Privacy policy (POPIA)

Last updated: 2026-11-12

CurlCoco (E.S Daniels) is the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Information Officer: E.S Daniels, info@deepevolution.za.net.

What we collect and why

• Orders: name, email, mobile number and delivery address, to deliver your order, send updates and meet our legal duties (for example, tax records).
• Payments: handled entirely by Paystack. We never see or store your card details.
• Newsletter: your email address, only if you sign up or tick the box at checkout.
• Analytics: Cloudflare Web Analytics counts visits without cookies and without tracking you across sites.

Who we share it with

We share only what each service needs to do its job:

• Our supplier (AliExpress and its sellers): your name, delivery address and phone number, to ship your order. Some of this processing happens outside South Africa.
• Paystack (payments), Brevo (email delivery, EU-based) and Cloudflare (website hosting).
• Meta and TikTok: ad-measurement cookies, only if you accept them.

When information leaves South Africa, we rely on these providers' data-protection terms, as section 72 of POPIA allows. We never sell your information.

Cookies

The site itself needs no tracking cookies. If you click "Yes" on the cookie notice, we load the Meta Pixel and TikTok Pixel to measure our ads. You can change this any time with "Cookie settings" at the bottom of every page. Your cart is saved in your own browser (local storage), not on our servers.

Marketing emails

We only send marketing emails if you opt in. Every email has an unsubscribe link (POPIA section 69; ECT Act section 45).

How long we keep it

Order records: 5 years, for tax and consumer-law purposes. Newsletter: until you unsubscribe.

Your rights

You can ask to see, correct or delete your information, or object to us processing it, by emailing info@deepevolution.za.net. If you're unhappy with our answer, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

Security

The site runs on HTTPS only, payments go through Paystack's PCI-DSS-compliant checkout, and access to order data is limited to the owner.