Privacy Policy

1. Who We Are (Responsible Party)

My Toy Box (Pty) Ltd (Reg. No. 2026/410428/07) is the Responsible Party as defined under POPIA. We determine the purpose and means of processing your personal information.

2. What Personal Information We Collect

We collect personal information that you provide to us directly when you:

• Place an order (name, delivery address, email address, phone number)
• Create an account on our website
• Subscribe to our newsletter
• Contact us by email, WhatsApp, or through our website
• Enter a competition or promotion

We may also collect the following information automatically when you use our website:

• IP address and browser type
• Pages visited and time spent on our website
• Referring website or search terms used to find us
• Device type and operating system

We do not collect sensitive personal information as defined in POPIA, and we do not collect the personal information of children directly. Orders for products intended for children are placed by adults.

3. Why We Collect Your Personal Information

We process your personal information only for lawful, specific, and clearly defined purposes, including:

• Processing and fulfilling your orders
• Communicating with you about your orders, deliveries, and any issues that arise
• Sending you transactional emails (order confirmations, dispatch notifications)
• Sending you marketing communications, if you have opted in
• Improving our website and customer experience
• Complying with our legal obligations
• Preventing fraud and ensuring the security of our website and transactions

4. Legal Basis for Processing

We process your personal information on one or more of the following lawful grounds:

• Contractual necessity , processing is necessary to fulfil your order and the contract between us
• Legitimate interest , to improve our service, prevent fraud, and communicate with existing customers
• Consent , for marketing communications, where you have given explicit opt-in consent
• Legal obligation , where we are required by law to process your information

5. How We Share Your Personal Information

We do not sell, rent, or trade your personal information to third parties. We share your personal information only where necessary, with:

• Our courier partners (name, delivery address, and contact number to enable delivery)
• PayFast , our payment gateway , for the purpose of processing payment securely. PayFast processes your payment details in accordance with PCI DSS standards. We do not store, process, or have access to your card details at any point
• Our email marketing platform (MailerLite) for sending communications you have consented to
• Our web hosting and analytics providers, subject to appropriate data processing agreements
• Law enforcement or regulatory authorities, where required by law

All third parties with whom we share your personal information are required to handle it securely and in accordance with POPIA and applicable data protection laws.

6. How Long We Keep Your Personal Information

We retain your personal information only for as long as necessary for the purposes for which it was collected, or as required by law:

• Order and transaction records: 5 years (for tax and legal compliance)
• Customer account data: for the duration of the account, plus 2 years after closure
• Marketing communications data: until you unsubscribe or withdraw consent
• Website analytics data: 26 months

7. Security of Your Personal Information

We take the security of your personal information seriously. Our website is built and maintained by a certified Cloud and Solutions Architect and Cybersecurity professional. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration.

Payment processing is handled exclusively by PayFast, a leading South African payment processor. PayFast is PCI DSS compliant. We do not store, process, or have access to your card details at any point.

Despite our best efforts, no transmission of data over the internet can be guaranteed to be completely secure. If you believe your personal information has been compromised, please contact us immediately at hello@mytoybox.co.za.

8. Your Rights Under POPIA

You have the following rights regarding your personal information:

• The right to be notified that your personal information is being collected
• The right to access your personal information that we hold
• The right to request correction of inaccurate or incomplete personal information
• The right to request deletion of your personal information, subject to our legal obligations
• The right to object to the processing of your personal information
• The right to withdraw your consent to marketing communications at any time
• The right to lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact our Information Officer at hello@mytoybox.co.za. We will respond within a reasonable time and in accordance with POPIA requirements.

9. Marketing Communications

We will only send you marketing emails and newsletters if you have explicitly opted in to receive them. You can unsubscribe at any time by clicking the unsubscribe link in any of our emails, or by emailing hello@mytoybox.co.za.

Withdrawing consent to marketing will not affect the lawfulness of any processing carried out before your withdrawal, and will not prevent us from sending you transactional communications related to an active order.

10. PayFast & Payment Processing

All payments on our website are processed by PayFast (Pty) Ltd, a leading South African payment service provider. PayFast is registered with the South African Reserve Bank and is PCI DSS Level 1 certified.

When you make a payment on our website, you will be redirected to PayFast's secure payment environment. Your payment details are collected and processed directly by PayFast and are never stored on our servers or accessible to us.

PayFast's own Privacy Policy governs the processing of your payment information. You can view PayFast's Privacy Policy at www.payfast.co.za/privacy-policy.

Accepted payment methods through PayFast include all major credit and debit cards (Visa, Mastercard), and Instant EFT.

11. Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have processed your personal information unlawfully:

• Website: www.justice.gov.za/inforeg
• Email: inforeg@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of any material changes by posting the updated policy on our website with a revised effective date. Your continued use of our website after such changes constitutes your acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information, please contact our Information Officer:

• Email: hello@mytoybox.co.za
• Website: www.mytoybox.co.za/get-in-touch
• WhatsApp: +27 61 695 5963