Privacy Policy

Advannotech (Pty) Ltd is the responsible party for the personal information collected through shop.smartkwam.co.za. You can reach us at privacy@smartkwam.co.za or by post at 141 Witch-Hazel Avenue, Highveld Techno Park, Centurion, Gauteng, South Africa.

• Account details — your name, email address and phone number when you register or check out as a guest.
• Order and delivery details — what you bought, your delivery or collection address, and the waybill the courier returns.
• Payment status — whether a payment succeeded, failed or was refunded. We never see or store your card details. Card data is entered directly into Payfast's secure form and never reaches our servers.
• Reviews you write — your rating, any comment, any photo you attach, and the first name shown next to it.
• How you use the shop — pages viewed, items added to cart, searches run. Used in aggregate to understand what people are looking for.
• Email engagement — whether an email we sent was delivered, bounced, or was reported as spam. Used to keep our sending healthy and to stop mailing addresses that do not work.

POPIA requires a lawful basis for every use of your information. Ours are:

• To perform our contract with you — processing your order, taking payment, arranging delivery, handling returns and refunds, and sending you the transactional emails that go with them (order confirmation, dispatch, delivery, refunds).
• Our legitimate interests — preventing fraud, securing accounts, keeping the shop working, and understanding in aggregate how it is used.
• Legal obligation — tax and accounting records we are required to keep.
• Your consent — marketing email, and any optional cookie beyond what the site needs to function.

We only send marketing email to people who have asked for it, or who have bought from us and have not objected. Section 69 of POPIA governs this, and we follow it:

• Every marketing email carries an unsubscribe link, both in the footer and as a one-click option your email app can show. Unsubscribing takes effect immediately.
• You can choose what you hear about rather than opting out of everything, at your email preferences.
• Transactional email is not marketing. Order confirmations, dispatch notices, delivery updates, refunds and password resets are part of our contract with you and will still be sent after you unsubscribe.
• We do not sell or rent your details to anyone for their own marketing.

We share only what each provider needs to do its job, and only with operators bound to protect it:

• Payfast (by Network) — payment processing. They handle your card details directly; we receive only the outcome.
• The Courier Guy — your name, delivery address and phone number, so they can deliver your order.
• Our suppliers — the delivery details needed to dispatch the specific items you ordered.
• Resend — email delivery.
• Cloudinary — hosting for product images and any photo you attach to a review.
• Railway and Vercel — hosting for the shop and its database.

Some of these operate servers outside South Africa. Where information is transferred abroad we rely on the recipient being subject to laws or binding agreements that provide protection substantially similar to POPIA, as section 72 requires.

Order and payment records are kept for five years to meet South African tax and accounting requirements. Account details are kept while your account is open. Published reviews stay up while the product is listed. Marketing preferences and unsubscribe records are kept indefinitely — that is how we know not to email you again.

Under POPIA you may:

• Ask what personal information we hold about you, and get a copy.
• Ask us to correct anything that is wrong or incomplete.
• Ask us to delete information we no longer have a reason to keep.
• Object to us using your information for direct marketing, at any time and free of charge.
• Complain to the Information Regulator if you think we have got it wrong.

To exercise any of these, email privacy@smartkwam.co.za. We will respond within a reasonable time and may need to verify who you are first.

The Information Regulator (South Africa) can be reached at complaints.IR@justice.gov.za.

Passwords are hashed with Argon2id and never stored in a readable form. Traffic is encrypted in transit. Card details never touch our servers — Payfast handles them, which keeps us within PCI DSS SAQ A. Sensitive documents are stored privately and served only through short-lived signed links. Access to customer data is limited to staff who need it.

We use cookies that the shop needs to work: keeping you signed in, remembering your cart, and protecting against fraud. These cannot be turned off without breaking checkout. We do not use advertising or cross-site tracking cookies.

The shop is not intended for children under 18. We do not knowingly collect information from children. If you believe a child has given us their details, contact us and we will delete them.

We may update this policy. The version published here is the one in force, and the date at the top tells you when it last changed. If a change materially affects how we use your information, we will tell you by email.