Privacy & POPIA
Last updated 20 September 2026
Maisonne collects only what it needs to authenticate a piece, take your order, deliver it and stay on the right side of the law — and keeps it no longer than it should. This notice explains what we hold, why, who we share it with, and the rights you have under the Protection of Personal Information Act 4 of 2013 (“POPIA”).
What we collect
- Identity & contact: your name, email address, telephone / WhatsApp number.
- Delivery: the delivery address and any instructions you give the courier.
- Order: the pieces you buy, order references, and correspondence with us (including WhatsApp enquiries).
- Payment confirmation: the outcome and reference of your payment. We do not receive or store your card number, CVV or bank login — those go directly to our payment gateway (see Payments).
- Technical: if analytics are enabled, limited usage data such as pages viewed and approximate region. This is disclosed and can be declined where required.
Why we process it, and our lawful basis
- To take, authenticate, fulfil and deliver your order — necessary to perform our contract with you.
- To keep you informed about your order and answer enquiries — contract and our legitimate interest in serving you.
- To meet legal obligations, including tax, consumer-protection and record-keeping duties.
- To send you marketing only with your consent, which you may withdraw at any time (every message includes an opt-out).
Who we share it with
We do not sell your personal information. We share it only with operators who help us run the house, under confidentiality and processing terms, and only as far as needed:
- our courier, to deliver your piece;
- PayFast, our payment gateway, to process payment;
- our hosting and infrastructure provider (Cloudflare) and, where enabled, an analytics provider; and
- professional advisers or authorities where the law requires it.
Some of these providers may process data outside South Africa. Where that happens, we rely on providers who are subject to laws or agreements that give your information comparable protection, as POPIA requires.
Payments
Payments are processed by PayFast. Your card and banking details are entered on PayFast's own secure pages and are never seen, handled or stored by Maisonne or by this website. We receive only confirmation that a payment succeeded or failed, and its reference.
How we keep it safe
We take reasonable technical and organisational measures to protect your information against loss, unauthorised access and misuse — including HTTPS across the site, keeping payment handling with PayFast, limiting who can access order data, and holding gateway credentials server-side rather than in the browser. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as POPIA requires.
How long we keep it
We keep personal information only as long as necessary for the purpose it was collected for, or as long as the law requires — for example, tax and financial records are generally kept for five years. Marketing consent data is kept until you withdraw consent. When information is no longer needed, we securely delete or de-identify it.
Your rights
Under POPIA you have the right to:
- ask what personal information we hold about you and request access to it;
- ask us to correct or update information that is inaccurate or out of date;
- ask us to delete or destroy information we are no longer entitled to keep;
- object to processing based on legitimate interests, and to withdraw marketing consent at any time; and
- lodge a complaint with the Information Regulator.
To exercise any of these, contact our Information Officer at [email protected]. We will respond within a reasonable time and may need to verify your identity first.
Complaints to the Regulator
If you believe we have not handled your personal information lawfully, you may complain to:
- Regulator
- The Information Regulator (South Africa)
- Address
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- Complaints
- [email protected]
- Enquiries
- [email protected]
Please confirm the Regulator's current contact details before publishing, and have this notice reviewed by a South African attorney. This page is a summary of our practices, not legal advice.