1. WHO WE ARE

Terminal Three is a South African business operating the Terminal Three online store and brand.

Website: www.terminalthree.co.za
Registered entity: TERMINAL THREE (Pty) Ltd
Enterprise number: 2025/736936/07
Registered or principal business address: 2029 Leander Road, 6 Silver Leaf Estate, Olympus, Pretoria, 0081
Email: admin@terminalthree.co.za

For purposes of POPIA, Terminal Three is generally the responsible party in respect of the personal information that we determine how and why to process.

2. WHAT IS PERSONAL INFORMATION?

“Personal information” means information relating to an identifiable natural person and, where applicable under South African law, an identifiable juristic person.

Depending on how you interact with Terminal Three, this may include your:

• name and surname;
• email address;
• telephone number;
• billing address;
• delivery address;
• account information;
• order history;
• payment and transaction information;
• correspondence with us;
• IP address;
• browser, device and technical information;
• website activity;
• marketing preferences;
• location information derived from your device or IP address;
• social media information where you interact with us through a social platform; and
• any other information that you voluntarily provide to us.

We aim to collect only the personal information that is reasonably necessary for the purposes described in this Privacy Policy.

3. INFORMATION WE COLLECT

3.1 Information you provide directly to us

We may collect personal information when you:

• place an order;
• create or use a customer account;
• check out as a guest;
• contact our customer service team;
• submit a return, refund, exchange or warranty request;
• subscribe to our email or SMS communications;
• enter a competition, giveaway or promotion;
• complete a survey or provide feedback;
• submit a product review;
• communicate with us through email, WhatsApp, social media or another communication platform; or
• otherwise provide information directly to us.

When you place an order, we may collect information including your name, contact details, billing and delivery addresses, items ordered and transaction details.

3.2 Payment information

When you make a purchase, payment information is processed by the payment service provider made available through our checkout.

Depending on the payment method selected, the payment provider may collect information such as your card details, bank details, payment credentials or other information required to process and authenticate the transaction.

Terminal Three does not necessarily receive or store your complete payment card details. Payment providers process payment information in accordance with their own terms, security standards and privacy policies.

3.3 Information collected automatically

When you visit our website, certain information may be collected automatically through cookies, pixels, tags, log files and similar technologies.

This information may include:

• your IP address;
• browser type and version;
• device type;
• operating system;
• referring website or source;
• pages viewed;
• products viewed;
• products added to or removed from your cart;
• searches performed;
• date and time of access;
• interaction with our website;
• approximate geographic location; and
• cookie or device identifiers.

We use this information to operate our website, understand how it is used, improve the customer experience, maintain security and, where permitted, support marketing and advertising activities.

3.4 Information from third parties

We may receive information about you from third parties that assist us in operating our business, including:

• Shopify;
• payment service providers;
• delivery and courier providers;
• marketing platforms;
• analytics providers;
• advertising platforms;
• fraud-prevention and security providers;
• social media platforms; and
• other service providers that you choose to interact with.

Where you interact with Terminal Three through a third-party service, that third party's own privacy policy may also apply.

4. HOW WE USE YOUR PERSONAL INFORMATION

We may process your personal information for purposes including:

Orders and transactions

We use personal information to:

• process and confirm your order;
• process payments;
• arrange delivery;
• provide order tracking information;
• communicate with you regarding your purchase;
• process returns, exchanges and refunds;
• resolve order or delivery issues;
• verify transactions; and
• maintain appropriate business and financial records.

Customer service

We may use your information to:

• respond to questions and requests;
• provide support;
• investigate complaints;
• respond to product-related concerns;
• manage returns or exchanges; and
• keep a record of our communications with you.

Operating and improving our website

We may process information to:

• operate, maintain and secure our website;
• remember preferences;
• understand how customers use our website;
• analyse website performance;
• improve navigation and functionality;
• improve our products and customer experience;
• identify technical problems; and
• develop and improve our business.

Security and fraud prevention

We may use information to:

• authenticate transactions;
• protect our website, customers and business;
• detect and prevent fraud;
• detect suspicious, unlawful or abusive activity;
• investigate security incidents;
• enforce our legal rights; and
• comply with legal obligations.

Marketing and advertising

Where permitted by law, we may use your information to:

• send marketing emails or messages;
• inform you about new products, launches, promotions or offers;
• show advertising that may be relevant to you;
• measure the effectiveness of our marketing;
• understand customer preferences; and
• create audiences for marketing and advertising purposes.

Where consent is legally required, we will obtain it before sending direct marketing communications or using your information for applicable advertising purposes.

You may unsubscribe from marketing communications at any time by using the unsubscribe function included in the communication or by contacting us.

Transactional messages relating to an order, payment, delivery, return, account or customer service matter are not marketing communications and may still be sent where necessary.

5. GROUNDS ON WHICH WE PROCESS PERSONAL INFORMATION

We process personal information only where there is a lawful basis for doing so.

Depending on the circumstances, we may process your information because:

• you have consented to the processing;
• the processing is necessary to enter into or perform a contract with you;
• the processing is required or permitted by law;
• the processing protects your legitimate interests;
• the processing protects the legitimate interests of Terminal Three or a third party, provided that your rights and interests are appropriately considered; or
• another lawful justification recognised by applicable data protection legislation applies.

Where we rely on consent, you may withdraw your consent, subject to applicable law and any processing that remains necessary or legally permitted.

6. SHOPIFY

Our online store is hosted using Shopify, which provides the e-commerce platform that allows us to sell our products and services to you.

When you visit our store, create an account, browse products, place an order or otherwise use our website, certain personal information may be processed by Shopify in order to provide its services to us and to support the operation of the store.

Shopify may process information including account, contact, transaction, device, browsing and shopping information.

Because Shopify operates internationally, information processed through the Shopify platform may be stored or processed in countries outside South Africa.

Shopify processes information in accordance with its own contractual, privacy and security arrangements. You may refer to Shopify's current privacy notices for further information regarding how Shopify processes personal information.

7. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies.

A cookie is a small data file stored on your device when you visit a website. Cookies can perform functions such as remembering your preferences, keeping items in your shopping cart, enabling website functionality and helping us understand how our website is used.

We may use:

Essential cookies
These cookies are necessary for the website to operate correctly, including checkout, security, shopping-cart functionality and account access.

Functional cookies
These help remember choices or preferences and improve website functionality.

Analytics cookies
These help us understand website traffic, customer behaviour and how visitors interact with our website.

Advertising and marketing cookies
Where permitted, these may be used to measure advertising effectiveness, understand your interaction with advertisements and show advertising that may be more relevant to you.

Some cookies may be placed by third-party services used on our website.

Where applicable, you may manage your cookie preferences through the cookie or privacy controls displayed on our website. You may also control certain cookies through your browser settings.

Disabling certain cookies may affect the functionality of the website.

8. WHO WE SHARE PERSONAL INFORMATION WITH

We do not sell your personal information as a standalone business practice.

We may disclose or make personal information available to third parties where reasonably necessary to operate our business, provide our services or comply with the law.

These third parties may include:

Shopify and technology providers

We may share information with Shopify and service providers that host, maintain, secure or support our website and business systems.

Payment providers

Information required to process your transaction may be shared with payment gateways, banks, financial institutions and fraud-prevention providers.

Delivery and courier providers

We may provide your name, delivery address, contact number and other necessary order information to courier or logistics providers so that your order can be delivered and tracked.

Marketing, advertising and analytics providers

Where permitted by applicable law and your privacy choices, information may be processed by providers that help us understand website activity, communicate with customers, measure campaigns or advertise Terminal Three products.

Professional advisers

We may disclose information to accountants, auditors, legal advisers, insurers, consultants or similar professional advisers where reasonably necessary.

Business service providers

We may use service providers for functions including customer support, communications, website services, cloud storage, data analysis, security and business administration.

We require service providers that process personal information on our behalf to handle that information appropriately and only for authorised purposes, subject to applicable law and contractual arrangements.

9. LEGAL DISCLOSURES

We may disclose personal information where we reasonably believe that disclosure is necessary to:

• comply with applicable legislation;
• comply with a lawful court order, subpoena or regulatory request;
• cooperate with law enforcement or government authorities where legally required;
• investigate fraud or unlawful conduct;
• protect the rights, property or safety of Terminal Three, our customers or others;
• establish, exercise or defend legal claims; or
• enforce our agreements and policies.

Where legally permitted and reasonably practicable, we will seek to ensure that disclosures are proportionate to the relevant purpose.

10. BUSINESS TRANSFERS

If Terminal Three undergoes a merger, acquisition, restructuring, sale of assets, financing transaction, change of ownership or similar corporate transaction, personal information may form part of the information transferred or disclosed as part of that transaction.

Any such processing will remain subject to applicable law.

11. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

Some of the service providers that support our website and business may operate, store information or process information outside South Africa.

As a result, your personal information may be transferred to or processed in countries whose data-protection laws differ from those of South Africa.

Where personal information is transferred outside South Africa, we will take reasonable and appropriate steps to ensure that the transfer is made in accordance with applicable data-protection legislation, including POPIA.

This may include relying on contractual safeguards, legally recognised transfer mechanisms, consent where appropriate, or transferring information to recipients that are subject to laws, agreements or corporate rules providing an appropriate level of protection.

By using services provided through internationally operated platforms such as Shopify, your information may be processed across multiple jurisdictions as necessary to provide those services.

12. DATA SECURITY

We take reasonable technical and organisational measures to protect personal information in our possession or under our control against:

• loss;
• misuse;
• unauthorised access;
• unauthorised disclosure;
• destruction;
• alteration; and
• unlawful processing.

Our service providers may also maintain their own physical, technical and organisational security measures.

However, no method of transmission over the internet and no electronic storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of any password or account credentials used to access your account and should not disclose these credentials to another person.

If you believe that your account or personal information has been compromised, please contact us as soon as possible.

13. SECURITY COMPROMISES AND DATA BREACHES

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate the incident and take appropriate steps in accordance with applicable law.

Where required by POPIA or other applicable legislation, we will notify the relevant regulatory authority and affected individuals as soon as reasonably possible, subject to any lawful restrictions on notification.

14. HOW LONG WE KEEP PERSONAL INFORMATION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or subsequently processed, unless a longer retention period is required or permitted by law.

The relevant period may depend on:

• the nature of the information;
• the purpose for which we collected it;
• contractual requirements;
• accounting and tax requirements;
• legal and regulatory obligations;
• fraud-prevention requirements;
• dispute-resolution requirements; and
• the establishment, exercise or defence of legal claims.

When personal information is no longer required, we will take reasonable steps to delete, destroy, de-identify or otherwise dispose of it in accordance with applicable law.

Certain information may remain within secure backups for a limited period after deletion from our active systems.

15. DIRECT MARKETING

Where permitted by law, Terminal Three may communicate with you about our products, new releases, promotions, events or other marketing content.

We will obtain your consent to electronic direct marketing where consent is required by applicable law.

Each electronic marketing communication will provide a reasonable way for you to unsubscribe or opt out.

You may also contact us directly and request that we stop sending you marketing communications.

Opting out of marketing does not prevent us from contacting you where necessary to:

• complete or administer an order;
• provide delivery information;
• respond to a request;
• communicate about a return or refund;
• send security-related notices; or
• otherwise fulfil our contractual or legal obligations.

16. SOCIAL MEDIA

Terminal Three may maintain profiles on social media platforms.

If you interact with our pages, tag us, send us a direct message, comment on our content or otherwise engage with us through a social media platform, we may receive information associated with your profile and interaction.

The relevant social media platform may independently collect and process your personal information in accordance with its own privacy policy.

We encourage you to review the privacy settings and privacy notices of the social media platforms you use.

17. COMPETITIONS, GIVEAWAYS AND PROMOTIONS

If you participate in a Terminal Three competition, giveaway or promotion, we may collect information necessary to administer that promotion, contact entrants, verify eligibility and provide prizes.

Where a promotion is conducted together with another business or partner, we will inform you where your personal information is intended to be shared with that partner for purposes connected with the promotion.

We will not provide your information to a promotion partner for that partner's independent marketing purposes without an appropriate legal basis, including consent where required.

Additional terms may apply to specific promotions.

18. PRODUCT REVIEWS AND USER-GENERATED CONTENT

If you submit a product review, photograph, comment, testimonial or other content for publication, information you choose to make public may be visible to other visitors.

Please avoid including sensitive or unnecessary personal information in any publicly submitted content.

Where you provide content to Terminal Three through a competition, campaign or other initiative, the applicable campaign or promotional terms may contain additional provisions governing that content.

19. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to websites, platforms or services operated by third parties.

Terminal Three does not control the privacy practices of independent third parties and is not responsible for how those parties collect or use your information.

We encourage you to review the privacy policies of any third-party website or service before providing personal information to it.

20. CHILDREN'S PRIVACY

Our website and products are not specifically directed at children and we do not knowingly seek to collect personal information from children without appropriate authorisation where such authorisation is required by law.

If you believe that a child has provided personal information to us in circumstances where appropriate consent or authorisation was required but not obtained, please contact us so that we can investigate and take appropriate action.

21. YOUR RIGHTS UNDER POPIA

Subject to applicable law and any permitted limitations, you may have the right to:

• ask whether we hold personal information about you;
• request access to personal information we hold about you;
• request correction of inaccurate, outdated, incomplete, excessive or misleading personal information;
• request the deletion or destruction of personal information in circumstances permitted by law;
• object to certain processing of your personal information;
• object to direct marketing;
• withdraw consent where processing is based on consent;
• request information regarding the identity of third parties, or categories of third parties, that have had access to your personal information where applicable;
• lodge a complaint with the Information Regulator; and
• exercise any other rights available to you under applicable data-protection legislation.

Some rights are not absolute. We may be entitled or required to retain or continue processing certain information despite a request where permitted or required by law.

For example, we may need to retain information relating to transactions for accounting, tax, fraud prevention, dispute resolution or other legal purposes.

22. HOW TO EXERCISE YOUR PRIVACY RIGHTS

To submit a privacy-related request, please contact us at:

Email: admin@terminalthree.co.za

Please clearly describe your request and provide enough information for us to identify the relevant records.

To protect your information, we may ask you to verify your identity before responding to a request.

We will process valid requests within the periods required by applicable law.

23. EUROPEAN ECONOMIC AREA AND UNITED KINGDOM CUSTOMERS

Where the European Union General Data Protection Regulation (“GDPR”), UK GDPR or similar legislation applies to our processing of your personal information, you may have additional rights, subject to applicable limitations.

These may include the right to:

• access your personal data;
• correct inaccurate personal data;
• request erasure;
• restrict certain processing;
• object to certain processing;
• receive certain personal data in a structured, commonly used and machine-readable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with an applicable supervisory authority.

Where these laws apply, our legal basis for processing may include consent, performance of a contract, compliance with a legal obligation or our legitimate interests where those interests are not overridden by your rights and interests.

24. AUTOMATED DECISION-MAKING

We do not intend to make decisions about you based solely on automated processing where those decisions would produce legal consequences or similarly significant effects, except where permitted by applicable law.

Certain service providers may use automated systems to identify potentially fraudulent or suspicious transactions. Such systems may consider transaction, device, payment or behavioural information for security and fraud-prevention purposes.

Where applicable law grants you rights regarding automated decision-making, those rights will apply.

25. ACCURACY OF YOUR INFORMATION

We rely on you to provide information that is accurate and up to date.

Please notify us if important personal information that you have provided changes, particularly your contact or delivery details.

Terminal Three will take reasonably practicable steps to maintain accurate information where necessary for the purpose for which it is processed.

26. ELECTRONIC COMMUNICATION

When you use our website, place an order or communicate with us electronically, you acknowledge that we may communicate with you electronically where permitted by law.

Electronic communications may include:

• order confirmations;
• payment confirmations;
• delivery notifications;
• return or refund communications;
• customer-service responses;
• account notifications;
• security notifications; and
• marketing communications where permitted.

Where electronic communications are legally required to be in writing, electronic communications may satisfy that requirement to the extent permitted by applicable law.

27. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to:

• our business;
• our website;
• our service providers;
• the technologies we use;
• applicable laws or regulations; or
• the way in which we process personal information.

The latest version will be published on our website and the “Last updated” date at the top of this policy will be amended accordingly.

Where a change materially affects the way we process your personal information and applicable law requires further notification or consent, we will take appropriate steps to notify you or obtain that consent.

We encourage you to review this Privacy Policy periodically.

28. GOVERNING LAW

This Privacy Policy and the processing of personal information by Terminal Three are subject to the laws of the Republic of South Africa, including POPIA, to the extent that those laws apply.

Nothing in this Privacy Policy limits any rights you may have under mandatory data-protection legislation that applies to you.

29. CONTACT US

If you have questions about this Privacy Policy, would like to exercise a privacy right, or have concerns about how your personal information has been handled, please contact:

Terminal Three
Website: www.terminalthree.co.za
Email: admin@terminalthree.co.za
Address: 2029 Leander Road, 6 Silver Leaf Estate, Olympus, Pretoria, 0081

We encourage you to contact us first so that we have an opportunity to address your request or concern.

30. INFORMATION REGULATOR (SOUTH AFRICA)

If you believe that your personal information has been processed in contravention of POPIA, you have the right to lodge a complaint with the Information Regulator (South Africa).

At the date of this Privacy Policy, the Information Regulator's contact details are:

Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead, Johannesburg, 2191

Telephone: 010 023 5200
Toll-free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za

The Information Regulator's current contact information and complaint procedures can also be accessed through its official website.

31. ACCEPTANCE OF THIS PRIVACY POLICY

By continuing to use our website or providing personal information to us, you acknowledge that you have been given an opportunity to read this Privacy Policy and understand how Terminal Three processes personal information.

Where consent is specifically required by law for a particular form of processing, your general use of our website will not replace the requirement for us to obtain that consent.