Privacy policy
Last updated: 19 October 2026
The short version: we only collect what we need to make and deliver your cups, answer your messages and show reviews. We share it only with the services that make that possible (PayFast, The Courier Guy, our email provider and our website host), we never sell it, and you can ask to see, correct or delete it at any time.
1. Who is responsible for your information
Dandelion Dust Creations is the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is the owner, Marianne Pheiffer. You can reach her at [email protected].
You can also reach the Information Officer through the contact form.
2. What we collect
| When | What we collect |
|---|---|
| You place an order | First name, surname, email address, cell number, delivery address (street, suburb, city, postal code, province, home or business), any delivery instructions for the courier, any note you leave for Marianne, what you ordered, the order number and payment status. |
| You pay | PayFast collects your payment details directly on its own secure page. We only receive confirmation of the payment (for example the amount, status and PayFast’s reference), never your card number. |
| You leave a review | Name, email address, optional order number, star rating and review text. |
| You send a message | Name, email address, optional cell number and your message. |
| You use the website | Technical information needed to run and protect the site, such as your IP address, browser type and security-check signals from Cloudflare Turnstile, which helps keep out spam bots. |
| On your own device | Your cart is saved in your browser’s local storage, and the details you type at checkout are kept in session storage until you close the tab, so you do not lose them. This stays on your device and is not sent to us until you check out. |
We do not use advertising or tracking cookies.
3. Why we use it
- To make, deliver and support your order, and to send you order and delivery updates.
- To take payment safely and prevent fraud.
- To reply to your messages and design custom decals with you.
- To publish reviews (only your name, rating and review text are shown; your email and order number are never shown) and to mark reviews from real buyers as verified.
- To keep the website secure and free of spam.
- To keep the records the law requires, for example for tax.
We rely on these lawful grounds under section 11 of POPIA: carrying out our contract with you, our legal obligations, our legitimate interest in running a safe shop, and your consent (for example for reviews). We will only send you marketing if you ask for it, and you can opt out at any time.
4. Who we share it with
We only share what each service needs to do its job, and we never sell your information.
- PayFast (payment processing): your name, email address, cell number, the order number, a short description of what you ordered and the amount, so you can pay securely.
- The Courier Guy (delivery): your name, cell number, email address, delivery address or chosen Pudo locker, and any delivery instructions you give for the courier (for example a gate code), so your cups reach you and, for a locker, so you can be sent the collection PIN. A note you leave for Marianne is not shared with the courier.
- Our email provider (order confirmations and replies to your messages): your name, email address and the content of the email. We send email through Resend.
- GoDaddy (website hosting): the website, the order system and its database run on GoDaddy’s servers in the EU, so order, review and contact-form information is stored there, and the servers briefly log technical details such as your IP address.
- Cloudflare (security and speed, and the Turnstile check): every visit to the website passes through Cloudflare’s network, which protects the site from attacks and spam bots and briefly processes technical details such as your IP address.
- Authorities, if the law requires us to.
Some of these providers may store or process information outside South Africa. Where they do, we rely on them to protect it to a standard similar to POPIA, as section 72 of POPIA requires.
5. How long we keep it
- Order and payment records: 5 years after the order, because tax law requires it.
- Messages from the contact form: up to 12 months after our last conversation, unless they relate to an order.
- Reviews: for as long as the review is shown on the website. You can ask us to remove yours at any time.
- Technical and security logs: kept only briefly by our hosting provider.
6. How we protect it
The website uses HTTPS encryption. Card payments happen on PayFast’s secure page. Access to order information is limited to the owner, and we use reputable providers with strong security.
7. Your rights
Under POPIA you may ask us to tell you what personal information we hold about you, to correct or delete it, or to stop using it for a particular purpose (such as marketing). You may also object to how we process it. Contact the Information Officer using the details above; we will answer within a reasonable time and will not charge you for a simple request.
If you are not happy with how we handled your information, you may complain to the Information Regulator: inforegulator.org.za.
8. Children
Our shop is meant for adults. If you are under 18, please ask a parent or guardian to order for you.
9. Changes
We will update this policy if the way we handle personal information changes. The date at the top shows when it last changed.