Who we are
nawtyshop is a trading name of WEBAFY (PTY) LTD. We are the responsible party for your personal information under the Protection of Personal Information Act (POPIA).
Our Information Officer is the person responsible for POPIA compliance at WEBAFY (PTY) LTD. You can reach them at nawtyyshop@gmail.com.
What we collect and why
| Information | Why we need it |
|---|---|
| Name, email address and phone number | To process your order and contact you about it |
| Delivery address | To deliver your order |
| What you ordered | To fulfil, support and, if needed, refund your order |
| Proof of payment you upload | To match your EFT to your order |
| Your acceptance of our terms, with the date, time, notice version and a scrambled (hashed) version of your IP address | To show what you agreed to and when |
| Your email address, if you ask to hear about new arrivals, offers or restocks | To send you only what you asked for |
We do not store card details. You pay by EFT through your own bank.
Special personal information
What you buy from us could reveal information about your sex life, which POPIA treats as special personal information. We only process it with your explicit consent, which you give with a separate tick box at checkout, and only to fulfil and support your order.
Who we share it with
We share only what each service needs to do its job:
- The supplier that sends your order: we do not keep stock, so your order is dropshipped. We give the supplier your name, delivery address and phone number so they can send the parcel to you. The courier they use receives the same details.
- The courier delivering your parcel: your name, phone number and delivery address, never what is in the parcel.
- Hosting and database providers that store our website and order records.
- Our email provider (Google Mail), which carries the order emails we send and the proof-of-payment emails you send us.
We never sell your information, and we do not use advertising pixels, retargeting or tracking cookies.
Where it is stored
Our website and database are hosted in the European Union (Frankfurt, Germany), which has data protection laws that give at least the same protection as POPIA.
Some of our suppliers may be outside South Africa. When your order is sent to such a supplier, your delivery details leave South Africa. We do this only because it is necessary to deliver the order you asked for, and we send only your name, delivery address and phone number. We choose suppliers that need nothing more than that, and we do not send them your payment details.
Suppliers and couriers keep their own delivery records under their own privacy policies. Once your order has been delivered, we cannot delete what they hold, but we can ask them to.
How long we keep it
- Delivery address and phone number: anonymised 90 days after delivery. For an order that expired or was cancelled, anonymised 90 days after it closed.
- Proof of payment: deleted 90 days after the payment is verified. A proof that was never verified, because the order expired or was cancelled, is deleted 90 days after you uploaded it.
- Order and payment records: kept for five years, as South African tax law requires.
- Marketing emails: until you unsubscribe.
Cookies and your device
We use a small number of cookies and on-device settings, all essential to how the site works:
- Age check: remembers that you confirmed you are 18 or over.
- Theme and Discreet Mode: remembers your light, dark and Discreet Mode choices. These stay on your device and are never sent to us.
If we measure visits, we use privacy-friendly analytics that do not use cookies or identify you.
Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy
- correct or update it
- delete it, where we are not legally required to keep it
- stop sending you marketing, at any time, using the unsubscribe link in any email
Email our Information Officer at nawtyyshop@gmail.com. We will respond within 30 days.
If you are not happy with how we handled your information, you can complain to the Information Regulator at inforegulator.org.za.
Security
All traffic to our site is encrypted. Order records are locked down so that only authorised staff can see them, and we keep a log of administrative actions.
Age
Our store is for adults only. We do not knowingly collect information from anyone under 18.
Changes
If we change this policy, we update the version number and date at the top of this page.