This Privacy Policy describes how KritKrats ("we", "us", "our") collects, uses and shares your personal information when you visit kritkrats.co.za (the "Site"), make a purchase, or otherwise communicate with us (collectively, the "Services"). By using the Services, you agree to the collection, use and disclosure of your information as described here. If you do not agree with this Privacy Policy, please do not use the Services. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") of South Africa.

The information we collect depends on how you interact with us. Information you give us directly includes: basic contact details (your name, email address, phone number), order information (billing and shipping address, what you ordered, payment confirmation), and any messages you send us through the contact form or by email. Information we collect automatically when you use the Site includes usage data such as your device and browser type, IP address, pages visited and how you interact with the Site — collected through cookies and similar technologies. Information we receive from third parties includes payment status from our payment processors and delivery updates from our couriers.

We use your personal information to: process and deliver your orders and send you order-related updates; respond to your questions and provide customer support; send you marketing emails (only where you have opted in — you can unsubscribe at any time); improve and optimise the Site and our products; and detect, prevent and investigate fraud or other illegal activity. We do not use your information to make automated decisions about you.

Like most websites, we use cookies and similar technologies to run the Site, remember your preferences and understand how the Site is used. We also use the Meta Pixel (from Facebook/Instagram's parent company, Meta) to measure how our ads perform and to show you more relevant advertising on Meta platforms. This means information about your visit may be shared with Meta in accordance with Meta's own privacy policy. Most browsers accept cookies by default, but you can set your browser to refuse or delete them — some parts of the Site may then not work as intended. You can also opt out of personalised advertising through your Meta account settings.

We share personal information only where needed to run the business, including with: systeme.io (the platform that hosts our store), our payment processors (to securely process your payment — we never see or store your full card details), our couriers (to deliver your order), Meta (for advertising measurement, as described above), and our email service provider (Zoho Mail, for order and support emails). We may also disclose information where the law requires it, or to protect our rights. We do not sell your personal information to anyone.

We keep your personal information only for as long as we need it: to fulfil your orders, maintain our business records, comply with legal obligations (such as tax law, which requires us to keep transaction records for several years), resolve disputes and enforce our agreements. When we no longer need the information, we delete or anonymise it.

We take reasonable technical and organisational measures to protect your personal information against loss, misuse and unauthorised access. Our store runs over HTTPS and payments are processed by PCI-compliant payment providers. That said, no security measures are perfect, and we cannot guarantee absolute security — please avoid sending sensitive information over unsecure channels.

KritKrats kits are bought by adults, for kids to enjoy. The Site and Services are intended for users aged 18 and older, and we do not knowingly collect personal information directly from children. If you believe a child has provided us with personal information, contact us at info@kritkrats.co.za and we will delete it.

Under POPIA you have the right to: request access to the personal information we hold about you; ask us to correct or delete your personal information; object to or restrict certain processing; withdraw consent where processing is based on consent (for example, marketing emails); and lodge a complaint with the Information Regulator of South Africa if you are unhappy with how we handle your information. To exercise any of these rights, email us at info@kritkrats.co.za. We will not discriminate against you for exercising your rights, and we may need to verify your identity before acting on a request.

The Site may contain links to websites or platforms operated by third parties (for example, our social media pages). If you follow those links, please review their privacy policies — we are not responsible for the privacy or security practices of third-party sites, and our linking to them is not an endorsement.

Some of our service providers (such as systeme.io and Meta) process information outside South Africa. Where your information is transferred internationally, we take reasonable steps to ensure it remains protected to a standard comparable to POPIA.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. The current version will always be posted on this page with the "Last updated" date above. Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.

Questions about this Privacy Policy or our privacy practices, or requests to exercise your rights, can be sent to info@kritkrats.co.za. If the KritKrats don't take over our warehouse, we reply same or next business day.