Privacy Notice & POPIA

1. Responsible party

ASDFSA (ASDF South Africa), registration number [COMPANY REG NO — TO BE PROVIDED], registered at [REGISTERED ADDRESS — TO BE PROVIDED], is the responsible party for the processing of your personal information under POPIA.

Our Information Officer can be contacted at [INFORMATION OFFICER EMAIL — TO BE PROVIDED].

2. Information we collect

• Account data: name, email address, password (hashed), role.
• Order data: delivery address, contact phone number, items purchased, order history.
• Retailer data: trading name, account number, region, contact person, credit balance.
• Age verification: confirmation that you are 18 or older (we do not store ID documents on the site).
• Technical data: IP address, browser type, device, and basic analytics for fraud prevention and site improvement.

3. Why we process it (lawful basis)

• To conclude and perform the sale contract with you (POPIA s11(1)(b)).
• To comply with our legal obligations, including age restriction, tax and excise duty record-keeping (s11(1)(c)).
• To pursue our legitimate interests in operating a safe, secure platform and preventing fraud (s11(1)(f)).
• With your consent, for marketing communications you have opted in to (s11(1)(a)).

4. Who we share it with

We share personal information only with: delivery and logistics providers (to fulfil your order), payment processors, our cloud hosting and backend provider, and government authorities where required by law (for example SARS in respect of excise duty). We do not sell your personal information.

5. Cross-border transfer

Some of our service providers (including hosting and email infrastructure) process data outside South Africa. Where this happens we ensure the recipient is subject to a law, binding rules or contract that provides an adequate level of protection, as required by POPIA s72.

6. How long we keep it

We keep personal information only for as long as necessary for the purposes set out above, or as required by tax, excise and consumer-protection law (typically 5 years for transactional records). Account data is deleted on request unless retention is legally required.

7. Your rights

You have the right to:

• access the personal information we hold about you;
• request correction or deletion of inaccurate or outdated information;
• object to processing for direct marketing at any time;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

To exercise these rights, email [INFORMATION OFFICER EMAIL — TO BE PROVIDED].

8. Marketing to minors

We do not knowingly market to, or collect personal information from, persons under the age of 18. Our content and communications are restricted to verified adult users.

9. Cookies

We use a small number of essential cookies for the age gate, login session and shopping cart. We do not use third-party advertising or tracking cookies for nicotine product marketing.

10. Security

Personal information is stored in a secure managed database protected by row-level security, hashed passwords and TLS in transit. Despite reasonable safeguards, no system is completely secure; please notify us immediately if you suspect unauthorised access to your account.

11. Changes

We may update this notice from time to time. The "last updated" date at the top reflects the most recent change.