PRIVACY POLICY

SUNBOY is a small South African clothing label operating from South Africa and selling at sunboy.co.za. We are the responsible party for the information described here. For anything about your information, email hello@sunboy.co.za.

To send you an order: your name, email address, phone number and delivery address, including the complex or unit, suburb, city, province, postal code and any delivery note. We cannot fulfil an order without these.

To take payment: the order amount and a Payfast payment reference. We never receive or store your card number, expiry date or CVV, and we do not save cards for future use.

If you create an account: your email address, a securely hashed password handled by our authentication provider, your saved addresses and your order history.

If you join the list: your email address, and only if you actively tick the box. Marketing is opt-in. We do not add you to anything by default, and we do not treat buying something as permission to market to you.

Technical information: your IP address and request details, kept briefly to block abuse of our login and checkout endpoints. We do not run advertising or cross-site tracking cookies. The cookies we set keep you signed in and remember your bag.

Order, delivery and payment information is processed to perform the sale contract with you. Fraud prevention and abuse limiting rest on our legitimate interest in running the shop safely. Tax and accounting records are kept because the law requires it. Marketing email is processed only on your consent.

We do not sell your personal information, ever, to anyone. We share the minimum necessary with these operators, each under a duty to protect it:

• Payfast by Network9 (Pty) Ltd — Takes the payment. Your card details go straight to them and never touch our servers — we only ever see the amount, the result and a payment reference.
• Supabase — Hosts the database that holds your account, addresses and orders.
• Vercel — Hosts the website itself and keeps short-lived request logs.
• Google Places — Powers the street address suggestions while you type. Only the partial address you type is sent, never your name, email or order.
• Resend — Sends order confirmation and shipping emails.
• The courier — Gets your name, delivery address, phone number and any delivery note, because they cannot deliver without them.

Some of these providers process information outside South Africa. POPIA allows this where the receiving country or the provider's contractual commitments give comparable protection, which is the basis we rely on.

Order and invoice records are kept for five years, as South African tax law requires. Account information stays until you ask us to delete it. Abandoned guest carts and login rate-limit records are cleared out within about 30 days. Marketing consent is kept until you unsubscribe, plus a short record that you did, so we don't email you again by mistake.

Everything travels over HTTPS. Database access is restricted per user by row-level security, so one customer cannot read another's orders or addresses. Payment pages are Payfast's, not ours. Admin access to the shop requires a PIN plus an authenticator app code, with lockout on repeated failures. If a breach ever affects your information, we will notify you and the Information Regulator as POPIA requires.

You may ask us for a copy of the information we hold about you, correct anything wrong, delete what we are not legally required to keep, withdraw marketing consent at any time, or object to processing. Email hello@sunboy.co.za and we'll respond within 30 days. You can update your details and addresses yourself at any time under your account.

Every marketing email has a one-click unsubscribe. Withdrawing consent does not affect order emails, which we still need to send you about purchases.

We do not knowingly collect information from anyone under 18 without the consent of a parent or guardian. If you believe we have, email us and we will delete it.

Come to us first — we would rather fix it. If you are not satisfied, you can complain to the Information Regulator of South Africa at POPIAComplaints@inforegulator.org.za.

If this policy changes in a way that matters, we will update the date at the top and, where the change is significant, tell account holders by email.