Privacy Policy

Who this policy covers

This policy explains how iMIHLA. collects, uses, stores, and protects your personal information when you browse the site, create an account, place an order, or sign up for drop notifications. It is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA).

The responsible party

iMIHLA. (“we”, “us”) is operated under two related businesses, both owned by Nando Bingani, who together are the responsible party for the personal information described in this policy:

ELAKHO BRANDING (Enterprise No. 2021/693116/07) — the registered business behind the iMIHLA. brand and retail operations.
DIGITAL SOLUTIONS CONSULTING (Enterprise No. 2025/934656/07) — the registered business that operates the iMIHLA. website and payment processing, including our Paystack merchant account.

Registered address: Cape Town, South Africa

Our Information Officer

As required by POPIA, we have designated an Information Officer responsible for ensuring we comply with the Act. You can reach them at hello@imihla.co.za.

Information Officer: Nando Bingani

What we collect

We collect only what we need to run the store and your account:

• —Account details — if you sign in with Google, we receive your name, email address, profile photo, and a unique account identifier.
• —Order and delivery details — name, email, phone number, and shipping address, plus the items, sizes, and variants in your order.
• —Payment details — payments are processed entirely by Ozow and PayFlex. We never receive or store your card or banking details, only the transaction reference and payment status.
• —Newsletter — if you sign up for drop notifications, we store your email address.
• —Session data — a session cookie that keeps you signed in while you use the site.

Why we collect it

We use your personal information to create and manage your account, process and deliver your orders, handle payments, respond to support queries, send drop notifications if you've subscribed, prevent fraud, and meet our legal and accounting record-keeping obligations.

Our lawful basis for processing

We process your information because it's necessary to perform our contract with you when you place an order, because you've given consent (Google sign-in, drop notifications), or because we're required to by law (tax and accounting records).

Who we share it with

We share personal information only with the service providers we need to run the store: Google (authentication), Ozow and PayFlex (payment processing), Supabase (database hosting), and our courier partners (delivery). Some of these providers may process or store data on servers outside South Africa; we only use providers that commit to data protection safeguards consistent with POPIA. We do not sell your personal information to anyone.

Cookies

We use a single essential session cookie to keep you signed in. We don't use advertising or third-party analytics cookies.

How long we keep it

We keep order and transaction records for as long as required by South African tax and accounting law. Newsletter email addresses are kept until you unsubscribe. Account information is kept for as long as your account is active, or until you ask us to delete it.

How we protect it

We use encrypted connections (HTTPS), restrict access to personal information to those who need it to run the store, and rely only on reputable third-party processors for authentication, payments, and hosting.

Your rights

Under POPIA, you have the right to:

• —Be notified that your personal information is being collected, and why (this notice).
• —Request access to the personal information we hold about you, free of charge for a first request in a year.
• —Request that we correct, update, or delete personal information that is inaccurate, out of date, incomplete, or collected unlawfully.
• —Object to us processing your personal information, including for direct marketing such as drop notification emails.
• —Withdraw your consent at any time, for example by unsubscribing from drop notifications.
• —Complain to the Information Regulator if you believe we've handled your personal information unlawfully.

Children's privacy

iMIHLA. is not directed at children, and we don't knowingly collect personal information from minors without the consent of a parent or guardian, as required by POPIA.

Changes to this policy

We may update this policy from time to time. The latest version will always be available at this page, with the date above reflecting the most recent update.

Contact us

Questions about this policy or your personal information? Email hello@imihla.co.za

Lodging a complaint

If you're not satisfied with how we've handled your personal information, you can lodge a complaint with South Africa's Information Regulator:

Information Regulator (South Africa)
SALU Building, 316 Thabo Sehume Street, Pretoria, 0001
Email: complaints.IR@justice.gov.za
Website: justice.gov.za/inforeg