We plan celebrations with care, and that includes looking after your personal information. This policy explains, in plain language, what we collect, why, who helps us, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who we are
Events Palour is a South African business run as a sole proprietorship. We are the "responsible party" for your personal information.
- Seller / responsible party: Kabelo Chabalala trading as Events Palour (sole proprietor)
- Address: 820 Saliehout Street, Pretoria, 0182
- Email: hello@eventspalour.co.za
- Information Officer: The owner of Events Palour is our Information Officer. Contact: hello@eventspalour.co.za
2. What we collect
- Contact us form: your name, surname, phone number, email address, the nature of your query and your message. Your message is relayed to our email inbox by Web3Forms, a form service based outside South Africa (see sections 4 and 5).
- Orders: your name, email address, what you bought, the amount, and order and payment references. Our payment providers handle your card or account details; we do not see or store full card numbers.
- Emails you send us: your email address and whatever you choose to include.
- Marketing (only if you opt in): your name and email address. Every marketing email includes an unsubscribe link, and you can unsubscribe at any time, or email us to be removed.
- Planned RSVP service: when we launch digital invitations with RSVPs, we will collect guest names, attendance and party size for the event host, and dietary notes only if a guest ticks a separate consent box. We will update this policy before that service goes live.
You don't have to give us your information, but without it we can't answer your query or complete your order.
3. Why we use it (and our lawful basis)
POPIA (section 11) only allows processing on a lawful basis. We use your information:
| Purpose | Lawful basis |
|---|---|
| Replying to your query | Your consent (the tick box on our form), and steps you ask us to take before an order |
| Processing and delivering orders, refunds and support | To perform our contract with you |
| Keeping tax and accounting records | Legal obligation (tax law) |
| Keeping our website and email secure and free of spam | Our legitimate interest in running a safe service |
| Sending news and offers | Your consent, which you can withdraw at any time |
We will not sell your information or use it for unrelated purposes.
4. Who we share it with
We use trusted service providers ("operators") who process information for us under their own security and privacy terms:
| Provider | What they do | Where |
|---|---|---|
| Web3Forms | Relays our Contact us form to our email | India, on cloud servers (AWS); outside South Africa |
| Zoho Mail | Hosts our email | United States; outside South Africa |
| Cloudflare | Hosts our website, DNS and security | United States, global network; outside South Africa |
| Payhip | Runs our digital products store and checkout | United Kingdom; outside South Africa |
| PayPal | Processes payments (if you choose PayPal) | International; outside South Africa |
| PayFast | Processes payments in rand | South Africa |
We may also share information when the law requires it (for example with SARS) or to protect our legal rights.
5. Information sent outside South Africa
Several of our providers are based or store data outside South Africa. POPIA (section 72) allows this only in limited cases. We rely on:
- the transfer being needed to reply to you or to perform your order;
- your consent, which you give when you tick the box on our form; and
- providers that are bound by data protection laws or agreements giving protection similar to POPIA (for example the UK GDPR for Payhip, and published data protection terms for Web3Forms, Cloudflare and Zoho).
6. How we protect it
As POPIA (section 19) requires, we take reasonable technical and organisational steps to keep your information safe. These include encrypted connections (HTTPS) on our website, strong passwords and two-step login on our accounts, limiting access to the owner, and choosing reputable providers. No system is perfectly secure. If we believe your information has been accessed without authorisation, we will tell you and the Information Regulator as the law requires.
7. How long we keep it
We keep information only as long as we need it (POPIA section 14):
- Contact messages: 12 months after your query is resolved, then deleted. If your query leads to an order, the relevant details move to our order records.
- Order and payment records: 5 years from the date we submit the related tax return, as required by the Tax Administration Act, and longer only if SARS is auditing us or a dispute is open.
- Marketing list: until you unsubscribe or ask us to remove you.
- RSVP data (planned): deleted 30 days after the event.
Our providers may keep their own copies for a limited time under their own policies. For example, Web3Forms keeps form submissions for up to 3 years unless we delete them sooner, and we aim to delete them on the schedule above.
8. Your rights
Under POPIA you may:
- ask what information we hold about you and get a copy (section 23);
- ask us to correct or delete information that is wrong, out of date or no longer needed (section 24);
- object to us using your information on the basis of legitimate interest, and opt out of direct marketing at any time (section 11(3));
- withdraw your consent at any time. This does not affect anything we did before you withdrew it;
- complain to the Information Regulator.
To use your rights, email hello@eventspalour.co.za. We may need to confirm your identity first. We will respond within a reasonable time and won't charge you for simple requests.
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
General enquiries: enquiries@inforegulator.org.za · 010 023 5200 · toll free 0800 017 160
Complaints: POPIAComplaints@inforegulator.org.za · Website: https://inforegulator.org.za
We'd appreciate the chance to sort things out first, so please contact us.
9. Cookies
Our own website sets no advertising, analytics or tracking cookies. Cloudflare, our host, may set strictly necessary security cookies to protect the site from bots and attacks. When you visit our store on Payhip or pay through PayFast or PayPal, those sites use their own cookies under their own policies. You can block or delete cookies in your browser settings.
10. Children
Our website and products are meant for adults. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian. If you think a child has sent us information, please contact us and we will delete it.
11. Changes to this policy
We may update this policy as our business grows, for example when we launch RSVPs. We will post the new version here with a new "Last updated" date. If a change is significant, we will highlight it on our website.
12. Contact us
Questions or requests about your privacy: hello@eventspalour.co.za
Address: 820 Saliehout Street, Pretoria, 0182