Good to knowPrivacy Policy

Who we are

Oh Fudge! is the responsible party (controller) for the information described here. We are a small business based in Johannesburg, South Africa. Contact us at ohfudgeofficial@gmail.com or on 083 436 5253. Privacy questions and requests go to the same email address, marked for the attention of our Information Officer.

What we collect and why

• When you place an order: your name, email address, phone number and delivery address, plus an optional delivery note. We use these to take payment, make and deliver your order, send order updates and handle any problem with it. Lawful basis: performing the contract with you (POPIA section 11(1)(b), GDPR Article 6(1)(b)).
• When you pay: Paystack collects your card or bank details directly. We never see or store them. We receive a payment status and reference from Paystack. When you accept our Terms and place the order, we record the date and the policy version you accepted against the payment.
• When you use the order lookup page: the order number and email you enter, to find your order.
• When you email, phone or WhatsApp us: whatever you send us, to answer you. Lawful basis: our legitimate interest in replying to you.

Supplying the order details is voluntary, but we cannot take, pay for or deliver an order without them. We do not make automated decisions about you and we do not use your information for marketing.

Who we share it with

We do not sell your information. We use these service providers (operators) to run the shop, and they process your information only on our instructions.

• Paystack, for payment processing.
• Neon, which hosts our order database.
• Vercel, which hosts this website.
• Google, which provides Google Analytics.
• Our courier, who receives your name, phone number and delivery address to deliver your order.

Some of these providers store or process data outside South Africa, including in the United States and Europe. We rely on their contractual and legal safeguards for those transfers. We also disclose information where the law requires it.

Cookies and browser storage

We use Google Analytics 4 to count visits and see which pages are used. Until you click Accept on our notice banner it runs in a cookieless mode: no cookies are set, but Google still receives basic page-view data such as your anonymised IP address and device details. If you click Accept, it sets cookies to tell visits apart. If you click Decline, it stays cookieless. We do not use advertising trackers. Your browser also stores your cart and your banner choice on your own device. Details are in our Cookie Policy.

How we protect it

Orders are stored in a managed database over encrypted connections, order lookups require both your order number and email, and the website is served over HTTPS with security headers. If we ever have reason to believe your information has been accessed without authority, we will tell you and the Information Regulator as POPIA requires.

Children

This shop is for adults. We do not knowingly collect information from anyone under 18.

How long we keep it

We keep order records for five years, which is the period South African tax and company law generally requires for financial records, and then delete or anonymise them. Emails and messages are kept only as long as needed to deal with your request, and no longer than 24 months after we last hear from you.

Your rights

Under POPIA, and the GDPR where it applies, you may ask us at any time, free of charge, to do any of the following.

• Tell you what personal information we hold about you and give you a copy.
• Correct anything that is wrong or out of date.
• Delete your information, where we are not required by law to keep it.
• Stop using your information for anything other than completing an order you have placed.
• Move your information to another provider where the GDPR applies.

Email us to make a request and we will respond within a reasonable time, and within one month for GDPR requests. We may need to confirm who you are first.

Complaints

Please contact us first so we can try to fix the problem. You also have the right to complain to the Information Regulator of South Africa (inforegulator.org.za, complaints.IR@justice.gov.za). If you are in the EU or UK you may complain to your local data protection authority.

Changes to this policy

If we change this policy we will update the date at the top of this page.