BLOSSOM BLOOM FRAGRANCES – PRIVACY POLICY

Last Updated: 25 August 2025

1. INTRODUCTION

Blossom Bloom Fragrances (“Company,” “we,” “us,” or “our”) is committed to protecting your privacy and complying with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African privacy laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website (https://blossombloom.co.za/), make purchases online, visit our physical store, or interact with our services.

By using our website, services, or providing us with your personal information, you consent to the practices described in this Privacy Policy.

2. DEFINITIONS

For purposes of this Privacy Policy:

• “Personal Information” means information relating to an identifiable, living, natural person as defined under POPIA
• “Processing” includes any operation performed on personal information, including collection, storage, use, and disclosure
• “Data Subject” means the person to whom personal information relates (you, the customer)

3. INFORMATION WE COLLECT

3.1 Personal Information Collected

Online Orders:

• Full name
• Email address
• Phone number
• Delivery address
• Order history and preferences

In-Store Purchases:

• Personal information is collected only when placing orders that require delivery
• Same basic information as online orders when applicable
• Point-of-sale transactions may not require personal information collection

Website Usage:

• IP address and browser information
• Website usage patterns and preferences
• Cookie data and tracking information

3.2 Automatic Information Collection

We use the following technologies to automatically collect information:

• Google Analytics: To understand website traffic and user behaviour
• Cookies: To enhance website functionality and user experience
• Social Media Integration: Through Facebook, Instagram, and Google My Business connections

4. HOW WE USE YOUR INFORMATION

4.1 Lawful Basis for Processing

We process your personal information based on the following lawful grounds under POPIA:

• Consent: When you voluntarily provide information or agree to marketing communications
• Contract Performance: To fulfil orders and provide customer service
• Legitimate Interest: For business operations, fraud prevention, and website improvement
• Legal Compliance: When required by South African law

4.2 Purposes of Processing

Your personal information is used for:

• Processing and fulfilling orders
• Communicating about orders, deliveries, and customer service
• Providing customer support and responding to inquiries
• Improving our website, products, and services
• Sending promotional marketing communications (with consent)
• Complying with legal and regulatory requirements
• Fraud prevention and security purposes
• Website analytics and optimisation

5. INFORMATION SHARING AND DISCLOSURE

5.1 Third-Party Service Providers

We share your personal information only with trusted third parties necessary for our business operations:

Payment Processing:

• PayFast processes all payment transactions securely
• We do not store or have access to your payment card details

Delivery Services:

• PUDO (locker-to-locker service)
• The Courier Guy (door-to-door delivery)
• Only delivery-relevant information is shared

Technology Services:

• Google Analytics and Google Search Console for website analytics
• Social media platforms (Facebook, Instagram) for business presence
• WhatsApp Business for customer communication

5.2 Legal Disclosure

We may disclose your personal information when:

• Required by South African law or legal process
• Necessary to protect our rights, property, or safety
• Required to comply with court orders or government requests
• Necessary to prevent fraud or illegal activities

5.3 Business Transfers

In the event of a merger, acquisition, or sale of business assets, customer information may be transferred as part of the transaction, subject to confidentiality obligations.

6. DATA RETENTION

6.1 Retention Period

We retain your personal information for:

• Customer Records: Up to 5 years from last transaction or as required by law
• Marketing Communications: Until you opt-out or withdraw consent
• Website Analytics: As determined by Google Analytics settings
• Legal Requirements: As mandated by applicable South African laws

6.2 Deletion of Information

Personal information is securely deleted or anonymised when retention periods expire, unless legal obligations require longer retention.

7. DATA SECURITY

7.1 Security Measures

We implement appropriate technical and organisational measures to protect your personal information:

• SSL encryption for website data transmission
• Two-factor authentication (2FA) for system access
• Secure payment processing through PayFast
• Regular security assessments and updates
• Access controls and staff training

7.2 Limitation of Security

While we strive to protect your personal information, no internet transmission or electronic storage method is completely secure. We cannot guarantee absolute security but maintain industry-standard protections.

8. YOUR RIGHTS UNDER POPIA

As a data subject, you have the following rights:

8.1 Right to Access

• Request confirmation of personal information processing
• Access your personal information held by us

8.2 Right to Correction

• Request correction of inaccurate or incomplete personal information

8.3 Right to Deletion

• Request deletion of personal information in certain circumstances

8.4 Right to Object

• Object to processing based on legitimate interests
• Opt-out of direct marketing communications

8.5 Right to Restrict Processing

• Request restriction of processing in specific situations

8.6 Right to Data Portability

• Receive your personal information in a structured format

9. MARKETING COMMUNICATIONS

9.1 Consent and Opt-In

• Marketing emails require your explicit consent
• You may receive promotional communications based on your purchase history

9.2 Opt-Out Procedures

• Unsubscribe links in all marketing emails
• Contact us directly to opt-out: info@blossombloom.co.za
• Phone: 072 345 2186

9.3 Communication Methods

• Email marketing communications
• WhatsApp Business messages (with consent)
• Social media interactions on our business pages

10. COOKIES AND TRACKING

10.1 Cookie Usage

We use cookies for:

• Website functionality and user preferences
• Analytics and performance monitoring
• Social media integration
• Marketing and advertising optimisation

10.2 Cookie Management

You can control cookies through your browser settings, though disabling cookies may affect website functionality.

11. INTERNATIONAL TRANSFERS

Currently, we do not transfer personal information outside South Africa, except through third-party services (Google, Facebook) which have their own international data handling practices.

12. CHILDREN’S PRIVACY

We do not knowingly collect personal information from children under 18. Our services are intended for adults. If we become aware of collecting information from minors, we will delete such information promptly.

13. CHANGES TO THIS PRIVACY POLICY

13.1 Policy Updates

We reserve the right to modify this Privacy Policy at any time. Changes will be posted on our website with an updated “Last Updated” date.

13.2 Notification of Changes

Significant changes will be communicated through:

• Website notifications
• Email communications to registered customers
• Social media announcements where appropriate

14. COMPLAINTS AND CONTACT

14.1 Privacy Concerns

For privacy-related questions, concerns, or to exercise your rights under POPIA, contact:

Blossom Bloom Fragrances
Email: info@blossombloom.co.za
Phone: 072 345 2186
Location: Shelly Centre, KwaZulu-Natal, South Africa

14.2 Information Regulator

If you are unsatisfied with our response to privacy concerns, you may lodge a complaint with the Information Regulator of South Africa:

• Website: www.justice.gov.za/inforeg
• Email: inforeg@justice.gov.za

15. GOVERNING LAW

This Privacy Policy is governed by the laws of the Republic of South Africa, including POPIA and other applicable privacy legislation.

---

This Privacy Policy should be read in conjunction with our Terms & Conditions, Refund Policy, and Disclaimer.