about your order
- What you ordered and paid, any deals that applied, delivery and tracking events, refunds, and the emails we sent you. We get PayFast’s confirmation of the payment (its reference, amount and status), never your card details.
- For deals limited to once per customer, a one-way scrambled code made from your email (a hash), so we can tell the deal was used without keeping a list of emails.
- Which version of our terms you agreed to when you paid, and when.
What your visit tells us
- Visit statistics from Vercel Web Analytics, which uses no cookies: pages viewed, where visitors came from, device type and country, as totals. We strip order numbers and links from page addresses before they’re counted, and pages inside your account aren’t counted at all.
- Our own counters of how many visits looked at a product, added to the cart and reached each step of checkout, and the words of searches that found nothing. These are daily totals with nothing that identifies you.
- Your IP address, which our server sees with every request and uses briefly to stop abuse (limits on uploads and payments). We don’t store it with your order.
We don’t ask for your ID number, and we don’t knowingly collect special personal information (such as health or religious beliefs). If a photo you send happens to show something like that, we use it only to print it.
Why we use it
POPIA allows us to use personal information for a lawful reason. Ours are:
- To carry out your order: to price it, take payment, print it, tell you when it’s ready, deliver it, give you its tracking, and handle any return, refund or complaint.
- Because the law requires it: keeping sales and payment records for tax, and reporting crime where we must.
- Our legitimate interests: keeping the site and payments secure, preventing fraud and abuse, and understanding which products and pages work, from totals rather than from individuals.
- Your consent: for an account, and for marketing email. You can withdraw consent at any time; that doesn’t affect what was done before.
We don’t make decisions about you by automated means alone, we don’t build profiles of you for advertising, and we never sell or rent your personal information.
Marketing email
We send marketing email only to people who have agreed to it, for example by signing up at the foot of our pages, and we record when and where you agreed. Order, delivery and account emails aren’t marketing; we send those because you placed an order or made an account.
You can stop marketing email at any time, free of charge, by replying “unsubscribe”, emailing info@expressphotoandgifts.com or telling us at the shop. We’ll keep a note that you opted out, so we don’t email you again by mistake.
How long we keep it
- Photos from a checkout that was never paid are deleted automatically 14 days after the last upload. Your browser forgets that checkout after 10 days.
- Photos of a paid order are kept with the order so we can remake it if something goes wrong in delivery or under its guarantee. Once your order is complete, ask us and we’ll delete them.
- Order and payment records are kept for at least five years after the order, because tax law requires us to keep them.
- Your account and saved details are kept until you ask us to close the account.
- A record that you agreed to, or opted out of, marketing is kept for as long as we might email you, and to show we respected your choice.
- Daily visit totals contain nothing personal and may be kept indefinitely.
When we no longer need information, we delete it or remove anything that identifies you.
How we protect it
We take reasonable technical and organisational steps to keep your information safe, including:
- an encrypted (HTTPS) connection for every page;
- payments handled by PayFast, so card details never reach us;
- passwords held by Firebase in a form nobody at the shop can read;
- a database closed to browsers, reachable only through our own server;
- staff access through named accounts only, with changes to orders logged against the person who made them;
- photo uploads that each need a one-time signature from our server, and order links that can’t be guessed.
Keep your order link private
The “Track my order” link in your emails shows the order, its delivery address and progress to whoever holds it, so treat it like a password and don’t post it publicly. On a shared device, finish or empty your checkout and sign out when you’re done: until then the device remembers the details you typed (see below).
No system is completely secure. If we believe your personal information has been accessed by someone without authority, we’ll tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.
Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct information that’s wrong, out of date or incomplete;
- ask us to delete information we no longer have a lawful reason to keep;
- object to our use of your information, including for marketing at any time;
- withdraw a consent you gave;
- complain to the Information Regulator.
To use any of these, email info@expressphotoandgifts.com or come to the shop. We may ask you to prove who you are before we act, so we don’t hand your information to someone else, and we’ll respond within a reasonable time, normally 30 days. Asking for your information costs nothing. Some records, like orders we must keep for tax, can’t be deleted before their time, and we’ll tell you if that applies. Requests for records under the Promotion of Access to Information Act (PAIA) can be made the same way.
Complaints to the Information Regulator
Please talk to us first, so we can put it right. If you’re not satisfied, you may complain to the Information Regulator:
- Complaints
- POPIAComplaints@inforegulator.org.za
- General enquiries
- enquiries@inforegulator.org.za
- Phone
- 010 023 5200 · toll-free 0800 017 160
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Website
- inforegulator.org.za
Children
Our shop is for adults: you must be 18 or older, or have a parent’s or guardian’s consent, to order or make an account. Photos of children are welcome on our products when they come from a parent or guardian, or with their consent, as our Terms ask, and we use them only to make the order.
Changes to this policy
We’ll update this policy when what we collect or who we share it with changes, and change the date at the top. If a change materially affects how we use information you’ve already given us, we’ll tell you by email before it applies.