Privacy Policy

1. Who is responsible

Velrovia Group is the responsible party (data controller) for personal information processed through velroviagroup.co.za. Our Information Officer can be reached at sales@velroviagroup.co.za or on 073 592 7535.

2. Information we collect

• Identity and contact information: name, company, email address, telephone number, delivery and billing addresses.
• Order information: products, quantities, prices, order status and correspondence about your order.
• Payment information: the payment method used and confirmation of payment. We never see or store full card numbers — these are handled by our PCI-DSS compliant payment provider.
• Technical information: IP address, browser, device type, referring pages and pages viewed, collected via cookies and server logs.
• Marketing preferences: whether you joined our newsletter, opened emails, and your communication preferences.
• Support information: the content of enquiries, warranty claims, returns and reviews you submit.

3. Why we process it

• To process, pack, deliver and invoice your order (performance of a contract).
• To provide warranty, returns and after-sales support.
• To answer enquiries and provide equipment recommendations you request.
• To comply with tax, accounting and consumer-protection obligations (legal obligation).
• To improve our website, catalogue and service quality (legitimate interest).
• To send marketing communications where you have opted in, or where you are an existing customer and we market similar products (with an easy opt-out in every email).

4. Legal basis and consent

We rely on the performance of a contract, compliance with legal obligations, your consent (for marketing and non-essential cookies) and our legitimate interests in running and improving a commercial business. You may withdraw consent at any time without affecting the lawfulness of processing that already took place.

5. Who we share information with

We share only what is necessary with operators who help us deliver our service: courier companies (name, address, phone, order contents), payment providers (billing and payment confirmation), our email and hosting providers, and our accountants for tax compliance. All operators are contractually required to keep information confidential and secure.

We do not sell, rent or trade personal information. We may disclose information where required by law, court order or a legitimate regulatory request.

6. Cross-border transfers

Some service providers (for example email delivery or analytics) may process information outside South Africa. Where this happens, we rely on section 72 of POPIA and ensure the recipient is subject to laws, binding rules or contractual terms providing an adequate level of protection.

7. Retention

• Order and invoice records: 7 years, as required by the Tax Administration Act and Companies Act.
• Warranty and service records: 5 years from purchase (or the warranty period, whichever is longer).
• Contact enquiries: 24 months, unless a customer relationship continues.
• Marketing preferences: until you unsubscribe, plus a suppression record to honour your opt-out.
• Server logs and analytics: up to 14 months.

8. Security

We use HTTPS across the site, access-controlled administration, encrypted backups, least-privilege access for staff, and PCI-DSS compliant payment partners. While no system is perfectly secure, we take reasonable technical and organisational measures to protect your information and will notify you and the Information Regulator where a breach poses a risk to your rights, as required by POPIA.

9. Your rights

To exercise any right, email sales@velroviagroup.co.za. We verify your identity and respond within 30 days.

• Access the personal information we hold about you and request a record of it.
• Request correction or deletion of information that is inaccurate, irrelevant, excessive or unlawfully obtained.
• Object to processing based on legitimate interests, and withdraw consent for marketing at any time.
• Lodge a complaint with the Information Regulator of South Africa (enquiries@inforegulator.org.za).

10. Children

Our website and products are intended for adults. We do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact us and we will delete it.

11. Changes

We update this policy when our practices change. The effective date above shows the current version, and material changes will be communicated to newsletter subscribers and shown prominently on the site.