Privacy and POPIA Policy

Last updated: 14 October 2026

This Privacy Policy explains how Bloo’s Cosmetics collects, uses, stores, and protects your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and any other applicable South African data-protection legislation.

2.1 Who We Are (Responsible Party)

Bloo’s Cosmetics is the responsible party under POPIA. Bloos Cosmetics. Physical address: 3 Tarragon Rd, Faerie Glen, Pretoria. Email: thomas@blooscosmetics.co.za. Phone: [0834076037

Information Officer: Thomas HIll Contact: thomas@blooscosmetics.co.za 

2.2 What Personal Information We Collect

We may collect the following categories of personal information:

  • Identity information: full name, date of birth.
  • Contact information: email address, phone number, delivery and billing address.
  • Order and transaction information: products purchased, order history, payment confirmation details (we do not store card numbers).
  • Account information: login credentials if you create an account.
  • Technical information: IP address, browser type, device information, and pages visited (via cookies and analytics tools).
  • Communication records: emails, live-chat transcripts, or other correspondence you send us.

We do not intentionally collect sensitive personal information (as defined in POPIA) such as health data, race, religion, or political beliefs. Please do not submit such information to us.

2.3 How We Collect Personal Information

We collect personal information:

  • Directly from you when you place an order, register an account, complete a form, or contact us.
  • Automatically via cookies and analytics tools when you browse the Website.
  • From third-party payment processors who confirm successful transactions.

2.4 Lawful Basis and Purpose of Processing

We process your personal information on one or more of the following lawful grounds:

  • Contract: to process and fulfil your order, arrange delivery, manage returns, and provide customer support.
  • Legal obligation: to comply with tax, accounting, and other statutory requirements.
  • Legitimate interest: to improve our Website and products, prevent fraud, and maintain security — balanced against your rights and interests.
  • Consent: to send you marketing communications where you have opted in. You may withdraw consent at any time (see section 2.7).

2.5 Sharing of Personal Information

We do not sell your personal information. We may share it only with:

  • Service providers acting as our operators under POPIA (e.g. payment processors, courier companies, email-platform providers) who are contractually required to protect your data.
  • Regulatory or law-enforcement authorities where required by law or valid court order.
  • A successor entity in the event of a business sale or merger, subject to equivalent privacy protections.

All third parties are required to comply with applicable data-protection legislation.

2.6 Cross-Border Transfers

Some of our service providers may be located outside South Africa (e.g. cloud-hosting or email platforms). Where your personal information is transferred to a foreign country, we take reasonable steps to ensure that it is subject to an adequate level of protection comparable to POPIA.

2.7 Your Rights Under POPIA

You have the right to:

  • Access the personal information we hold about you.
  • Correction or deletion of inaccurate, irrelevant, or out-of-date personal information.
  • Objection to the processing of your personal information in certain circumstances.
  • Withdraw consent for direct marketing at any time by clicking “Unsubscribe” in any marketing email or contacting us at [PLACEHOLDER: email address].
  • Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.

To exercise any of these rights, contact our Information Officer at [PLACEHOLDER: Information Officer email]. We will respond within a reasonable time and in accordance with POPIA.

Information Regulator of South Africa Website: www.inforegulator.org.za | Email: inforeg@justice.gov.za

2.8 Cookies

Our Website uses cookies to enhance your browsing experience and collect analytics data. You may adjust your browser settings to refuse cookies; however, some features of the Website may not function correctly without them. [PLACEHOLDER: If you use a consent-management tool, describe it here.]

2.9 Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or destruction. Payment transactions are processed through PCI-DSS compliant payment gateways. Despite these measures, no online transmission is entirely risk-free; you submit information at your own risk.

2.10 Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law (e.g. SARS requirements). Order and transaction records are generally retained for at least five (5) years. Account information is retained while your account is active and for a reasonable period thereafter.

2.11 Children

Our Website is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

2.12 Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised Policy on the Website with an updated “Last updated” date. Material changes will be communicated by email or a prominent notice on the Website.