Privacy Policy
Updated 3 November 2026
We like your personal information the way we like our tees: handled with care and not shared around. This policy explains what we collect, why, who helps us handle it, and what your rights are under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who we are (the responsible party)
The responsible party for your personal information is Sonica Lensley, trading as Soft Rebellion (Sole proprietor, registration number N/A (sole proprietorship, not registered with CIPC)), at 251 General Beyers Street, Pretoria North, Pretoria, 0182.
- General contact: [email protected] | 062 046 6346
- Privacy requests: [email protected]
- Information Officer: Sonica Lensley ([email protected])
2. What we collect, why, and our lawful basis
| What | Why | Lawful basis (POPIA s11) |
|---|---|---|
| Name, email, phone, delivery address, locker choice | To take, make, pay for, deliver and support your order | Needed to conclude and perform the contract with you |
| Order history, payment reference, proof of EFT payment | To confirm payment, issue invoices, handle returns and keep tax records | Contract; legal obligation (tax and consumer law) |
| Account details (email, hashed password), if you create an account | To let you view orders and check out faster | Contract / your consent |
| Messages you send us (email, WhatsApp, contact form) | To reply and keep a record of the conversation | Legitimate interest; contract |
| Marketing details (email, first name) and consent record | To send you news, drops and offers, only if you opt in | Your consent (POPIA s69) |
| Website usage data (pages viewed, device, approximate location, cart events) via Google Analytics | To understand and improve the site | Your consent (cookie banner) |
Advertising identifiers (Meta Pixel, Meta Conversions API: hashed email/phone, order value, browser IDs _fbp/_fbc) |
To measure and improve our ads and show relevant ads | Your consent (cookie banner and the marketing tickbox at checkout) |
| Technical and security data (IP address, browser, request logs, bot-check signals) | To keep the site secure and prevent fraud and abuse | Legitimate interest |
We collect information directly from you (and from your browser when you use the site). We do not collect it from other sources. We only collect what we need.
Supplying your information is voluntary, but if you do not give us your name, delivery details and contact details we cannot take or deliver your order. Marketing, analytics and advertising information is entirely optional. Some laws require us to keep certain records once you order: the Tax Administration Act 28 of 2011 and the Income Tax Act 58 of 1962 (financial and tax records), and the Consumer Protection Act 68 of 2008 and the Electronic Communications and Transactions Act 25 of 2002 (records of the transaction).
We do not sell personal information. We do not make decisions about you based solely on automated processing.
3. Operators and third parties
We use the following service providers ("operators") who process information on our behalf under written or standard-terms agreements that require them to keep it secure and use it only for our purposes.
| Provider | Role | Information involved |
|---|---|---|
| Cloudflare, Inc. | DNS, CDN, firewall, bot protection (Turnstile), email routing, admin access control | IP address, request data, cookies for security |
| Cloudflare R2 | Storage of product images (no customer data intended) | None, or only technical logs |
| Home-hosted server (our own infrastructure in South Africa) and encrypted backups on Microsoft Azure Blob Storage | Runs the shop database and stores backups | All order and account data (backups encrypted in transit; see our Data Retention Policy) |
| Brevo (Sendinblue SAS) or another SMTP relay | Sends order emails and, with your consent, marketing emails | Name, email, order details |
| Google Analytics (Google Ireland Ltd / Google LLC) | Site analytics | Pseudonymous usage data, only after consent |
| Meta Platforms (Facebook / Instagram) | Ad measurement via Pixel and Conversions API | Cookie IDs, hashed email/phone, order value, only after consent |
| The Courier Guy and Pudo (same group) | Delivery | Name, phone, email, address or chosen locker |
| Our bank | Receives your EFT payments | Payer name and payment reference (held by the bank under its own privacy notice) |
| Payfast (Network International / PayFast (Pty) Ltd) | Card/instant EFT payments, only once we switch it on | Name, email, order amount; card details go directly to Payfast and never touch our servers |
We may also disclose information where the law requires it (for example to SARS, a court, or the police) or to protect our rights. We may share it with our accountant, bound by confidentiality.
4. Cross-border transfers (POPIA s72)
Some of our providers (Cloudflare, Google, Meta, Brevo, Microsoft Azure) process information outside South Africa, including in the EU and the United States. We only transfer information where the recipient is subject to law, binding corporate rules or an agreement that gives substantially similar protection to POPIA, or where the transfer is necessary to perform our contract with you, or where you have consented (for example, by accepting analytics and marketing cookies).
5. How long we keep it
A summary: order and invoice records 5 years (tax law); marketing list until you unsubscribe; abandoned carts 30 days; server and security logs 90 days; backups 30 days; analytics 14 months. The full schedule is in our Data Retention Policy. When retention ends we delete or de-identify the information.
6. How we protect it
Encryption in transit (HTTPS), access controls and two-factor protection on the admin area, least-privilege access, hashed passwords, patched and isolated containers, and encrypted backups. Details are in the Data Retention Policy. If there is a security compromise affecting you, we will notify you and the Information Regulator as POPIA s22 requires.
7. Direct marketing (POPIA s69)
We send marketing emails only if you opted in (the checkbox at checkout is unticked by default, or you joined our list on the site). Every email has an unsubscribe link, and you can also email [email protected]. Unsubscribing does not stop service messages about an order you have placed.
8. Cookies
See our Cookie Policy. Analytics and marketing cookies are off until you accept them.
9. Your rights
You may, free of charge for the request itself:
- ask whether we hold information about you and access it (a reasonable prescribed fee may apply to copies of records requested under PAIA);
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent at any time (this does not affect processing already done);
- ask for access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA). Send PAIA requests to our Information Officer at [email protected].
Email [email protected] with your name and the email address used on your order. We may need to verify your identity. We aim to respond within 30 days.
10. Complaints
Please talk to us first. If you are not satisfied, you may complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za
- POPIA complaints: [email protected]
- PAIA complaints: [email protected]
- General enquiries: [email protected]
- Tel: 010 023 5200 | Toll-free 0800 017 160
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
11. Children
Our shop is not aimed at children, and you must be 18 or older (or have a parent or guardian's consent) to buy. We do not knowingly collect information from children under 18 without a competent person's consent. If you think we have, contact us and we will delete it.
12. Changes
We may update this policy. The date at the top shows the latest version. If we make a material change we will tell you on the site or by email.