Privacy Policy
Last updated 5 November 2026
Who we are
Flowers in the Foyer CC (registration 2005/109746/23), 44 Ryneveld Street, Stellenbosch, 7600 · PO Box 7540, Stellenbosch, 7599 · info@flowersinthefoyer.co.za · +27 (0)21 887 8138.
We are the "responsible party" for the personal information described here.
Information Officer: Hermien Coetzee — hermien@flowersinthefoyer.co.za, or write to the postal address above, marked "Information Officer".
Our Information Officer, Hermien Coetzee, is registered with the Information Regulator.
What we collect, and why
| When you… | We collect | Why |
|---|---|---|
| Order (checkout or "Order flowers") | Your name, email and phone number | To take payment, send your confirmation, and contact you about the order |
| The recipient's (or collector's) name, phone number, delivery address, and any note for the driver (e.g. a unit number or gate code) | To deliver the flowers, or hand them over at the shop | |
| Your card message, and any note about the occasion or the recipient's preferences | So the florist can write the card and make the arrangement | |
| What you ordered, the delivery date, the road distance and delivery fee, discount code and total | To make and deliver the order, and for our accounting and tax records | |
| Create or use an account | Email, password (stored only in scrambled, "hashed" form), name, phone, saved addresses | To let you sign in, reuse addresses and see past orders |
| Send us an enquiry (contact form) | First and last name, email, phone number, type of enquiry, an event date if you give one, your message | To answer you. Wedding, corporate event and private celebration enquiries go to our events team |
| Make a cookie choice | A random identifier, what you chose and when — nothing that identifies you | Proof of your consent (see §7) |
| Visit the site | Your internet (IP) address, browser type and the pages requested, in our server logs | To keep the site running and secure, e.g. to limit abuse |
- Information about someone else. When you send flowers, you give us the recipient's details. We use them only to deliver that order — never for marketing. Please only give us details you are entitled to share.
- Required or optional. Name, email and phone, and the recipient's name, phone and address, are needed to place an order: without them we cannot take payment or deliver. Notes, card messages and saved addresses are optional.
- Customers of our previous website. If you bought from our previous online shop, your customer details and order history moved with us to this shop: your name, email address, phone number, the addresses you used, and the orders you placed there (what you bought, when, delivery details and card messages). Your password did not move: to use an account here, choose "Forgot password" and set a new one with the same email address. We use this history to recognise you as a returning customer and to answer questions about past orders. We will send you one email asking whether you would like to hear from us about our flowers and gifts; we email you about them only if you say yes (see "Emails about our flowers and gifts" below). To ask us to delete your old account and order history, write to our Information Officer (§1): we will delete it, except the sale records the tax laws require us to keep (§6).
- Laws that require it. We keep records of sales for at least five years, as the Value-Added Tax Act 89 of 1991 (section 55) and the Tax Administration Act 28 of 2011 (section 29) require.
- Emails about our flowers and gifts — only if you agree.
- Customers of our previous website receive one email from us asking whether they would like to hear from us about our flowers, gifts and services (POPIA section 69(2)). Only those who say yes receive these emails; anyone who does not answer, or says no, is not asked again.
- Customers of this shop receive these emails only once our checkout lets you say no when you order; until then we send none. After that, we may email customers who did not say no about our own flowers, gifts and services similar to what they bought (POPIA section 69(3)).
- Every such email has an unsubscribe link, and you can also opt out at any time, free of charge, by emailing hermien@flowersinthefoyer.co.za. When you opt out we stop, and we keep your email address only on a list of people we must not email, so that it stays that way.
- We never send marketing to the people you send flowers to, we do not send marketing by SMS or phone call, and we do not sell, rent or share personal information for anyone else's marketing. Anyone else receives marketing from us only if they ask for it.
- No automated decisions. Delivery fees are set by road distance; nothing is decided about you by a computer in a way that affects you.
Who else processes it for us
We use these service providers ("operators"), each only for the job described:
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Payfast by Network | Takes card and other payments on its own pages | Your name and email, the order amount, an order reference and the product names | Card payments are processed by Payfast by Network on its own secure pages; your card details never reach us. Payfast's privacy policy explains how it handles your information. |
| Xneelo | Hosts our server, where the shop and its database run | Everything stored on the site | South Africa |
| Microsoft 365 | Sends and stores our email: order confirmations, the order sheet for our florists, enquiries, account emails | Order and enquiry details, including recipient details and card messages | Our email runs on Microsoft 365. Microsoft may store email data in South Africa or other countries, under its own privacy terms. |
| Klaviyo | Sends our emails about flowers and gifts — the one request to the previous website's customers, and marketing only to customers who have agreed (§2) — and handles unsubscribes | Your name and email address, what you bought and when, and whether you have unsubscribed — never the recipient's details or card messages | United States (Klaviyo stores customer data with Amazon Web Services in the US) |
| Amazon Web Services | Stores our encrypted nightly backups | The whole database, encrypted before it leaves our server — AWS cannot read it | South Africa (Cape Town region) |
| Google Analytics | Statistics about how the site is used — only if you agree | See §7. Never your name, email, phone or address | Outside South Africa |
| Google Maps | Suggests addresses as you type a delivery address; and, asked by our server, works out the road distance from our shop to the address you choose, to price the delivery | What you type, and your IP address (address suggestions, from your browser); a Google reference to the chosen address (distance, from our server — no name, phone or other detail about you). We keep the distance for an address for 30 days so we need not ask again | Outside South Africa |
Our own staff see orders and enquiries to do their work, and our own driver delivers every order — we do not pass delivery details to a courier. (If that ever changes, for example a delivery service such as Uber, this policy will name it first.) We may also disclose information where the law requires it.
Information sent outside South Africa (Google, Klaviyo, and possibly Microsoft): each of these providers processes it under a written data processing agreement with us that binds it to protect the information, and is subject to data-protection laws that give protection comparable to POPIA (section 72).
Links to other services
Our WhatsApp button and our Instagram and Facebook links take you to those services, which have their own policies. Nothing is loaded from them until you click.
How we protect it
- The whole site is served over an encrypted connection (HTTPS).
- We never see or store card details — payment happens on PayFast's pages.
- Passwords are stored only in hashed form. Password-reset links are single-use and expire after an hour.
- The database is not reachable from the internet; the server's firewall allows only web traffic and administration access. Only the shop's administrator can sign in to the shop's back office.
- Backups are encrypted before they leave our server.
- We limit how often forms can be used, to stop abuse.
If we learn that personal information has been accessed without authority, we will tell the Information Regulator and the people affected, as POPIA requires (section 22).
How long we keep it
| Information | Kept for |
|---|---|
| Orders and the details on them (incl. the previous website's orders) | We keep sale records for at least five years, as tax law requires. Your order history stays linked to your customer record so we can show your past orders, until you ask us to delete it, except records the law requires us to keep. |
| Your account | Until you ask us to close it |
| Your email address for our emails about flowers and gifts (only if you agreed) | Until you unsubscribe; after that only on our do-not-email list (§2) |
| Contact-form enquiries | 12 months, then deleted automatically |
| Records of your cookie choice | 24 months, then deleted automatically |
| Google Analytics data | GA4 data is kept for 14 months |
| Server logs (which record IP addresses) | Web server logs are kept for 14 days; logs and backup copies are kept for up to about 13 months. |
| Backups | Up to about 13 months; a deleted record disappears from backups as they expire. |
Changing Your Cookie Choice
You can change your choice at any time, using “Cookie settings” at the foot of our pages or the button below. If you withdraw your consent, Google Analytics stops straight away and its cookies are deleted from your browser.
Your rights
Under POPIA you may:
- ask whether we hold information about you, and for a copy of it;
- ask us to correct or delete it, or to stop using it (to object), where the law allows;
- unsubscribe from our emails about flowers and gifts at any time, free of charge (§2);
- withdraw consent you have given, such as for analytics or marketing cookies (see §8);
- complain to the Information Regulator.
Signed in, you can update your name, phone and addresses yourself under Account. For anything else, contact our Information Officer (§1). We may need to confirm who you are first. We will answer within 30 days. Requests for access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA) may also be made to our Information Officer, using the request forms the Information Regulator publishes.
The Information Regulator (South Africa) — Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · PO Box 31533, Braamfontein, Johannesburg, 2017 · enquiries@inforegulator.org.za · +27 (0)10 023 5200 · complaints can be lodged through www.inforegulator.org.za.
Changes to this policy
We will post any change here, with a new date.