Privacy policy
Kanoodle Privacy Policy
Last updated: 27 July 2026
This Privacy Policy explains how Kanoodle (“Kanoodle”, “we”, “us”, “our”) collects, uses, stores, shares, and protects your personal information when you visit our website (www.kanoodle.co.za), create an account, or purchase products from us. It is issued in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and, where relevant, the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”) and the Consumer Protection Act 68 of 2008 (“CPA”). This policy forms part of the Kanoodle Comprehensive Website Policies.
By using our website or providing us with your personal information, you agree to the collection and use of your information as described in this Policy. If you do not agree, please do not use our website or services.
1. Who We Are — Responsible Party
Kanoodle (Pty) Ltd (registration number 2025/824739/07) is the “Responsible Party” as defined in POPIA. Our physical address is 11 Fick Street, Potchefstroom, 2531.
2. Personal Information We Collect
We collect personal information that you voluntarily provide, and information generated automatically when you use our website:
• Identity and contact details: Full name, email address, phone number, delivery and billing address.
• Account information: Username, password (stored in encrypted/hashed form), order history, wish lists, loyalty points.
• Payment information: Processed via our third-party payment gateway; Kanoodle does not store full card numbers on its own servers.
• Transaction information: Products purchased, order value, promotional codes used, returns, and complaints.
• Technical information: IP address, browser type, device information, and cookies (see our Cookie Policy below).
• Marketing preferences: Whether you have opted in or out of receiving marketing communications.
• Special personal information: Where you voluntarily disclose skin type, allergies, or sensitivities to help us recommend products, this is treated with heightened care under POPIA and is used solely for that purpose, with your explicit consent.
3. Why We Process Your Information (Lawful Basis)
In line with POPIA’s processing conditions, we only collect information that is adequate, relevant, and not excessive, and we process it for the following purposes:
• To process, fulfil, and deliver your orders, and to communicate with you about them.
• To create and manage your online account.
• To process payments and prevent fraud.
• To provide customer support and respond to queries or complaints.
• To send you direct marketing, but only where you have given prior, specific consent as required by section 69 of POPIA (see clause 6 below). You may withdraw this consent at any time.
• To comply with our legal, tax, and accounting obligations.
• To improve our website, products, and services, including through analytics.
• To protect the rights, property, and safety of Kanoodle, our customers, and the public.
4. Sharing of Your Information
We do not sell your personal information. We may share it, under appropriate contractual safeguards (operator agreements as required by POPIA), with:
• Courier and delivery partners, to fulfil your order.
• Payment gateway providers, to process payments securely.
• Our e-commerce platform, hosting, and IT service providers.
• Professional advisors (auditors, lawyers) where necessary.
• Regulators or law enforcement, where required by law.
• A prospective buyer, in the event of a sale or restructuring of our business, subject to confidentiality safeguards.
Where any service provider is located outside South Africa, we ensure the transfer complies with section 72 of POPIA (i.e., the recipient is subject to laws, binding agreements, or codes of conduct that provide an adequate level of data protection).
5. Cookies and Similar Technologies
Our website uses cookies and similar tracking technologies to make the site function properly, remember your preferences, and understand how visitors use our site (analytics). You can control or disable cookies through your browser settings; please note that disabling essential cookies may affect the functionality of the site. Where required, we will present a cookie banner allowing you to accept or decline non-essential cookies before they are set.
6. Direct Marketing
We will only send you marketing communications (email, SMS, WhatsApp, etc.) if you have opted in. You may unsubscribe at any time using the link provided in each communication, or by emailing us.
7. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law (for example, financial records must generally be retained for five years under South African tax and companies legislation). Once no longer needed, information is securely deleted or anonymised.
8. Security of Your Information
We implement appropriate technical and organisational measures — including encryption in transit, restricted access controls, and secure hosting — to protect your personal information against loss, unauthorised access, alteration, or disclosure, as required by section 19 of POPIA. In the event of a data breach that compromises your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA.
9. Your Rights as a Data Subject
Under POPIA, you have the right to:
• Be notified that your personal information is being collected.
• Access the personal information we hold about you.
• Request correction, updating, or deletion of your personal information.
• Object, on reasonable grounds, to the processing of your personal information.
• Withdraw consent to processing (including marketing) at any time.
• Complain to the Information Regulator if you believe your information has been processed unlawfully.
Information Regulator Contact Details: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 | Email: complaints.IR@justice.gov.za | Website: www.justice.gov.za/inforeg/
10. Children’s Information
Our products and website are not directed at children under the age of 18. We do not knowingly collect personal information from children without the consent of a parent or legal guardian, as required by POPIA.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The updated version will be posted on this page with a revised “last updated” date. Please check back periodically.
