Privacy Policy (POPIA)

Last updated: 19 August 2026

Polyroads (Pty) Ltd ("Polyroads", "we", "us") respects your privacy and handles your personal information in line with South Africa's Protection of Personal Information Act (POPIA). This policy explains what we collect, why, who we share it with, and your rights.

Who we are

• Responsible party: Polyroads (Pty) Ltd (Reg no. 2009/017412/07)
• Address: 3/4 Coppel Road, Alrode South, Alberton, 1451
• Information Officer / contact for privacy matters: shop@polyroads.com

What we collect

When you shop with us, browse our store, or contact us, we may collect:

• Contact & delivery details: name, email, phone number, delivery/billing address.
• Order details: the products you buy and your order history.
• Payment information: processed securely by our payment provider, PayFast. We do not see or store your full card details.
• Website and device data: information your browser sends (such as IP address, device and browser type, referring website), the pages and products you view, items you add to your cart, and whether you complete a purchase. This is collected through cookies and similar technologies, including advertising pixels — see Cookies and tracking below.

Why we use it

• To process, deliver and support your orders.
• To arrange courier delivery (we share your name, address and phone number with our courier partner, Bob Go / the delivering courier, for this purpose only).
• To communicate with you about your order, and — only if you opt in — to send you occasional updates or offers.
• To measure how our advertising performs, and to show you relevant advertising on Facebook and Instagram. This happens only where you have accepted non-essential cookies.
• To meet our legal, tax and accounting obligations.

Who we share it with

We share personal information only with the parties needed to run the store and, where you have consented, to advertise it:

• PayFast — payment processing.
• Bob Go and the courier delivering your order — delivery.
• Shopify — our e-commerce platform, which hosts the store and processes orders on our behalf.
• Meta Platforms, Inc. and Meta Platforms Ireland Limited ("Meta") — the operators of Facebook and Instagram. Where you have accepted non-essential cookies, we share information about your activity on our store with Meta so that we can measure our advertising and show you relevant ads. This may include the pages and products you viewed, items added to your cart, purchases and order value, your IP address and device information, and — in encrypted (hashed) form — your email address and phone number. Meta uses this information in line with its own Data Policy and its Business Tools Terms.

Each of these parties processes your data under their own privacy terms. We do not sell your personal information.

Cookies and tracking

Our store uses cookies and similar technologies for three purposes:

• Essential — to keep your cart working, keep you signed in, and process your order. These cannot be switched off without breaking the store.
• Analytics — to understand how the store is used so we can improve it.
• Advertising — including the Meta pixel and Meta's Conversions API, which tell us which of our Facebook and Instagram ads led to a visit or a sale, and allow Meta to show our ads to people likely to be interested.

Analytics and advertising cookies are only used if you accept them on the cookie banner shown when you first visit the store. You can change your choice at any time through the cookie preferences link in our store footer, or through your browser settings.

You can also limit or opt out of Meta's use of your information directly:

• Facebook and Instagram → Settings → Ads → Ad preferences
• Your device's advertising settings (iOS App Tracking Transparency, Android Ads settings)

Declining advertising cookies will not affect your ability to shop with us.

Sending information outside South Africa

Some of the parties above process information outside South Africa — in particular Meta, which processes data in Ireland and the United States, and Shopify, which operates internationally.

As required by section 72 of POPIA, we transfer personal information across borders only where the recipient is subject to laws, binding corporate rules or a written agreement that provide an adequate level of protection comparable to POPIA, or where you have consented to the transfer. Meta and Shopify each commit contractually to protecting the information they receive from us and to processing it only for the purposes we have set out.

Direct marketing

We will only send you marketing emails or messages if you have opted in — for example by ticking the newsletter box at checkout or on our sign-up form. We do not pre-tick that box.

Every marketing message includes an unsubscribe link, and you can also email shop@polyroads.com at any time to be removed. Withdrawing marketing consent does not affect emails about an order you have placed.

Advertising you see on Facebook or Instagram is not direct marketing to you personally — it is targeted by Meta based on the cookie preferences described above, and you control it through those settings.

How long we keep it

We keep your information only as long as needed for the purpose it was collected, or as required by law (for example, tax records must be kept for a set period). Advertising and analytics data collected through cookies is retained for a limited period in line with the settings of the platforms concerned.

Security

We take reasonable technical and organisational steps to protect your information. Our store runs on Shopify with secure (HTTPS) connections, payments are handled by PayFast's secure gateway, and any customer identifiers shared with Meta are encrypted (hashed) before they leave our systems.

Your rights under POPIA

You have the right to:

• Ask what personal information we hold about you, and request a copy.
• Correct or update it.
• Object to the processing of your information, and withdraw consent for marketing or for advertising cookies, at any time.
• Request deletion of your information, where we're not required by law to keep it.
• Complain to the Information Regulator (South Africa) if you believe we've mishandled your data — enquiries@inforegulator.org.za.

To exercise any of these, email us at shop@polyroads.com.

Changes

We may update this policy from time to time — for example when we add a new service provider or advertising platform. The latest version will always be on this page, with the date it was last updated at the top.