Privacy Policy

Who we are

This policy explains what personal information Khalala (Pty) Ltd collects, why it is processed, how it is protected, and how information is shared with the independent Store Owner who operates the Khalala Store through which a customer interacts or purchases, in accordance with South Africa's Protection of Personal Information Act (POPIA).

Information we collect

Depending on how you use Khalala, we may collect:

• Name, email address, and phone number
• Delivery address
• Which Khalala Store you use, the Store Owner associated with that Store, and any community/business/school/church group you identify
• For Store Owners: business details, bank account information, and an ID or business registration number, used for onboarding, account administration and verification of payout bank details
• Order history and what you've purchased

We don't collect or store your card details ourselves — payment is handled directly by Paystack.

Cookies

We use a small number of essential cookies to keep your cart and your login session working — nothing used for advertising or tracking you across other sites.

How we use your information

• To process and fulfil your orders
• To arrange delivery
• To create and manage your account, and to let the Store Owner associated with that Store see order-level details (items purchased, order status) for orders placed through their storefront
• To verify Store Owner payout bank details and make Store Owner margin payments
• To calculate and track community group rebates
• To send transactional communications, respond to enquiries, and support customer service

Who we share it with

We share personal information only where reasonably necessary for the purpose for which it was collected, to operate the Khalala platform, to comply with law, or where another lawful justification applies. This includes making order-level details — the items purchased, order status, and any customer-service notes Khalala has recorded for that order — visible to the Store Owner of the Store through which the order was placed, so they can track sales made through their storefront.

A Store Owner's access to personal information is currently limited to a customer's name and order history (items purchased, order status, and any notes Khalala has recorded) for orders placed through that Store Owner's own storefront. A Store Owner cannot see a customer's email address, phone number or delivery address through the platform, and cannot access orders or customers belonging to another Khalala Store. Store Owners may not use the order information they can see for any purpose other than tracking and supporting sales made through their own storefront, and may not attempt to obtain further customer information outside the platform. Depending on the activity, Khalala and a Store Owner may each have POPIA responsibilities for the processing they determine and undertake. Store Owners must comply with Khalala's data-protection requirements and applicable law.

Store Owners currently have no means within the Khalala platform to directly contact, message or market to customers — all customer communication (order confirmations, shipping updates, support) is sent by Khalala. If Khalala introduces a feature allowing Store Owners to contact or market to customers directly, this policy will be updated before that feature is enabled, and any such marketing will only ever be conducted in compliance with POPIA and other applicable law, including an appropriate way to opt out.

We also work with the following service providers, only to the extent each needs to do their job:

• Paystack — payment processing and Store Owner margin payouts
• Bob Go — courier delivery
• Resend — sending order and account emails
• Our hosting and database providers

We don't sell your personal information to anyone.

How long we keep it

We retain customer and order records for as long as reasonably required for the purpose for which they were collected and for applicable legal, tax, accounting, dispute and fraud-prevention requirements. Where a specific record must be retained for a statutory period, we retain it for that period and thereafter securely delete, destroy or de-identify it when no longer required.

Your rights

Under POPIA, you can ask us to:

• Tell you what personal information we hold about you
• Correct information that's wrong or out of date
• Delete your information, subject to any legal or accounting reasons we need to keep it
• Stop using your information for a particular purpose

You can also complain to South Africa's Information Regulator if you're unhappy with how we've handled your information.

Security

We take appropriate, reasonable technical and organisational measures to safeguard personal information. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Khalala will follow the notification and response requirements of POPIA, including notification to the Information Regulator and affected data subjects where required.

Some technology or service providers may process or store information outside South Africa. Where personal information is transferred across borders, Khalala will take steps required by POPIA to ensure an appropriate lawful basis and level of protection.

Children

We don't knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time.

Contact / Information Officer

Information Officer: Sina Molelekoa Morunyana
Email: support@khalala.co.za