Privacy & POPIA Policy

1. Responsible party

Olympic Cleaning Solutions (Pty) Ltd t/a ShopXP is the responsible party for personal information processed through ShopXP. The Information Officer contact is hello@shopxp.co.za.

This policy applies to customers, prospective customers, website visitors, suppliers and people who contact us. It should be read with our Cookie Policy and other transaction policies.

2. Information we process

• Identity and account information, including name, email, telephone number, password hash and verification status.
• Delivery and billing details, order history, returns, support correspondence and preferences.
• Payment status, transaction references and limited payment metadata received from processors; ShopXP does not need to store your full card number.
• XP Wallet, ledger entries, level, campaign eligibility and reward activity.
• Device, browser, IP address, security logs, cookies and website interaction necessary to operate and protect the service.
• Information you provide in reviews, surveys, promotions or communications with us.

3. Why we process it

• Create and secure accounts, authenticate users and prevent fraud.
• Process orders, payments, deliveries, returns, refunds, warranties and customer support.
• Operate ShopXP Rewards, calculate XP and levels, and reconcile reward transactions.
• Meet tax, accounting, consumer-protection, recordkeeping and other legal obligations.
• Improve product selection, website performance, service quality and fraud controls using proportionate information.
• Send requested service messages and, where lawfully permitted, marketing with a clear opt-out.

4. Lawful processing grounds

Depending on the activity, we process information with consent, to conclude or perform a contract, to comply with law, to protect a legitimate interest of you or another person, or to pursue our legitimate business interests without unjustifiably affecting your rights.

You may withdraw consent at any time where processing relies on consent. Withdrawal does not make earlier lawful processing unlawful and may affect services that genuinely require that information.

5. Who receives information

We share only what is reasonably necessary with payment processors such as Paystack, banks, fraud-prevention providers, couriers, fulfilment partners, distributors, email and hosting providers, professional advisers and authorities where law requires it.

Service providers must process information for agreed purposes and use appropriate safeguards. A distributor or courier may contact you only as needed to fulfil or support an order unless another lawful basis applies.

6. Cross-border processing

Some technology or payment providers may process information outside South Africa. We use providers and safeguards intended to satisfy POPIA's requirements for cross-border transfers, including adequate protection, binding agreements or another lawful basis.

7. Security and payment data

We use reasonable technical and organisational safeguards appropriate to the information and risk, including access controls, protected credentials, encrypted transport, payment-provider controls, backups, logging and incident response.

No internet service can promise absolute security. If we reasonably believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as required by POPIA.

8. Retention

We keep personal information only for as long as needed for the purpose collected, a lawful business need, dispute handling, fraud prevention or a legal retention obligation. Transaction, tax and accounting records may be retained for the applicable statutory period.

When information is no longer required, we delete, destroy or de-identify it using reasonable measures. Some records may remain in protected backups until they rotate out.

9. Direct marketing

We send electronic marketing only where permitted by POPIA. Messages identify ShopXP and provide a working way to opt out. You may unsubscribe at any time; service messages about an order, account, security or policy are not marketing.

We do not sell your personal information. We do not use sensitive information or children's information for behavioural advertising.

10. Your POPIA rights

• Ask whether we hold your personal information and request access to it.
• Request correction, deletion or destruction where the legal requirements are met.
• Object to certain processing or withdraw consent where applicable.
• Request information about recipients or categories of recipients.
• Complain to ShopXP or the Information Regulator and institute civil proceedings where permitted.
• Not be subject to a decision based solely on automated processing where POPIA's restriction applies.

11. Exercising your rights

Email hello@shopxp.co.za with enough information to identify you and the request. We may require reasonable proof of identity before disclosing or changing information. PAIA may apply to formal access requests.

You may complain to the Information Regulator of South Africa using the current contact details and forms published on its official website.

12. Children and policy changes

ShopXP is not intended for independent use by children under 18. A parent or guardian should place an order for a minor. We do not knowingly seek children's personal information without a lawful basis.

We may update this policy as services or legal requirements change. Material changes will be highlighted reasonably and the effective date will be updated.