Help & Contact

Effective 31 August 2026.

This notice explains what personal information PUMKINGREY (Pty) Ltd (“we”) collects when you use www.pumkingrey.com, why we collect it, who we share it with, and what you can ask us to do about it. We are the responsible party for that information under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. What we collect

We collect only what we need to sell you something and get it to you.

• Account and contact details — your name, email address and mobile number. This is what identifies your account and what we send verification codes to.
• Delivery address — street, suburb, city, province and postal code.
• Order information — what you bought, sizes, quantities, prices, order status, and any return you request together with the reason and note you give us.
• Payment confirmation — the reference, amount and status PayFast returns to us. We never receive or store your card number, expiry date or security code.
• Messages you send us — through the contact form, by email or on WhatsApp.
• Technical information — your IP address and browser details, recorded when pages load and when we apply rate limits to protect order links from being guessed.

We do not collect your date of birth, gender, income, occupation, household details or biometric data. We do not buy personal information from data brokers, and we do not collect anything about you from social networks.

2. Why we use it, and on what basis

• To take and fulfil your order — including delivery and returns. Basis: performance of our contract with you.
• To verify who you are when you sign in or ask us to change something. Basis: contract, and our legitimate interest in keeping accounts secure.
• To take payment through PayFast. Basis: contract.
• To answer you when you contact us. Basis: contract, or our legitimate interest in responding.
• To prevent fraud and abuse — including rate limiting. Basis: legitimate interest.
• To keep required records and comply with the law. Basis: legal obligation.
• To understand how the Website is used, in aggregate. Basis: legitimate interest. See section 5.

We do not sell your personal information, and we do not use it for targeted advertising.

3. Who we share it with

We share personal information only with the operators who make the shop work:

• PayFast — to take payment. They receive your name, email address and the amount, and handle your card details on their own systems.
• Our email provider — to send order confirmations, verification codes and return correspondence.
• Twilio — only if we send you a verification code by WhatsApp or SMS. Mobile codes are currently switched off; verification is by email.
• Google Analytics — see section 5.
• Couriers — your name, address and phone number, so your order can be delivered.
• Our hosting provider, which stores the site and its database.
• Professional advisers or authorities, where the law requires it.

4. Where it is kept

Your information is stored on servers in South Africa. Some of the operators above — Google and Twilio in particular — process information outside South Africa. Where that happens we rely on section 72 of POPIA, which permits a transfer where the recipient is subject to a law or binding agreement providing comparable protection.

5. Cookies and analytics

We use cookies that are necessary for the Website to work — keeping you signed in, remembering your cart, and carrying the security token that protects our forms. The site does not function without these.

We also use Google Analytics to understand how the Website is used in aggregate — which pages are visited and how people move through the shop. This sets analytics cookies and shares your IP address and browsing activity on this site with Google. These analytics cookies currently load when you open the Website, before you are asked. We are telling you that plainly rather than describing a consent step that does not yet exist. You can prevent Google Analytics entirely by installing Google’s opt-out browser add-on, or by blocking cookies in your browser settings — the shop will still work.

We do not use advertising or targeting cookies, and we run no advertising pixels or remarketing tags.

6. How long we keep it

• Order records — retained while your account is open and thereafter for as long as we need them for tax, accounting and consumer-protection purposes.
• Verification codes — valid for 10 minutes and discarded once used.
• Order-viewing links — expire 90 days after they are issued.
• Contact-form messages — kept while we deal with your query and for a reasonable period after.

7. How we protect it

• The Website is served over HTTPS.
• Sign-in uses a single-use code that expires in 10 minutes, is limited to five attempts, and is only ever sent to the details already on your account.
• Order-viewing links use a 256-bit random token, stored only as a hash, so the link cannot be recovered from our database. They are rate limited and marked noindex so search engines do not list them.
• Cancelling an order always requires a signed-in session, never just a link.
• Card details never reach our systems.

No system is perfectly secure. Because an order link works for anyone holding it, please do not forward one to someone you would not want to see that order.

8. Your rights under POPIA

You may ask us to:

• confirm whether we hold information about you, and give you a copy;
• correct or delete information that is wrong, misleading, or no longer needed;
• stop using your information for a purpose you object to;
• stop sending you marketing, at any time.

Contact privacy@pumkingrey.com and we will respond within a reasonable time. We may need to verify who you are first — which protects you, since your account is reachable by anyone who controls your email.

If you are unhappy with how we have handled your information you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — complaints.IR@justice.gov.za.

9. Children

The Website is not intended for children under 18. We do not knowingly collect information about children. If you believe we have, contact privacy@pumkingrey.com and we will delete it.

10. Changes

We may update this notice. The current version is always the one on this page, with its effective date at the top.

11. Contact

PUMKINGREY (Pty) Ltd
D103b Nongalwana Crescent
Ikwezi Park, Khayelitsha
Cape Town, 7784
South Africa
Privacy enquiries: privacy@pumkingrey.com
Everything else: admin@pumkingrey.com