1. Who We Are

This Privacy Policy is issued by Nona International (Pty) Ltd, a company registered in South Africa (Registration No. 2020/443239/07), trading as Nona International.

Our registered address and primary trading address is:

Nona International (Pty) Ltd

Shop UR 29, Sandton Gate Central
26 Sandton Gate Drive, Sandton, Johannesburg, 2191
Email: info@nona-international.co.za
Website: www.nona-international.co.za

In this Policy, references to “Nona”, “we”, “us” or “our” mean Nona International (Pty) Ltd. References to “you” or “your” mean any individual whose personal information we collect, process or hold.

2. Scope and Purpose of This Policy

This Privacy Policy explains how we collect, use, store, share and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and any other applicable South African data protection legislation.

This Policy applies to all personal information we collect through:

• Our physical store at Sandton Gate Central;
• Our website and e-commerce platform at www.nona-international.co.za;
• Email, telephone and any other electronic correspondence;
• Corporate and hospitality client enquiries and transactions;
• Social media channels operated by Nona International;
• Pop-up shops, markets and events at which Nona International trades;
• Any other interaction between you and Nona International.

By engaging with us in any of the above ways, you acknowledge that you have read and understood this Policy. Where we require your consent to process your personal information, we will obtain it separately and explicitly.

3. Information Officer

Nona International has appointed an Information Officer as required by POPIA. Our Information Officer is responsible for ensuring that we comply with our obligations under POPIA and for handling any queries, requests or complaints relating to the processing of your personal information.

Information Officer:  NM Cele  |  info@nona-international.co.za  |  Shop UR 29, Sandton Gate Central, Sandton, Johannesburg

4. Personal Information We Collect

We collect only the personal information that is necessary for a specific, defined purpose. The categories of personal information we may collect include:

4.1  Identity and Contact Information

• Full name and surname;
• Email address;
• Telephone number (mobile or landline);
• Delivery address (for online or corporate orders);
• Billing address;
• Company name and contact details (for corporate and hospitality clients).

4.2  Transaction and Purchase Information

• Products purchased, including quantities and values;
• Payment method (we do not store full card details — payments are processed by secure third-party payment providers);
• Order history, returns, exchanges and credits (including Return Merchandise Authorisation (RMA) numbers, reasons for return, and photographic evidence of damaged or defective goods submitted in support of a return or dispute claim);
• Gift messages and special instructions.
• Banking confirmation details (account holder name and bank account number) where a refund is to be processed by EFT, as required under our Returns, Exchange & Refund Policy.

4.3  Account and Website Information

• Username and password (for registered website accounts — stored in encrypted form);
• Browsing behaviour on our website, including pages visited and items viewed;
• Device type, browser, IP address and geographic location (collected via analytics tools);
• Cookie data — see Section 10 for our full Cookies Policy.

4.4  Communication and Marketing Preferences

• Email newsletter subscription status and preferences;
• Records of correspondence with us, including emails, enquiries and complaints;
• Marketing consent records.
• Loyalty programme membership details, including points balance, tier status, purchase history used for rewards calculation and redemption records.

4.5  Corporate and Hospitality Client Information

• Business registration details where required;
• Key contact persons and their contact details;
• Purchase orders and specification documents;
• Credit references where applicable.

4.6  Information We Do Not Collect

We do not collect or process any special personal information as defined in Section 26 of POPIA, including information relating to race, ethnicity, political opinion, religious belief, trade union membership, health, sex life or biometric data, unless specifically required and legally justified.

5. How We Collect Your Personal Information

We collect your personal information directly from you in the following ways:

• When you make a purchase in our store, online or by telephone;
• When you create an account on our website;
• When you subscribe to our email newsletter;
• When you enrol in our loyalty programme, redeem points or update your loyalty account;
• When you submit a corporate or hospitality enquiry;
• When you contact us by email, telephone or through our website contact form;
• When you interact with our social media content or send us a direct message;
• When you participate in a promotion, competition or customer survey.

We may also collect limited personal information indirectly through:

• Our website analytics tools (including Google Analytics), which collect data about how visitors use our site;
• Social media advertising platforms (including Meta/Facebook and Instagram), which may share aggregated audience data with us;
• Our point-of-sale system, which records transaction data automatically.

6. Lawful Basis for Processing

We process your personal information only where we have a lawful basis to do so under POPIA. Our lawful bases are:

6.1  Performance of a Contract

We process your personal information where it is necessary to fulfil a purchase, complete an order, process a return or exchange, or deliver products to you.

6.2  Legitimate Interest

We may process your personal information where it is in our legitimate business interest to do so, provided that your rights and interests are not overridden. This includes fraud prevention, maintaining our store security, conducting business analytics, and managing our corporate client relationships.

6.3  Consent

Where we rely on your consent — in particular for email marketing communications — we will ask for your explicit consent before we begin. You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.

6.4  Legal Obligation

We process personal information where required by law, including for tax and financial record-keeping purposes under South African law.

7. How We Use Your Personal Information

We use your personal information only for the purposes for which it was collected, or compatible purposes. Specifically, we use your information to:

7.1  Process Your Purchases and Orders

• Process payments and issue receipts and invoices;
• Arrange delivery of products to your address;
• Manage returns, exchanges, refunds and disputes in accordance with our Returns, Exchange & Refund Policy, including issuing RMA numbers, processing credit notes (valid for 12 months from date of issue), processing monetary refunds for defective goods within 7 business days of confirmed defect, and verifying banking details for EFT refunds;
• Respond to product queries and after-sales support.
• Process transit damage claims — where a delivery is damaged, we may request and retain photographs of the damaged goods and packaging. Damage must be reported to info@nona-international.co.za within 48 hours of receipt.

7.2  Manage Your Account

• Create and maintain your online customer account;
• Allow you to view your order history;
• Reset your password and manage account security.

7.3  Communicate With You

• Send order confirmations and delivery notifications;
• Respond to your enquiries, complaints or feedback;
• Send transactional communications relevant to your purchase.

7.4  Marketing (with your consent)

• Send our email newsletter to subscribers who have opted in;
• Share new product arrivals, promotions and events;
• Personalise our communications where possible.
• Administer our loyalty programme, including tracking points earned and redeemed, managing tier status and notifying you of rewards and benefits.

You may unsubscribe from marketing emails at any time using the unsubscribe link in any email we send, or by contacting us directly at info@nona-international.co.za. Withdrawal of consent for marketing communications does not affect your loyalty programme membership, which is governed by separate terms and conditions.

7.5  Improve Our Business

• Analyse website traffic and customer behaviour to improve our online experience;
• Monitor sales trends and inventory performance;
• Conduct customer satisfaction research and surveys.

7.6  Comply With Legal Obligations

• Maintain financial and tax records as required by SARS and the Companies Act;
• Comply with applicable consumer protection legislation;
• Respond to lawful requests from law enforcement or regulatory authorities.

8. Sharing Your Personal Information

We do not sell, rent or trade your personal information to any third party for their own marketing purposes. We share your personal information only where necessary, with the following categories of third-party service providers:

8.1  Payment Processors

We use secure, PCI-DSS compliant third-party payment processors to handle all card transactions. Nona International does not store, transmit or have access to your full card number. The payment processor processes payment data on our behalf under a formal data processing agreement.

8.2  E-Commerce and POS Platform Providers

Our point-of-sale system and e-commerce platform are provided by third-party technology vendors. These providers process transactional and customer data on our behalf and are bound by data processing agreements consistent with POPIA requirements.

8.3  Email Marketing Platform

We use a third-party email marketing platform (such as Mailchimp or equivalent) to manage our newsletter subscriber list and send marketing emails. Your email address and preferences are stored on this platform’s servers. You may unsubscribe at any time.

8.4  Analytics Providers

We use Google Analytics to understand how visitors use our website. Google Analytics collects data about your browsing behaviour on our site using cookies and similar technologies. This data is aggregated and pseudonymised. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

8.5  Social Media Advertising Platforms

We use Meta (Facebook and Instagram) advertising tools, which may involve sharing limited customer data (such as email addresses in hashed form) to enable targeted advertising and to measure the effectiveness of our campaigns. This sharing is governed by Meta’s data processing terms.

8.6  Delivery and Logistics Providers

Where we arrange delivery of an order, we share your name, delivery address and contact number with our courier or logistics partner for the sole purpose of completing the delivery.

8.7  Legal and Professional Advisers

We may share personal information with our lawyers, accountants or auditors where required for the performance of professional services, subject to applicable confidentiality obligations.

8.8  Regulatory and Law Enforcement Authorities

We may disclose personal information to law enforcement, regulatory or government bodies where required by law, or where we have a good-faith belief that disclosure is necessary to protect our rights, your safety or the safety of others.

Cross-border transfers:  Some of our third-party service providers are based outside South Africa (including the United States and European Union). Where personal information is transferred internationally, we ensure appropriate safeguards are in place consistent with Section 72 of POPIA.

9. How Long We Keep Your Personal Information

We retain your personal information only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our general retention periods are:

9.1  Customer and Transaction Records

We retain purchase records, invoices and related transaction data for a minimum of five (5) years, as required by the South African Revenue Service for tax and financial record-keeping purposes. Returns, exchange and refund records — including RMA records, credit notes issued, defect documentation and banking confirmation for EFT refunds — are retained for the same minimum five (5) year period. Credit notes are valid for 12 months from date of issue; records of issued credit notes are retained for the full five (5) year period thereafter for audit purposes.

9.2  Customer Accounts

We retain account information for as long as your account remains active. If you request deletion of your account and there are no outstanding legal obligations requiring retention of your records, we will delete your account data within 30 days.

9.3  Marketing Preferences

We retain your email newsletter subscription and consent records until you unsubscribe or request deletion. Where you unsubscribe, we retain a suppression record to ensure you are not inadvertently re-added to our mailing list.

9.4  Loyalty Programme Records

We retain loyalty programme membership records, including your points history and transaction records used to calculate rewards, for the duration of your membership plus five (5) years thereafter, consistent with our financial record-keeping obligations. If you request closure of your loyalty account, we will deactivate it within 30 days and delete personal data that we are not legally required to retain. Points balances lapse upon account closure.

9.5  CCTV (In-Store)

Our store premises at Sandton Gate Central may be covered by CCTV cameras operated by Sandton Gate Centre Management. We are not the operator of this CCTV system. Footage is generally retained for a period determined by Sandton Gate Centre Management in accordance with their policies.

10. Cookies and Website Tracking

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse website traffic and support our marketing activities.

10.1  What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to recognise your device on return visits and to store certain preferences and information.

10.2  Types of Cookies We Use

• Strictly necessary cookies: These are essential for the website to function. They enable core features such as your shopping cart and secure checkout. These cannot be disabled.
• Performance and analytics cookies: These collect anonymised data about how visitors use our website (for example, Google Analytics). They help us understand which pages are most popular and how we can improve the user experience.
• Functionality cookies: These remember your preferences (such as language or currency settings) to improve your experience.
• Marketing and targeting cookies: These are used to deliver advertising that is relevant to you. They may be set by our advertising partners, including Meta (Facebook and Instagram).

10.3  Your Cookie Choices

When you first visit our website, you will be presented with a cookie consent notice that allows you to accept or manage your cookie preferences. You can change your preferences at any time via the cookie settings on our website. You can also manage cookies through your browser settings; however, disabling certain cookies may affect the functionality of our website.

11. Your Rights Under POPIA

POPIA grants you the following rights in relation to your personal information. You may exercise any of these rights by contacting our Information Officer at info@nona-international.co.za:

11.1  Right of Access

You have the right to request confirmation of whether we hold personal information about you, and to request access to that information. We will respond to such requests within 30 days. A reasonable fee may apply.

11.2  Right to Correction

You have the right to request that we correct any inaccurate, incomplete or outdated personal information we hold about you.

11.3  Right to Deletion

You have the right to request the deletion of your personal information where we no longer have a lawful basis for processing it, or where the information is no longer necessary for the purpose for which it was collected. Deletion may not be possible where we are required by law to retain the information.

11.4  Right to Object

You have the right to object to the processing of your personal information where we rely on legitimate interest as our lawful basis, or where we process your information for direct marketing purposes. If you object to direct marketing, we will cease processing immediately.

11.5  Right to Withdraw Consent

Where we rely on your consent to process your personal information, you may withdraw your consent at any time. Withdrawal will not affect processing carried out prior to your withdrawal.

11.6  Right to Lodge a Complaint

If you believe that we have not complied with our obligations under POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa):  Website: www.inforegulator.org.za  |  Email: POPIAComplaints@inforegulator.org.za  |  Tel: 010 023 5200  |  JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

12. How We Protect Your Personal Information

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration.

Our security measures include:

• Encrypted storage of passwords and sensitive credentials;
• Use of SSL/TLS encryption for all data transmitted through our website;
• Restricted access to personal information on a need-to-know basis;
• Staff training on data protection and confidentiality obligations;
• Secure, access-controlled physical premises;
• Regular review of our data handling practices.

In the event of a personal information breach that poses a risk to your rights, we will notify the Information Regulator and affected individuals as required by POPIA.

13. Children’s Privacy

Our products and services are directed at adults. We do not knowingly collect personal information from children under the age of 18 without the consent of a competent person (parent or legal guardian) as required by POPIA. If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will delete that information promptly. If you believe we may have collected information from a child, please contact us immediately at info@nona-international.co.za.

14. Links to Third-Party Websites

Our website and social media channels may contain links to third-party websites, including those of our suppliers (ASA Selection, Serax) and retail partners. We are not responsible for the privacy practices of those websites and we encourage you to read their privacy policies before submitting any personal information to them. This Policy applies only to information collected by Nona International.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business operations, applicable law, or best practice. When we make material changes, we will notify you by posting the updated Policy on our website with a revised effective date, and where appropriate, by email.

We encourage you to review this Policy periodically. Your continued use of our website or services after any changes have been posted constitutes your acceptance of the updated Policy.

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have a concern about how we have handled your personal information, please contact our Information Officer:

Information Officer — Nona International (Pty) Ltd
Shop UR 29, Sandton Gate Central, 26 Sandton Gate Drive, Sandton, Johannesburg, 2191
Email: info@nona-international.co.za
Website: www.nona-international.co.za

We aim to respond to all requests and complaints within 30 days. Where a request is complex or where we receive a large volume of requests, we may extend this period by a further 30 days, in which case we will notify you.