Privacy Policy

1. Introduction and scope

This policy explains what personal information Nilla Vanilla (“we”, “us”, “our”) collects through nillavanilla.co.za (the “Site”) — including when you browse, create an account, place an order, apply for wholesale/trade access, subscribe to our newsletter, or use our live chat — why we collect it, how it's used, who we share it with, and the rights you have over it, in line with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) and, where relevant, the Electronic Communications and Transactions Act 25 of 2002 (ECT Act).

2. Responsible party

Nilla Vanilla is the “responsible party” under POPIA for the personal information described in this policy.

Trading name: Nilla Vanilla.
Registered business address: Sunset Avenue, Lonehill, Johannesburg, Gauteng, South Africa.

3. Personal information we collect

• Account information: name, email address, phone number and a securely hashed password (we never store your password in plain text, and staff cannot view it).
• Delivery & billing addresses you add to your account or enter at checkout.
• Order history and transaction data:what you've bought, when, how much was paid (including shipping cost), fulfilment and courier tracking status — this powers your order history and printable statements.
• Refund-related banking confirmation: if you request a refund, we may ask for a bank confirmation letter or similar proof that the receiving bank account belongs to the person who placed and paid for the order. This is collected solely to verify a refund payout is going to the right person, is not used for any other purpose, and is retained only as long as needed to process and account for that refund. See our Refund Policy for detail.
• Wholesale applications: if you apply for a trade account, your business name and, optionally, VAT number, company registration number and estimated order volume.
• Live chat data:if you use the chat widget on the Site, we collect the messages you send, your name/email/phone if you're not logged in (or your existing account details if you are), your IP address, browser user-agent, an approximate location derived from your IP address, and — for logged-in customers — the account and order information the assistant looked up to answer your question. See Section 6 below for detail on how this is processed.
• Newsletter details: name, email and (optionally) phone number, if you subscribe via the footer, at checkout, or after a completed order.
• Cart contents,stored in your browser's local storage, not on our servers, until you check out.
• Technical information: IP address, browser type, device type and general usage information, collected automatically as part of operating the Site securely (for example, rate-limiting abusive requests).

We do not collect or store payment card or bank login details — those are handled entirely by PayFast (see Section 5).

4. Why we collect it, and our legal basis

We use your information to create and manage your account; process, fulfil and deliver orders; calculate accurate shipping costs; process refunds and verify refund recipients; assess wholesale applications; respond to support and live chat requests; send order, payment, shipping and account-related emails; and, where you've consented, send newsletter marketing communications. We rely on one or more of the following legal bases for each of these purposes: performance of a contract with you (placing and fulfilling an order, managing your account); your consent (newsletter marketing, non-essential cookies if introduced in future); our legitimate business interests, balanced against your rights (fraud prevention, rate-limiting, running the live chat assistant); and compliance with a legal obligation (accounting and tax record-keeping). We do not sell your personal information to third parties.

5. Who we share it with

To provide the service, some information is shared with the following processors, each acting only for the specific purpose described:

• PayFast — processes your payment. We receive confirmation that payment succeeded, not your card details.
• The Courier Guy — receives your delivery address and contact details to quote, book and deliver your order.
• Zoho Mail — our email provider, used to send order confirmations, shipping updates, newsletter emails and password reset emails.
• Our live chat AI provider — messages you send through the chat widget, and the minimum account/order context needed to answer your question, are sent to a third-party AI language-model provider to generate a response. Guests without an account never have order or account information sent to this provider on their behalf. See Section 6.
• An IP-geolocation lookup service — when you start a live chat, your IP address (only) is sent to a third-party lookup service to resolve an approximate city/country, shown to our support team so we have context on where a query is coming from. This lookup does not receive your name, email, or message content.
• Google (Places API) — used to power address autocomplete at checkout; the address text you type is sent to Google to suggest matching addresses.

Each of these providers processes your information under its own privacy practices, for the specific purpose described above, and we take reasonable steps to only share what's necessary for that purpose. We may also disclose information where required by law, to protect our legal rights, or to investigate suspected fraud or abuse of the Site.

6. Live chat and the AI assistant, in detail

Our live chat widget first tries to answer using an automated AI assistant before offering to connect you with a real person. The assistant is deliberately restricted in what it can access and say:

• If you are not logged in, the assistant can only answer from general, published store information (products, pricing, shipping, wholesale) — it is never given access to any order or account data, even if you ask about a specific order.
• If you are logged in, the assistant may look up and discuss your own account's order status and wholesale status only — never another customer's.
• Every message, and a record of what information the assistant looked up to answer it, is stored against your chat conversation so our team can review it and so a conversation can continue seamlessly if you ask to speak to a real person.
• You can ask to be connected to a real person at any point, and nothing stops you from simply emailing [email protected] instead.

7. Cross-border information transfer

Some of the third-party processors listed in Section 5 — including our email provider, our live chat AI provider, and our IP-geolocation lookup service — may process information on servers located outside South Africa. Where this happens, we rely on those providers maintaining data protection standards that are, at minimum, comparable to POPIA's requirements, whether through contractual commitments, recognised certification, or the laws of the jurisdiction in which they operate.

8. Cookies and similar technologies

We use the following functional, non-advertising technologies to make the Site work:

• A session cookie, to keep you logged in.
• A chat session cookie, so a live chat conversation continues as you move between pages or return to the Site.
• Your cart contents, stored in your browser's local storage, not as a cookie and not on our servers.

These are all strictly necessary for core functionality — we don't use tracking, analytics, or advertising cookies at this time. If that changes, we'll update this policy and ask for your consent where required.

9. Direct marketing

We only send newsletter/marketing emails to addresses that have opted in — via the footer newsletter signup, at checkout, or automatically after a completed order (in which case you can unsubscribe at any time using the link in that email, or by contacting us directly). You will still receive essential, non-marketing transactional emails relating to an order or account you hold with us (for example, order confirmations and password resets) regardless of your marketing preference, since these are necessary to provide the service you've requested.

10. How long we keep it

We retain account, order and chat information for as long as your account is active, and for a reasonable period afterward to meet our accounting, tax and consumer- protection record-keeping obligations. Refund-related bank confirmation documents are retained only as long as needed to process and account for that specific refund. You can ask us to delete your account at any time, subject to information we're legally required to retain.

11. Security

Passwords are hashed, not stored in plain text. Access to order, customer and chat data is limited to what's needed to run the store. We use rate-limiting and other technical controls to reduce abuse of the Site. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information from unauthorised access, loss or disclosure, and we will notify you and the Information Regulator where required by law if we become aware of a security compromise that affects your personal information.

12. Children's privacy

The Site is intended for use by adults capable of entering into a contract. We do not knowingly collect personal information from children, and accounts should only be created and orders should only be placed by, or under the direct supervision and consent of a parent or guardian on behalf of, someone who meets the eligibility requirement in our Terms & Conditions.

13. Your rights as a data subject

Under POPIA, you have the right to: be told what personal information we hold about you and why; request a copy of it; ask us to correct or update inaccurate or outdated information; object to our processing of your information on reasonable grounds; withdraw consent (for example, to marketing emails) at any time; and request deletion or destruction of your personal information, subject to information we're legally required to retain. To exercise any of these rights, contact us through our contact page or at [email protected].

14. Complaints

If you're unhappy with how we've handled your personal information, please contact us first so we can try to put it right. You also have the right to lodge a complaint with South Africa's Information Regulator, whose contact details are published at inforegulator.org.za.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our operations, the services we use, or the law; the current version will always be available on this page, with the “last updated” date above reflecting the most recent revision.

16. Contact us

Questions about this policy, or requests relating to your personal information, can be sent to [email protected] or through our contact page.