Privacy policy

Who we are

Maxine Benatar, trading as Amaya, a sole trader in Cape Town, South Africa, is the responsible party for your personal information under the Protection of Personal Information Act (POPIA). Information Officer: Maxine Benatar, maxinebenatar@gmail.com, +27 83 703 8502.

What we collect, and why

To fulfil your order: name, delivery address, email, phone number, what you bought and how you paid. We need this to perform our contract with you.
To take payment: Payfast (and Payflex if you choose it) processes your card or bank details on its own secure pages. We never see or store your card number.
To deliver: your name, address and phone number go to The Courier Guy so they can deliver and reach you.
To run the site: Shopify hosts our store and processes orders, accounts and emails on our behalf. Shopify's own privacy policy applies to its systems.
To stay in touch: if you tick the newsletter box, register a dress or sign up for back-in-stock alerts, we keep your email (and the size or style you asked about) and email you about new styles. We never pre-tick that box. Every email has a one-click unsubscribe.
To answer you: WhatsApp messages, emails and chat messages you send us are kept so we can reply and remember what we agreed.
To understand the site: anonymised analytics (pages visited, device type). With your consent we also use marketing cookies.

Cookies

The site uses cookies that make the bag, checkout and your account work; those cannot be switched off. Analytics and marketing cookies are set only after you agree in the cookie banner. You can change your choice at any time.

Who else sees your data

Only the operators we need to run the shop: Shopify (hosting), Payfast and Payflex (payment), The Courier Guy (delivery), our email provider, and Google Analytics if you consented to analytics cookies. Each handles your data under its own agreement with us and does not get to use it for its own marketing. We do not sell or rent your data. Some of these providers process data outside South Africa under contracts that meet POPIA's requirements.

How long we keep it

Order and invoice records: 5 years, as tax law requires. Newsletter and alert data: until you unsubscribe or ask us to delete it. Messages: 2 years. Analytics: 14 months.

Your rights

You can ask what we hold about you, have it corrected or deleted, object to marketing, or ask us to stop processing it: email maxinebenatar@gmail.com and we respond within 30 days. If you are not satisfied, you can complain to the Information Regulator of South Africa (inforegulator.org.za, complaints.IR@inforegulator.org.za).

Security

Shopify encrypts the site and your account. Payment pages run on Payfast's systems. We use strong passwords and two-step login on the admin, and only Maxine and the people who help run the shop can see orders.