Privacy policy

Last updated: 23 October 2026

1. WHO WE ARE

ICANDLES SA (PTY) LTD, trading as iCandles SA, operates www.icandlessa.co.za. We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for personal information whose processing purposes and means we determine.

This policy explains how we handle information about website visitors, retail and wholesale customers, prospective customers, and people who contact us. We serve customers in South Africa, Zimbabwe, Zambia and Botswana. Nothing in this policy limits mandatory privacy rights under laws applicable to you.

Personal information includes information about an identifiable living individual and, where applicable under POPIA, an identifiable existing juristic person.

Privacy contact: Pieter Naude
Email: info@icandlessa.co.za
Telephone: +27 64 024 3539
Address: 262 Voortrekker Road, Krugersdorp, 1739, South Africa
Company registration number: 2022/834520/07

2. INFORMATION WE COLLECT AND WHY

Orders and payments
We collect your name, contact details, billing and delivery addresses, products ordered, order history, payment confirmations and transaction references to process purchases, reconcile payments, issue invoices, arrange delivery and handle returns. You provide information at checkout, when requesting a quotation or when placing an order directly. Payment and delivery providers also supply payment status and delivery updates.

We accept Paystack, Yoco and EFT. We receive payment confirmations, not card details. Card information submitted to payment providers is handled through their payment systems. Please do not send card numbers or security codes by email or WhatsApp. EFT records or proof of payment may contain banking information you or your bank provide.

Customer support and communications
We collect your contact details, order information and correspondence when you contact us by email, phone, WhatsApp, social media or our website. We use this information to answer questions, resolve complaints and assist with orders, deliveries and refunds. Please provide only information relevant to your enquiry.

Wholesale enquiries
We collect the contact, business, location and purchasing information you provide through our Wholesale Request Form or correspondence. We use it to assess your enquiry, provide quotations and administer an agreed trade relationship.

Website and device information
Our store and its integrations collect technical and interaction information, such as IP address, browser and device information, cookie identifiers, pages viewed, referral information and interactions with products or checkout. Purposes include operating and securing the store, understanding website use, personalisation and advertising, subject to applicable privacy choices and lawful processing requirements.

Reviews and promotions
If you submit a review, we process its content and related customer or order information to administer reviews and verify purchases. Information you choose to publish in a review may be visible to others. Promotional tools may process cart and order information to administer offers or gifts.

Marketing preferences
We record your subscription choices, consent where relied upon, and unsubscribe requests. Marketing systems may also record interactions with messages, such as opens and link clicks, depending on their settings and your privacy choices.

3. REQUIRED AND OPTIONAL INFORMATION

Information needed to process payment, deliver an order or resolve a particular enquiry is necessary for that service. If you do not provide it, we may be unable to complete the transaction or assist you fully.

Marketing subscriptions and optional cookie choices are voluntary. Declining marketing does not prevent you from purchasing. Some optional website features may work differently if you decline related cookies. Where collection is specifically required by law, we will explain the relevant requirement where applicable.

4. OUR GROUNDS FOR PROCESSING

Depending on the purpose and circumstances, we rely on consent, steps requested before entering into a contract, performance of a contract, compliance with legal obligations, or a legitimate interest recognised by POPIA, such as preventing fraud and administering our business. We consider the effect on your privacy and do not treat visiting the website or accepting this policy as blanket consent.

Electronic direct marketing is subject to the separate requirements described below. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.

5. WHO RECEIVES INFORMATION

We share information relevant to the service being provided with:

• Shopify, which hosts our store and provides commerce and related services.
• Paystack, Yoco and banking providers for payments, reconciliation and payment disputes.
• Fastway, The Courier Guy, and, where used, Uber or Bolt delivery services and the drivers fulfilling deliveries. Delivery information may include the recipient’s name, address, telephone number and relevant instructions.
• Mailchimp for subscription management and email marketing.
• Meta through our Facebook and Instagram integration, and Google through our Google & YouTube and Google Analytics integrations, for advertising, measurement and related functions, subject to applicable privacy choices.
• Judge.me for reviews and BOGOS.io for offers and free-gift functions.
• WhatsApp and other communication platforms when we communicate through them.
• Professional advisers, authorities or other recipients where disclosure is lawfully necessary for compliance, dispute resolution or protection of rights.

Providers may act on our instructions or determine some processing purposes independently, depending on the service. Their own privacy notices may apply to independent processing. Where a provider acts as our operator, we require appropriate confidentiality and security obligations.

A marketing agency is not automatically entitled to our customer database. If appointed to process information on our behalf, its access must be limited to the agreed work, subject to appropriate contractual safeguards and a lawful basis. We will update relevant disclosures before materially changing our practices. This policy does not authorise an agency to use customer details for its own unrelated marketing.

6. SHOPIFY AND NETWORK INTELLIGENCE

Our store is hosted by Shopify. Information about visits, purchases and interactions is shared with Shopify to operate the store. Shopify Network Intelligence is enabled. Shopify also processes information from interactions with our store, other merchants and Shopify to provide enhanced services, including personalisation, advertising and insights into customer interactions.

Information may be shared with Shopify and other third parties located outside your country for these services. Shopify's role and applicable privacy controls depend on the service.

Read Shopify’s Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers

You can learn about and exercise applicable rights relating to Shopify’s processing through its privacy portal:
https://privacy.shopify.com/

You may also contact us about information processed in connection with our store.

7. COOKIES, ANALYTICS AND ADVERTISING

Cookies and similar technologies support the following purposes:

• Required: essential store operations, security, shopping cart and checkout functions.
• Personalisation: optional features that remember preferences or tailor your experience.
• Marketing: advertising relevance, campaign measurement and related activities.
• Analytics: understanding website interactions and identifying improvements.

Our cookie preferences interface lets you accept or decline optional categories and save your selection. Required cookies remain enabled. You can adjust your choices through the available cookie controls or contact us for assistance. Browser settings can also remove or block cookies, although this may affect store functionality. Choices can be specific to a browser or device.

Advertising and analytics integrations can involve both browser and server communications. Deleting browser cookies alone does not necessarily stop all information sharing or withdraw an email subscription. Cookie permission is separate from permission to send promotional emails or WhatsApp messages.

We use social-media platforms including Facebook, Instagram and TikTok for marketing. Interacting with our pages on those platforms is also subject to their privacy notices. This does not mean that every platform has a tracking pixel installed on our store.

8. EMAIL AND WHATSAPP MARKETING

We send electronic promotions where you have consented or where the applicable existing-customer exception permits it. Under POPIA, that exception requires contact details obtained in connection with a sale, promotion of our own similar products or services, and a free, straightforward opportunity to object at collection and in each marketing communication.

Use the unsubscribe link in marketing emails, reply STOP to WhatsApp promotions, or contact info@icandlessa.co.za to stop promotional messages. We honour these requests and may retain a minimal suppression record to avoid contacting you again for marketing.

Order confirmations, payment queries and delivery updates are service communications and may still be necessary after you unsubscribe from promotions.

9. INTERNATIONAL PROCESSING

Our providers operate internationally, so information may be processed outside South Africa, including through Shopify, Mailchimp, Google and Meta infrastructure. Cross-border deliveries may also require information to be sent to recipients or delivery providers in the destination country.

Transfers must meet applicable legal requirements. Under POPIA section 72, relevant grounds can include adequate protection through law, binding corporate rules or binding agreements, or another permitted ground such as contractual necessity or consent where applicable. Overseas privacy laws may differ from those in your country. Contact us for information about the recipients and safeguards relevant to your information.

10. RETENTION

We retain personal information for as long as reasonably necessary for its purpose or another lawful retention ground. Relevant considerations include completing orders and returns, accounting and statutory recordkeeping, resolving disputes, preventing fraud and maintaining an active customer relationship.

Marketing records are retained while there is a lawful basis for marketing, with limited consent and suppression records retained where needed to demonstrate and honour your choices. Support records are retained according to their relevance to enquiries, transactions and disputes.

When information is no longer required and retention is not otherwise lawful, it must be securely deleted, destroyed or de-identified. Deletion requests may be subject to legal recordkeeping requirements and other lawful exceptions.

11. SECURITY AND INCIDENTS

We are required to take reasonable technical and organisational measures to protect personal information against loss, unauthorised access and unlawful processing, and to require appropriate protection from operators processing it on our behalf. No online system can guarantee absolute security.

Where a security compromise triggers notification obligations, we will notify the Information Regulator and affected persons as required by applicable law, subject to any permitted exceptions or delays.

12. FRAUD SCREENING AND AUTOMATED PROCESSING

Shopify and payment services use automated tools to identify suspicious activity or assess transactions. Pieter Naude reviews suspicious orders, while some payment or security controls may automatically prevent a transaction from proceeding.

If you believe an automated restriction has affected you unfairly, contact us to request an explanation and appropriate review. Applicable rights concerning decisions based solely on automated processing remain unaffected. We may need to refer payment-provider decisions to that provider.

13. CHILDREN

Our store is intended primarily for adults. We do not knowingly seek children’s information for marketing. Where processing information about a child is necessary, an applicable legal exception, such as consent from a legally competent parent or guardian, must be established. For POPIA purposes, the child protections generally concern persons under 18 who are not legally competent to take the relevant decision without assistance.

Please contact us if you believe a child has provided information without an appropriate lawful basis, so that we can investigate and take suitable action.

14. YOUR RIGHTS AND COMPLAINTS

Subject to applicable law, you may request confirmation of whether we hold your personal information, access to it, correction of inaccurate information, or deletion or destruction where the legal requirements are met. You may object to qualifying processing, withdraw consent where relied upon, and object to direct marketing. Protections relating to certain solely automated decisions may also apply.

Contact info@icandlessa.co.za. We may reasonably verify your identity or authority before disclosing or changing records. We will explain any applicable procedure, lawful fee or reason why a request cannot be met in full. These rights are not all unconditional.

You may complain directly to the Information Regulator (South Africa); you do not have to complete our internal complaint process first.

Website: https://inforegulator.org.za/
Complaints information: https://inforegulator.org.za/complaints/
General enquiries: enquiries@inforegulator.org.za
Telephone: 010 023 5200

Customers in other countries retain any rights and complaint routes available under laws applicable to them.

15. CHANGES

We will update this policy when relevant practices or requirements change and revise the date above. Where required, we will give additional notice or obtain consent before using information for a materially different purpose. Publishing a revised policy does not itself create consent or remove existing rights.