Privacy policy

Karoo Collectables & Slabs ("we", "us"), Mossel Bay, Western Cape, South Africa is the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Privacy questions or requests: support@karoocollectablesandslabs.co.za.

• Account details: name, email, mobile number (optional) and a securely hashed password.
• Order details: delivery address, items bought, payment status and order history. We never see or store your full card number; card payments are handled by our payment provider.
• Messages you send us, such as PSA pre-order and bulk order requests.
• Basic site usage (pages and products viewed). Anonymous visit statistics are only linked to a browser ID if you accept optional cookies. See our cookie policy.

• To process, deliver and support your orders (contract).
• To run your account, wishlist and collection features (contract).
• To send order and account emails, such as confirmations and shipping updates (contract).
• To send news about drops and restocks, only if you opt in. You can unsubscribe at any time (consent).
• To prevent fraud and keep the site secure, and to meet tax and accounting duties (legitimate interest / legal obligation).

Only with service providers who need it to do their job: our courier (name, address, phone for delivery), payment provider, email delivery service, and website hosting and database providers. Some of these store data outside South Africa under safeguards that meet POPIA's requirements.

We never sell or rent your personal information.

Order and invoice records are kept for 5 years for tax purposes. Account information is kept while your account is open; ask us to close it at any time.

You may ask to see, correct or delete your personal information, object to its use, or withdraw consent for marketing. Email us and we will respond within 30 days.

If you are unhappy with how we handled your information you may complain to the Information Regulator (inforegulator.org.za).

We use encrypted connections (HTTPS), hashed passwords, access controls and reputable providers. No system is perfectly secure; we will notify you and the Regulator of any breach as POPIA requires.