How we collect, use and protect your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA) · Effective 1 October 2026 · Version 1.0

We only ask for what we need to send you a box every month, and we look after it carefully. This notice explains what we collect, why, who sees it and what your rights are.

1 Who we are

1.1 The responsible party for your personal information is Poetic Studio (Pty) Ltd, registration number 2023/107704/07, trading as Poetic Wax and Letters by PoeticWax (“we”, “us”, “our”).

Address	50 Avalon Road, Modderfontein, Johannesburg, Gauteng, 1609
Email	subscriptions@poeticwax.co.za
Phone and WhatsApp	081 554 3122
Website	www.poeticwax.co.za

2 Our Information Officer

2.1 Our Information Officer makes sure we comply with POPIA and deals with privacy requests and complaints. They are registered with the Information Regulator.

Information Officer	Cherome Jean Moodley, Director
Email	subscriptions@poeticwax.co.za (subject line: “Privacy”)
Phone	081 554 3122
Post or hand delivery	50 Avalon Road, Modderfontein, Johannesburg, Gauteng, 1609

3 What we collect and why

What	For example	Why we need it
Contact and delivery details	Name, email address, mobile number, delivery address	To create your account, deliver your box and send you service emails. Couriers won’t deliver without a mobile number.
Payment information	Payment dates, amounts and results, and the last four digits and expiry month of your saved card	To take your monthly payment and handle failed payments and refunds. Payfast captures and stores your card details. We never receive or store your full card number.
Subscription history	Start date, skips, pauses, cancellations, orders, tracking numbers	To run your subscription and plan how many boxes to make each month.
Messages with us	Emails, WhatsApp messages, complaints, reasons for cancelling (if you choose to tell us)	To answer you, fix problems and improve the service.
Website information	IP address, browser and device type, login and basket cookies	To keep the website working and secure and to keep you signed in.
Marketing choices	Whether you agreed to marketing, and when and how	To send marketing only to people who want it, and to prove that we asked.
Community and events (only if you take part)	A story you send us, the name you want it printed under, your pen name, pen pal letters that pass through us, your posts in the members’ community, event bookings and photographs taken at an event	To print your story with your written permission, to run the anonymous pen pal service for founding members, to run the members’ community, and to sell you a ticket and host the event. We forward pen pal letters without sharing your real name, address or contact details.
Fragrance allergies (only if you tell us)	An allergy or sensitivity you tell us about at sign-up or later	To check each month’s scent against what you have told us, and to curate a different fragrance where it isn’t right for you. This is health information, so we use it only with your consent and only for that purpose.

3.1 Required and optional information. You must give us your contact and delivery details and a payment card before we can take your subscription. Everything else is optional.

3.2 Children. Our subscription is for adults (18 and older). We don’t knowingly collect personal information about children.

3.3 Where it comes from. Most information comes from you. We also receive payment results from Payfast and delivery updates from the courier. If someone else subscribes for you or sends you a box as a gift, they give us your name and delivery details. We use those only to deliver the box.

4 The legal grounds we rely on

Under section 11 of POPIA, we only use your personal information when at least one of these applies:

to perform our contract with you, for example to deliver your box and collect payment;
to comply with the law, for example tax and company record-keeping, and consumer protection;
for our legitimate interests, for example keeping our website secure, preventing fraud and planning production, in ways that don’t override your rights; and
with your consent, for marketing, for printing your story, for the pen pal service, and for any fragrance allergy you tell us about. You can withdraw your consent at any time.

5 Emails and marketing

5.1 Service emails tell you about your own subscription: welcome, payment taken, payment failed, dispatch and tracking, the monthly skip reminder, skip and cancellation confirmations, and changes to our terms. You will get these as long as you subscribe.

5.2 Marketing means news about other Poetic Wax products and offers. We send it by email, SMS or WhatsApp only if you ticked the marketing box, which is never ticked for you (section 69 of POPIA). Every marketing message includes a free way to unsubscribe, and we act on it promptly. If you are already a customer, section 69(3) of POPIA also lets us email you about our own similar products, and every one of those emails has an unsubscribe link.

5.3 We don’t send marketing to anyone who has registered a block on the National Consumer Commission’s opt-out registry, unless they have given us their consent. We check our marketing list against that registry every month, as the Consumer Protection Act regulations require.

6 Who we share it with

We never sell or rent your personal information. We share only what each party needs, with:

Who	What for
Payfast	Our payment provider. Payfast stores your card securely and processes your payments. It is a PCI DSS-certified payment processor.
Your bank and the payment system	To process payments, disputes and refunds.
Our courier	Your name, mobile number and delivery address, to deliver your box.
Our website host	To run our website and store your account securely.
Our email platform	To send service emails and, if you agreed, marketing emails.
Your pen pal (only if you opt in)	Your pen name and the letters you write. Never your real name, address or contact details.
Our ticketing platform	Your name and email address, to issue and check event tickets. We name the platform on the ticket page at the time you book.
Accountants, auditors and legal advisers	Where they need records to do their work. They are bound by confidentiality.
Authorities	Only when the law requires it, for example the South African Revenue Service, or a court order.

6.1 Service providers who process information for us are “operators” under POPIA. They must keep it confidential and secure under a written agreement (sections 20 and 21 of POPIA), and may use it only for our instructions.

7 Information sent outside South Africa

7.1 Some of our service providers, such as email and cloud platforms, may store information on servers outside South Africa.

7.2 We only allow this where section 72 of POPIA permits it. The recipient must be bound by a law, binding company rules or an agreement that gives your information protection at least equal to POPIA, or the transfer must be needed to perform our contract with you.

8 How long we keep it

Information	How long
Orders, payments, invoices and refunds	Seven years, because the Companies Act and tax laws require us to keep financial records.
Payment authorisation and proof of delivery	For as long as you subscribe, and 12 months after that, so we can answer any payment dispute.
Stories and pen pal details	Until you withdraw your permission or leave the pen pal service. A story that has already been printed stays in the boxes that were sent.
Event bookings and event photographs	12 months after the event. Photographs we use on our website or social media stay up until you ask us to take them down.
Posts in the members’ community	Until you delete them or leave the community.
Your account and subscription history	12 months after you cancel, in case you have a return, a warranty claim or want to restart. After that we delete it or remove anything that identifies you.
Messages and complaints	Two years after the matter is closed.
Marketing consent and opt-outs	For as long as we might contact you. We keep a record of your opt-out so we don’t contact you again.
Fragrance allergies	For as long as you subscribe, or until you ask us to delete it. Deleted when your account is closed.
Records of a complaint, claim or dispute	Three years after it is closed, so that we can defend a claim if it comes back. Tax and company records are kept for five years because the law requires it.

9 How we protect it

Payment details are handled by Payfast, not stored on our website.
Our website uses an encrypted (https) connection.
Access to customer information is limited to the people who need it, using strong passwords and two-step login where available.
Our operators are bound by written agreements to keep information secure.
If we believe your personal information has been accessed or taken by someone without authority, we will tell you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires. We will also tell you what you can do to protect yourself.
Everyone who handles personal information for us — our courier, our payment provider, our email platform and our website host — is bound in writing to use it only on our instructions and to keep it secure, as section 21 of POPIA requires.

10 Cookies

10.1 Our website uses essential cookies. These remember your basket, keep you signed in and let checkout work. The website can’t work without them.

10.2 You can delete or block cookies in your browser settings. If you block essential cookies, you won’t be able to check out.

11 Your rights

Under POPIA you have the right to:

know whether we hold personal information about you, free of charge;
get a copy of it (section 23). We will tell you in advance if a fee applies under the Promotion of Access to Information Act (PAIA);
ask us to correct or delete information that is wrong, out of date, incomplete or that we are no longer allowed to keep (section 24);
object to our use of your information, including for marketing (section 11(3));
withdraw your consent at any time. This doesn’t affect anything we did before you withdrew it;
not be subject to decisions made only by automated means. We don’t make any; and
complain to the Information Regulator (section 12 of this notice).

11.1 To use any of these rights, email subscriptions@poeticwax.co.za with “Privacy” in the subject line. We may ask you to confirm your identity first. We will respond within 30 days. You may use the official POPIA forms (Form 1 to object, Form 2 to correct or delete), but you don’t have to.

11.2 Some information we must keep by law, such as financial records, even if you ask us to delete it. If so, we will tell you why.

12 Complaints

12.1 Please tell our Information Officer first. We take privacy complaints seriously and will try to resolve yours quickly.

12.2 You also have the right to complain to the Information Regulator at any time:

Information Regulator	Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Phone	0800 017 160 (toll-free) or 010 023 5200
Email	enquiries@inforegulator.org.za
Website	www.inforegulator.org.za. Complaints are lodged on Form 5, available on the website.

13 Our PAIA manual

13.1 Our manual under the Promotion of Access to Information Act 2 of 2000 explains how to request records we hold. It is available on request from subscriptions@poeticwax.co.za.

14 Changes to this notice

14.1 We may update this notice. The date and version at the top show the current one. If a change affects how we use your information in a significant way, we will email subscribers before it applies.

Privacy Notice