Privacy Policy
Snow Aurora (Pty) Ltd
Last updated: 23 September 2026
Previous version: 16 September 2026
This policy explains what personal information we collect when you use snowaurora.co.za, why we collect it, who we share it with, how long we keep it and what you can do about it. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA), the Consumer Protection Act 68 of 2008 (CPA) and the Electronic Communications and Transactions Act 25 of 2002 (ECTA).
1. Who we are and who is responsible
Snow Aurora (Pty) Ltd is the responsible party for the personal information described in this policy. That means we decide why and how your information is used.
- Company: Snow Aurora (Pty) Ltd
- Registration number: 2024/805061/07
- Registered address: 77 Kindlewood Drive, Mount Edgecombe, KwaZulu Natal, 4302
- Website: snowaurora.co.za
- General enquiries: info@snowaurora.co.za
- Orders and returns: orders@snowaurora.co.za
- Support: support@snowaurora.co.za
- Telephone: +27 65 322 4846
Information Officer
Our Information Officer is responsible for POPIA and PAIA compliance and is your first point of contact for any question or complaint about your personal information.
- Information Officer: Xiaofang Chen
- Email: officer@snowaurora.co.za
- Telephone: +27 65 322 4846
2. What this policy covers
This policy covers our online shop, our customer accounts, our contact and stockist forms, our newsletter and promotional emails, our competition and event entries, and the tracking tools we run on the website. It does not cover other companies’ websites that we link to.
3. Information we collect
3.1 Information you give us
| Where you give it to us | What we collect |
|---|---|
| Creating an account | Name, email address, password (stored encrypted), and any details you add to your profile |
| Signing in with Google | Your name, email address and Google profile picture, passed to us by Google when you choose to sign in that way |
| Placing an order | Name, email address, contact number, billing address, delivery address, order contents, order value, order notes and your choice of payment method |
| Newsletter sign-up (website forms, checkout tick box, event and competition forms) | First name, email address and your marketing opt-in. Where a form asks for them, also your surname, contact number, birthday and interests |
| Contact form and support emails | Name, email address, contact number and whatever you write to us |
| Stockist and “Stock My Shop” applications | Your name, business name, contact details and the business information you supply |
| PAIA request form | Full name, identity or passport number, postal address, telephone number, email address and details of the record you are asking for. We collect an identity number here only because PAIA requires us to verify who is making the request |
| Wishlists and saved items | The products you save and, if you are logged in, the account they are saved to |
| Reviews and social posts we display | The name and content you published on the platform the review came from |
3.2 Information we collect automatically
When you visit the website, we and our service providers collect:
- Your IP address, approximate location (city or region level), device type, screen size, operating system, browser and language setting
- Pages you view, products you look at, how long you stay, what you click, how far you scroll and where you go next
- Mouse movement, scrolling and clicks, recorded as an anonymised replay of your visit through Microsoft Clarity. Text you type into form fields is masked and is not recorded
- How you arrived at the site: the search engine, social post, advertisement, email link or referring website, including any campaign tags in the link
- Your cart contents, recently viewed products and cookie preferences
- If you have subscribed to our emails, a link between your browsing on this site and your email address, so that we can send relevant follow-ups. This is explained in section 5
3.3 Information we get from other people
- PayFast tells us whether your payment succeeded or failed, and gives us a reference. We never see or store your full card number, CVV or banking login details
- Couriers give us delivery tracking and proof of delivery
- Google gives us your basic profile details if you sign in with Google, and gives us aggregated audience statistics
- Brevo tells us whether you opened an email, which links you clicked, and whether an email bounced or was marked as spam
4. Why we use your information, and our lawful basis
| What we do | Why | Lawful basis under POPIA |
|---|---|---|
| Take, process and deliver your order, and handle returns and refunds | To do what you asked us to do | Necessary to perform our contract with you (section 11(1)(b)) |
| Run your customer account | So you can log in, see your orders and save addresses | Contract (section 11(1)(b)) |
| Send order confirmations, payment receipts, shipping and delivery notifications, password resets and account notices | These are service messages, not marketing, and we send them to every customer | Contract (section 11(1)(b)) |
| Answer your questions and provide support | To help you | Contract, or our legitimate interests (section 11(1)(f)) |
| Send newsletters, promotions, discount codes, competition emails and abandoned-cart reminders | To tell you about products and offers | Your consent (section 69(2)), or, if you are an existing customer, section 69(3) for similar products, with an opt-out in every message |
| Track how you use the site and link that to your email address once you have subscribed | To send you follow-ups about products you looked at and to improve what we send | Your consent, given through the cookie banner and your marketing opt-in |
| Measure website traffic, test page performance and watch anonymised session replays | To find broken pages and make the shop easier to use | Your consent, given through the cookie banner |
| Prevent and investigate fraud, chargebacks and site abuse | To protect the business and other customers | Our legitimate interests (section 11(1)(f)), and legal obligation |
| Keep tax, accounting and consumer records | Because the law requires it | Legal obligation (section 11(1)(c)) |
| Deal with PAIA requests and regulator queries | Because the law requires it | Legal obligation (section 11(1)(c)) |
5. Email, SMS and marketing messages
We use Brevo (operated by Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France) to manage our mailing list, to build and send our marketing emails, to run automated email sequences, and to send the service emails that come from our shop. Brevo processes your information on our instructions only, under a written data processing agreement.
5.1 What Brevo holds about you
Depending on how you signed up, the record Brevo holds may include your first name, surname, email address, contact number, birthday, the date and source of your sign-up, whether you confirmed your subscription, which lists and segments you belong to, your language, your customer ID on our shop, your order and subscription status, and your engagement history (which of our emails you opened, which links you clicked, and whether you unsubscribed or reported an email as spam).
5.2 How you end up on our list
- You sign up on the website, at an event or through a competition entry. You fill in a newsletter form, or tick the optional newsletter box on a competition or event entry form. You are added to our marketing list when you submit the form, and Brevo records the date, time and form you used as evidence of your consent
- You tick the newsletter box at checkout. The box is optional and is never ticked for you
- You place an order without ticking the newsletter box. Your order and contact record is still synchronised into Brevo so that our shop and our email system hold the same customer information and so that we can send you service emails about your order. You are kept on a separate, marked non-subscriber list and we do not send you marketing unless and until you opt in
5.3 Competition and event entries
Some of our competition and event pages, such as our Comic Con Africa page, use a sign-up form hosted by Brevo. When you submit one of those forms, your details go directly to Brevo’s servers rather than passing through our website first. Entering a competition does not subscribe you to our mailing list unless you tick the optional newsletter box. Where a discount code or prize is involved, the competition rules or promotion terms apply in addition to this policy.
5.4 Stopping marketing messages
Every marketing email has an unsubscribe link at the bottom. Clicking it stops marketing immediately and permanently, and you do not need to give a reason. You can also email info@snowaurora.co.za and ask us to stop. We will still send you service emails about orders you have placed, because we are obliged to. If we add SMS or WhatsApp marketing in future, we will ask for your consent separately before sending anything to your number.
5.5 Tracking in emails and on the site
Our marketing emails contain a small tracking pixel and tracked links that tell us whether the email was opened and which links were clicked. We also run Brevo’s website tracking script on snowaurora.co.za. Before you subscribe, that script records browsing activity against an anonymous ID stored in a cookie. Once you subscribe or click through from one of our emails, that browsing history is linked to your contact record, which lets us send follow-ups such as a reminder about a product you viewed. This is automated, and it does not involve any decision that has a legal effect on you. If you do not want this, decline analytics and marketing cookies in our cookie banner, and unsubscribe from our emails.
6. Website analytics, session recording and reviews
- Google Analytics 4 (Google). Measures visits, traffic sources, product views and sales, so we can see what is working. We use it with IP anonymisation
- Microsoft Clarity (Microsoft Corporation). Produces heatmaps and anonymised replays of visits so we can see where the shop is confusing or broken. Form inputs are masked. Microsoft processes this data for its own purposes as well as ours, stores it in the United States and keeps it for up to 13 months. You can read Microsoft’s privacy statement at privacy.microsoft.com/privacystatement
- Google Site Kit. Connects our website to our own Google Analytics and Search Console accounts
- Trustindex. Displays our public Google reviews on the site. It loads from Trustindex’s servers, which means your IP address is visible to Trustindex
- Order attribution. Our shop records how you first found us and how you arrived on the visit where you ordered, so we can tell which marketing is worth paying for
- Google Sign-In. If you choose to log in with Google, Google will know that you signed in to our site
7. Cookies and similar technologies
Cookies are small files stored on your device. We use them to keep your cart working, remember your preferences, understand how the shop is used, and support our marketing. When you first visit, our cookie banner lets you accept all, reject all, or choose categories. You can change your choice at any time through the banner, and you can delete cookies through your browser settings. Blocking strictly necessary cookies will break the cart and checkout.
| Category | Examples on our site | What they do |
|---|---|---|
| Strictly necessary | woocommerce_cart_hash, woocommerce_items_in_cart, wcj_order_data, wp-settings, cookieyes-consent | Keep your cart and checkout working, keep you logged in and remember your cookie choices. These cannot be switched off |
| Functional | shopengine_recent_viewed_product, wcj_products_per_page, g_state | Remember recently viewed products, your display preferences and your Google sign-in state |
| Analytics and performance | _ga, _ga_GF8WP8XZ0E (Google Analytics), _clck, _clsk (Microsoft Clarity) | Count visits, measure how pages perform and record anonymised session replays |
| Marketing | sib_cuid (Brevo), sbjs_first, sbjs_current, sbjs_session, sbjs_udata and related attribution cookies | Recognise you across visits for email follow-ups, and record which campaign brought you to us |
8. Who we share your information with
We do not sell or rent your personal information. We share it only with the service providers we need in order to run the shop, and only as far as they need it. Each of them is bound by a contract that limits what they may do with it.
| Who | What they do for us | Where they process it |
|---|---|---|
| Brevo (Sendinblue SAS) | Mailing list, marketing and automated emails, outgoing shop emails, sign-up forms and website tracking | France, Germany and Belgium. Some Brevo support and infrastructure functions are performed in the United States and India |
| PayFast | Card and EFT payment processing | South Africa |
| Courier Guy, Globe Flight, PostNet and other couriers we use | Delivery and tracking | South Africa |
| Google (Analytics, Site Kit, Sign-In) | Website measurement and optional social login | United States and other countries where Google operates |
| Microsoft | Heatmaps and session replay through Clarity | United States |
| Trustindex | Displaying our public reviews | European Union |
| CookieYes | Cookie consent banner and consent records | European Union |
| Our website host | Hosting the website, the shop database and backups | Managed by The Bloc Studio (South Africa), on servers provided by Verpex in Europe |
| Our accountant and auditors | Bookkeeping and tax | South Africa |
| Stockists and agents | Promotional material, only where you have specifically opted in | South Africa |
| Law enforcement, regulators and our legal advisers | Where the law requires it, or to establish or defend a legal claim | South Africa |
9. Sending your information outside South Africa
Some of the service providers above process your personal information outside South Africa. Section 72 of POPIA allows this, and we rely on the following:
- Brevo. Your contact and email engagement data is stored in the European Union, in France, Germany and Belgium. The European Union has data protection law that is substantially similar to POPIA. Brevo is contracted to us under a written data processing agreement that binds it to a level of protection comparable to POPIA, including its onward transfers to its own sub-processors in the United States and India, which are covered by the European Commission’s Standard Contractual Clauses
- Google and Microsoft. These providers process data in the United States and elsewhere under their own data processing terms and the Standard Contractual Clauses, which bind them to comparable protection
- Our website host. The website, shop database and backups are stored on Verpex servers in Europe. The European Union has data protection law that is substantially similar to POPIA
- Where you ask us to. If you ask us to ship or send something internationally, we will transfer the information needed to do that
You may ask us for details of the safeguards that apply to any of these transfers by emailing officer@snowaurora.co.za.
10. How long we keep your information
| Type of record | How long we keep it |
|---|---|
| Orders, invoices and payment records | 5 years from the end of the tax year they relate to, as required by tax and company law |
| Customer account | For as long as your account is open, then 12 months after you close it or ask us to delete it, unless we must keep order records for longer |
| Marketing list records and consent evidence | Until you unsubscribe or ask us to delete you, and then we keep a minimal suppression record (your email address only) so that we do not accidentally email you again |
| Email engagement history in Brevo | Rolling 24 months |
| Website analytics | Google Analytics: 14 months. Microsoft Clarity: up to 13 months, held by Microsoft |
| Competition and event entries | 3 months after the competition closes. Winners’ records are kept for 3 years, as the Consumer Protection Act requires. If you also subscribed to our mailing list, your subscription is kept until you unsubscribe |
| Support emails and contact form messages | 24 months |
| Stockist applications | 24 months, or for the life of the stockist relationship |
| PAIA requests and our responses, including any identity number supplied | 3 years from the date the request is finalised |
| Security and server logs | 12 months |
When a retention period ends we delete the information or make it anonymous so that it can no longer identify you.
11. How we protect your information
- The whole site runs over an encrypted HTTPS connection
- Passwords are stored in encrypted (hashed) form and cannot be read by us
- Access to the shop’s admin area and to Brevo is limited to the people who need it, with strong passwords and two-factor authentication
- We take regular backups, which are stored encrypted
- We keep the website, its theme and its plugins updated
- We do not store card numbers. Card details are handled entirely by PayFast, which is PCI DSS compliant
- Every service provider that handles personal information for us is bound by a written agreement requiring appropriate security and confidentiality
No system is completely secure, so we cannot promise absolute safety, but we take these obligations seriously and review them regularly.
12. If there is a security compromise
If personal information under our control is accessed or acquired by someone who is not authorised to have it, we will notify the Information Regulator and every affected person as soon as reasonably possible after establishing what happened, as section 22 of POPIA requires. Our notice to you will describe what happened, what information was involved, what we are doing about it and what you should do to protect yourself.
13. Your rights
Under POPIA you have the right to:
- Be told what personal information we hold about you, and be given a copy
- Ask us to correct information that is wrong, misleading or out of date
- Ask us to delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
- Object to us processing your information on the grounds of legitimate interests, by submitting Form 1 under the POPIA regulations
- Withdraw your consent at any time, including your consent to marketing, without affecting anything we did before you withdrew it
- Object to direct marketing at any time, free of charge
- Not be subject to a decision based only on automated processing that has a legal effect on you. We do not make decisions of that kind
- Complain to the Information Regulator
- Go to court over an alleged breach of your rights
How to exercise your rights
Email officer@snowaurora.co.za. We will ask you to confirm your identity before we act, so that we do not give your information to someone else. We will respond within 30 days. Access to information is normally free, but PAIA allows us to charge a prescribed reproduction fee for copies, and we will tell you in advance if any fee applies.
Complaining to the Information Regulator
If you are not satisfied with how we have handled your information or your request, you can complain to:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
POPIA complaints: POPIAComplaints@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Website: inforegulator.org.za
14. Our PAIA manual
We keep a manual under section 51 of the Promotion of Access to Information Act 2 of 2000. It sets out the records we hold, how to request access to them, and the procedure and fees that apply. You can request a free copy by emailing officer@snowaurora.co.za.
15. Children
Only adults (18 or older) may buy from our shop, although many of our kits are suitable for younger builders. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian, as POPIA requires. If you believe a child has given us their information, email officer@snowaurora.co.za and we will delete it.
16. If you are in the European Union or the United Kingdom
If you are in the EU or the UK, the GDPR or UK GDPR may also apply to you. In that case you additionally have the right to data portability and the right to restrict processing, our lawful bases are consent, contract, legal obligation and legitimate interests as set out in section 4, and you may complain to your national supervisory authority. Email officer@snowaurora.co.za and we will handle your request under those rules.
17. Other websites
Our site links to other websites and social media platforms. We do not control them and we are not responsible for how they handle your information. Read their privacy policies before giving them anything.
18. Changes to this policy
We update this policy when what we do changes, or when the law changes. The date at the top always shows the current version. If a change materially affects how we use your information, we will tell you by email or through a notice on the site before it takes effect.
19. Contact us
Questions about this policy, or about your information:
- Information Officer: officer@snowaurora.co.za
- General: info@snowaurora.co.za
- Telephone: +27 65 322 4846
- Website: www.snowaurora.co.za