PRIVACY POLICY

Last updated: 1 September 2026

Bruvz Clothing (Pty) Ltd ("Bruvz", "we", "us") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and all applicable South African privacy legislation. This policy explains what information we collect, how we use it, and your rights regarding your data.

1. WHO WE ARE

Bruvz Clothing (Pty) Ltd is a South African registered company operating the website bruvz.co.za. For any privacy-related queries, contact us at privacy@bruvz.co.za.

2. INFORMATION WE COLLECT

Information you provide directly

Name, email address and password when creating an account
Shipping and billing address when placing an order
Phone number (optional, for delivery queries)
Payment information (processed securely by PayFast — we never store card details)
Reviews, messages and enquiries you submit
Newsletter subscription preferences

Information collected automatically

IP address, browser type, device type, operating system
Pages visited, time spent, referral source
Shopping cart and wishlist interactions

3. HOW WE USE YOUR INFORMATION

To process and fulfil your orders and send order confirmations
To create and manage your account
To communicate with you about your orders, returns and queries
To send you marketing communications (only with your consent, and you may opt out at any time)
To operate the B COINS loyalty programme
To improve our website and personalise your experience
To detect and prevent fraud and other illegal activities
To comply with legal obligations

4. HOW WE PROTECT YOUR DATA

We take security extremely seriously:

All data is transmitted over HTTPS (TLS 1.3)
Passwords are hashed using bcrypt (12 rounds) — we never store plaintext passwords
Sensitive personal information (email, address) is encrypted at rest using AES-256-GCM
Payment processing is handled entirely by PayFast — we receive only a transaction confirmation
Two-factor authentication (2FA) is available for all accounts
Account brute-force protection: accounts are locked after 5 failed login attempts
All API endpoints are rate-limited and protected against common web attacks

5. SHARING YOUR INFORMATION

We do not sell your personal information. We share it only with:

PayFast — to process payments securely
Courier partners — to deliver your orders (name and address only)
Resend — to send transactional emails
Cloudinary — to store product images
Supabase — our database provider (hosted in the EU with appropriate data transfer safeguards)
Legal authorities — when required by South African law

6. YOUR RIGHTS UNDER POPIA

You have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your personal information (subject to legal retention requirements)
Object to the processing of your information for direct marketing
Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email privacy@bruvz.co.za. We will respond within 30 days.

7. COOKIES

We use essential cookies only — to keep you signed in and maintain your shopping cart. We do not use advertising or tracking cookies.

8. RETENTION

We retain your account information for as long as your account is active. Order records are retained for 5 years as required by South African tax law. You may request deletion of your account at any time — we will delete all personal data except records required for legal compliance.

9. CONTACT THE INFORMATION REGULATOR

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: inforeg@justice.gov.za

10. CHANGES TO THIS POLICY

We may update this policy from time to time. We will notify registered users by email of material changes. The "last updated" date at the top of this page will always reflect the current version.