Privacy Policy

1. Responsible party and privacy contact

Responsible party: Koel Sleep. For privacy questions or requests, email info@koelsleep.co.za.

You can also find our available support details on the Contact page.

2. Information we collect

We collect information needed to provide our services, including your name, email address, billing and delivery addresses, order items, payment status, transaction references and correspondence with support.

Where enabled, website technologies may collect your IP address, device and browser information, pages viewed, interactions, cookie identifiers and referral information. We do not ask you to provide sensitive personal information to buy a blanket.

3. How information is collected

You provide information through Shopify checkout, customer enquiries and any contact or subscription forms made available on the website. Shopify and authorised providers supply order and transaction updates. Cookies and similar technologies may collect browsing information, subject to the choices and safeguards described below.

4. Purposes and lawful processing

We use necessary information to accept payment, fulfil and deliver orders, provide tracking, handle returns and refunds, respond to enquiries, prevent fraud, maintain records and meet legal obligations. Processing is based on the relevant lawful ground under POPIA, including performance of a contract, legal obligations, consent or legitimate interests where appropriate.

We request only information reasonably necessary for these purposes. Required checkout details must be supplied to complete an order; optional marketing information is not a condition of purchase.

5. Payments and service providers

Payments are handled through Shopify checkout and its third-party payment providers. Koel does not ask you to send card details by email or messaging and does not store full payment-card details. Payment providers process payment information under their own security standards and privacy notices.

We share necessary information with Shopify, payment processors, courier companies, hosting and support providers, and professional advisers where needed. We may also disclose information where required by law. Providers must use appropriate safeguards and process information only for authorised purposes, except where they act independently under their own legal obligations.

Some providers may process information outside South Africa. Any cross-border transfers must comply with section 72 of POPIA, including appropriate protection, contractual safeguards or another permitted basis.

6. Cookies, analytics and advertising

Essential cookies support functions such as checkout, cart continuity and security. If enabled, analytics, Meta Pixel and other advertising technologies may measure website use, advertising performance or audiences, and may share browsing events with their providers.

This policy does not mean that Meta Pixel or analytics are currently active.

Non-essential tracking must follow applicable consent requirements. You may manage cookies in your browser and through any available preference controls; blocking essential cookies may affect checkout. Withdrawing consent does not affect processing already lawfully carried out.

7. Marketing communications

Electronic direct marketing is sent only where consent or a lawful existing-customer exception under POPIA permits it. You can unsubscribe using the link in a marketing message or contact us. Order confirmations, delivery updates and other necessary service messages are separate from marketing.

We never sell your personal information to third parties.

8. Your POPIA rights

Subject to legal requirements and exceptions, you may request confirmation of information we hold, access to it, correction of inaccurate information, deletion of information we are no longer entitled to retain, or object to applicable processing. You may withdraw consent where processing relies on consent and object to direct marketing.

Contact our privacy contact with your request. We may verify your identity before disclosing or changing records, explain any legally permitted fee or refusal, and retain records that the law requires. You may lodge a complaint with South Africa’s Information Regulator at inforegulator.org.za.

9. Security and retention

We apply reasonable technical and organisational safeguards, restrict access to authorised people and require appropriate protection from service providers. No internet service can guarantee absolute security. If a security compromise occurs, we will take appropriate action and notify the Information Regulator and affected people where POPIA requires it.

Information is kept only for as long as necessary for its purpose, legal record-keeping obligations, dispute handling or another lawful basis, then securely deleted, de-identified or destroyed.

10. Updates

Changes to this policy will be posted here, with additional notice where legally required.