Vape Queen (Pty) Ltd
Privacy Policy
Last updated:
Vape Queen (Pty) Ltd (“Vape Queen”, “we”, “us” or “our”) respects your privacy. This policy explains how we collect, use, store, share and protect personal information when you visit our website or stores, buy from us, communicate with us or participate in our customer programmes.
Our handling of personal information is subject to the Protection of Personal Information Act 4 of 2013 (“POPIA”). Other applicable South African laws include the Promotion of Access to Information Act 2 of 2000 (“PAIA”), the Consumer Protection Act 68 of 2008 (“CPA”) and the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”).
This policy provides information about our practices. Visiting our website, buying a product or acknowledging this policy does not, by itself, give consent to optional marketing or every type of processing described below.
1. Who is responsible for your information?
Vape Queen (Pty) Ltd is the responsible party for the personal information it determines how and why to process in operating its retail business.
Hivex handles management and privacy enquiries on behalf of Vape Queen. You can direct questions, requests and complaints to Hivex using the details below. Hivex will coordinate with Vape Queen and its Information Officer as necessary.
Responsible party: Vape Queen (Pty) Ltd
Management and enquiry contact: Hivex
Email: info@hivex.co.za
Telephone: 081 433 5820
International: +27 81 433 5820
Where Hivex processes information solely under Vape Queen’s instructions, it acts as an operator or authorised service provider. Appointing Hivex to manage enquiries does not transfer or remove Vape Queen’s obligations under POPIA.
2. Scope and meaning of personal information
This policy applies to customers, prospective customers, website visitors, people who contact us, delivery recipients, loyalty members and representatives of business customers or suppliers. It covers information in electronic and paper records. Employment and recruitment activities may be covered by separate notices.
Personal information is information relating to an identifiable living person and, where applicable under POPIA, an identifiable existing juristic person. It can include contact details, purchase records, online identifiers and communications. Processing includes collecting, recording, organising, using, sharing, retaining and deleting that information.
A particular form, promotion, store notice or service may provide additional privacy information. We will make relevant additional notices available when the information is collected.
3. Information we may collect
The information we need depends on your interaction with us. We aim to collect information that is relevant and proportionate to the purpose.
- Identity and contact details: your name, email address, telephone number, billing address, delivery address and, for business transactions, company and VAT details where relevant.
- Account information: account identifiers, login credentials in the form used by our systems, saved details, account activity and communication preferences.
- Order and transaction information: products purchased, quantities, prices, discounts, invoices, receipts, payment status, transaction references, delivery details, returns, refunds and related correspondence.
- Payment-related information: the payment method, provider reference, payment confirmation and limited information supplied by a payment provider. If needed for a refund, we may request the minimum banking information required to process it.
- Loyalty information: membership identifiers, qualifying purchases, points earned or redeemed, balances, rewards and adjustments where you participate in a loyalty programme.
- Enquiries and communications: messages, support requests, complaints, attachments and records of how we resolved a matter.
- Technical information: IP address, browser and device information, access times, pages requested, referral information, cookies and security or error logs, depending on the tools in use.
- Age-verification information: an age declaration, date of birth or limited evidence needed to verify eligibility when age verification is required. An identity document is not a routine requirement for every website visit or enquiry.
- Voluntary submissions: reviews, survey responses, competition entries or other information you choose to provide where these features are offered.
- Store security information: CCTV images or incident records where surveillance operates and appropriate notices are displayed.
Please avoid sending passwords, card security codes, one-time PINs, full card details or unrelated sensitive documents in an email, contact form or support message.
4. Where information comes from
We normally collect information directly from you when you place an order, create an account, join a programme, visit a store, submit a form or contact us.
We may also receive relevant information from payment providers, couriers, point-of-sale and online ordering systems, authorised management providers such as Hivex, and platforms through which you contact us. Examples include payment confirmations, delivery outcomes and a support message submitted through a social platform. Website systems may collect technical information automatically.
Where you supply another person’s details, such as a delivery recipient’s name and telephone number, you must have an appropriate reason and authority to do so. Please tell that person why their information is being supplied and direct them to this policy.
Where information comes from another source, we will provide any further source information or collection notice required by law.
5. Why we use personal information
- To respond to enquiries and provide information you request.
- To create and manage customer accounts and authenticate access.
- To accept, process and fulfil orders, arrange collection or delivery, and issue transaction documents.
- To reconcile payments and handle returns, refunds, warranty enquiries, disputes and chargebacks.
- To administer loyalty balances, rewards and customer programmes you use.
- To keep relevant online and in-store customer and transaction records consistent where our systems are connected.
- To send necessary service messages, including order confirmations, delivery updates, security notices and relevant product recall information.
- To verify age or other eligibility requirements using proportionate checks.
- To maintain our website and systems, investigate faults, prevent misuse and protect people, property and accounts.
- To understand service performance and improve the shopping experience, subject to applicable privacy and cookie choices.
- To send permitted marketing communications in accordance with section 8 below.
- To meet applicable tax, accounting, consumer-protection and other legal obligations, and establish, exercise or defend legal rights.
If we intend to use information for a materially different purpose, we will assess whether that use is lawful and compatible with the original purpose. We will provide additional notice and obtain consent where required.
6. Lawful grounds for processing
Depending on the activity, we rely on one or more grounds recognised by POPIA:
- Contract: processing needed to enter into or perform an agreement with you, such as fulfilling an order.
- Legal obligation: processing needed to comply with a legal duty, such as maintaining required transaction records.
- Legitimate interests: processing justified by your legitimate interests, or necessary for our or a third party’s legitimate interests, subject to your rights. Examples include proportionate fraud prevention and resolving disputes.
- Consent: processing based on a voluntary, specific and informed choice, where required, including relevant optional marketing and tracking.
You may withdraw consent for future consent-based processing. Withdrawal does not invalidate earlier lawful processing, and does not require us to delete information that must still be kept on another lawful ground. General legitimate interests do not override the specific rules governing electronic direct marketing.
7. Required and optional information
Required fields will be identified in the relevant form or process. Information needed to complete a purchase is a transactional requirement; this does not necessarily mean that a law requires you to supply it.
If you do not provide necessary details, we may be unable to process payment, deliver an order, verify eligibility, administer a requested benefit or resolve an enquiry. Where collection is required by a particular law, we will identify the relevant requirement when appropriate.
Optional surveys, promotional subscriptions and optional tracking are voluntary. Refusing these choices does not, by itself, prevent you from purchasing from us. Declining optional tracking may reduce personalisation.
8. Direct marketing and your choices
Electronic direct marketing, including promotional email, SMS, messaging and telephone communications where applicable, will be handled in accordance with POPIA section 69 and applicable CPA requirements.
We will use your details for this marketing only with valid consent or where the existing-customer exception lawfully applies. That exception requires us to have obtained your contact details in the context of a sale, to market our own similar products or services, and to have offered a free and reasonable opportunity to object both when collecting the details and with each marketing communication.
Where the law permits a once-off approach to request marketing consent, we will respect that limit and any previous refusal. Opening an account, placing an item in a basket, joining a loyalty programme or accepting this policy does not automatically constitute marketing consent.
Our marketing communications will identify Vape Queen and provide a working opt-out contact or mechanism. You can opt out using the unsubscribe mechanism in a message, by replying as instructed, or by contacting info@hivex.co.za or 081 433 5820. We do not charge for opting out. We will stop the relevant marketing and may retain a minimal suppression record to honour your choice.
Necessary order, account, security or legal notices may still be sent after a marketing opt-out. We will not use service notices to bypass your marketing choices. We also honour applicable direct-marketing restrictions and legally binding blocking or opt-out requirements.
10. Payments and banking information
Where you choose an external payment service, that provider processes the payment information required for its service. Its own privacy notice may apply to processing it controls, including regulatory checks and fraud prevention. Please review the provider identified at checkout.
We use the relevant payment result, reference and transaction information to confirm an order, reconcile accounts and handle refunds or disputes. The exact information available to us depends on the payment method and integration.
Do not provide online-banking passwords, one-time PINs or card security codes to our staff or through general support channels. Where refund bank details must be verified, we will explain what is needed and the appropriate way to provide it.
11. Who may receive your information?
We may provide relevant information to the following recipients when necessary for a lawful purpose:
- Authorised Vape Queen personnel and Hivex: for management, customer assistance, technical administration and privacy enquiries.
- Technology providers: website hosting, cloud storage, backups, security, point-of-sale, inventory, customer account and technical support services.
- Payment and financial providers: payment gateways, banks and related services for payment processing, reconciliation, fraud checks and disputes.
- Delivery providers: couriers and fulfilment partners receiving details needed to deliver or collect an order.
- Communication and programme providers: services supporting enquiries, transactional messages, permitted marketing and loyalty administration.
- Professional advisers: accountants, auditors, insurers and legal advisers where their involvement is necessary.
- Public authorities and other legally authorised recipients: where a valid legal obligation, lawful process or justified protection of legal rights requires disclosure.
- Parties to a business transaction: relevant advisers or a prospective successor in a genuine restructuring, merger or sale, subject to confidentiality, limited access and a lawful basis.
We limit disclosures to information reasonably needed for the relevant task. Operators processing information on our behalf must be subject to appropriate written security and confidentiality obligations and may not use the information for unrelated purposes without a separate lawful basis.
Some recipients act as independent responsible parties for their own processing. We do not sell or rent customer contact lists, or authorise Hivex to use Vape Queen customer information to market unrelated businesses without an appropriate separate lawful basis and any required consent.
12. Processing outside South Africa
Depending on the services used, information may be hosted, backed up or accessed by service providers outside South Africa. Overseas access can occur when a provider supplies technical support, even if its main service is used locally.
Any such transfer must satisfy POPIA section 72. This may involve a recipient bound by an adequately protective law, binding corporate rules or agreement, or another applicable ground expressly permitted by that section, such as valid consent or a qualifying contractual necessity.
Where we rely on contractual safeguards, they must address appropriate protection and onward transfers. Acceptance of this policy is not blanket consent to an unrestricted overseas transfer. Contact Hivex for information about the destinations and safeguards relevant to your information. Any more specific disclosure required for a particular service will be provided in its collection notice.
13. How long we keep information
We retain personal information only for as long as a lawful purpose requires or permits. The period depends on the record, the relationship, applicable retention duties and any unresolved dispute or investigation.
| Record | How the retention period is determined |
|---|---|
| Orders, invoices and accounting records | Applicable tax and company-record obligations, and relevant audit, dispute or legal-hold requirements. Different duties may require different periods. |
| Customer accounts and loyalty records | The period needed to maintain the account or programme, resolve balances and disputes, and retain any records separately required by law. |
| Enquiries, returns and complaints | The time needed to resolve the matter and retain proportionate evidence for follow-up or related claims. |
| Marketing preferences and suppression records | The period needed to evidence consent or honour an opt-out, retaining only the details needed for that purpose. |
| Technical logs, CCTV and verification evidence | A period proportionate to the security or verification purpose, with longer retention only where needed for a specific incident or legal obligation. |
| Backups | The applicable backup rotation and recovery period. Residual copies remain protected and are not used to resume marketing or other discontinued activities. |
When retention is no longer justified, we will securely delete, destroy or de-identify the information. Closing an account does not automatically erase records we must retain. Where we decline a deletion request, we will explain the applicable reason and limit further use appropriately.
You may contact Hivex for the retention criteria or period applicable to a particular category of your information.
14. Security safeguards
We must take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access and unlawful processing. We assess foreseeable risks and review safeguards in light of those risks.
Measures appropriate to the systems concerned include restricting access according to duties, authentication controls, secure transmission where appropriate, software maintenance, supplier controls, protected backups and procedures for handling incidents. The safeguards required depend on the sensitivity and context of the information.
No website, transmission method or storage system can be guaranteed completely secure. This does not remove our legal duties. Keep account credentials confidential, use a strong password and notify us promptly if you suspect unauthorised access to your account or information.
15. Security compromises
If there are reasonable grounds to believe that an unauthorised person has accessed or acquired personal information under our control, we will investigate, take appropriate containment and remedial action, and make the notifications required by POPIA section 22.
We will notify the Information Regulator and affected people as soon as reasonably possible after discovering the compromise, subject to the exceptions and permitted delays in the law. Notification to an affected person is subject to their identity being establishable. We do not wait for an investigation to finish where the duty to notify has already arisen.
Notices will provide available information about the incident, possible consequences, measures taken or proposed and protective steps you can take. Report a suspected incident to info@hivex.co.za or 081 433 5820.
16. Age verification and children’s information
Our retail offering is intended for adults aged 18 and over. We do not knowingly invite children to create customer accounts, join promotional mailing lists or purchase age-restricted products.
Where age verification is needed, we seek a proportionate method and limit the information collected. Checking identification does not automatically require retaining a full copy. If a copy or verification record is necessary, its purpose and retention will be limited accordingly.
If you believe that a child has supplied personal information to us, contact Hivex. We will assess the circumstances and delete or restrict that information unless a lawful ground requires or permits its retention. Any permitted processing of children’s information remains subject to POPIA’s specific safeguards.
17. Special personal information
Ordinary purchases and enquiries should not require unrelated information about your health, religion, race, political views, sex life, trade union membership, biometrics or alleged criminal behaviour.
Please do not include such information unless it is relevant to a matter you are asking us to handle. If special personal information is received or must be processed, we will assess the applicable POPIA authorisation, limit access and use, and apply appropriate safeguards. Voluntarily including sensitive information in a message does not authorise unrelated uses.
18. Automated tools and profiling
Where used, automated tools may calculate loyalty points, apply discounts, identify suspicious transactions or generate product suggestions. These tools can use transaction, account or browsing information appropriate to their purpose.
We will not subject you to a decision based solely on automated profiling that has legal consequences or substantially affects you unless permitted by POPIA section 71 and supported by the required safeguards. Where applicable, you may request information about the relevant logic and an opportunity to make representations. Contact Hivex if you believe an automated decision has incorrectly affected your order or account.
19. Your rights
Subject to the conditions and limitations in applicable law, you may:
- Ask whether we hold personal information about you and request access to a record or description of it, including relevant information about recipients.
- Request correction of information that is inaccurate, incomplete, misleading or out of date.
- Request deletion or destruction of information that is irrelevant, excessive, unlawfully obtained or no longer lawfully retained.
- Object, on reasonable grounds relating to your particular situation, to applicable processing based on legitimate interests, unless legislation provides for that processing.
- Object to direct marketing and withdraw consent for processing that depends on consent.
- Request restriction of processing in circumstances recognised by POPIA, including relevant disputes about accuracy or lawful use.
- Exercise applicable protections concerning automated decisions.
- Complain to the Information Regulator and pursue other available legal remedies.
These rights are not an unconditional right to erase every transaction or obtain another person’s confidential information. If an exception applies, we will explain our decision and the available route to challenge it.
20. How to make a privacy request
Contact info@hivex.co.za or call 081 433 5820. It helps to include your name, the contact details associated with the record, the type of request and an order or account reference where relevant. An email subject such as “Vape Queen privacy request” will help us direct it, but is not a condition of exercising your rights.
We may request proportionate proof of identity or authority before releasing or changing information. Do not send an identity-document copy unless we explain why it is needed and how to supply it securely.
We will assist with the appropriate request process and any applicable POPIA or PAIA form. We will accommodate an accessible lawful method of making a request. If you make an objection or a correction or deletion request by telephone, we will explain the recording required by the regulations and make the recording or a transcription available to you on request, free of charge.
Confirmation of whether we hold your information, objections, and correction or deletion requests are free of charge. Where a prescribed access or reproduction fee lawfully applies to supplying records, we will explain it before charging. We will not charge a fee prohibited by law.
We will respond within the applicable legal period. Formal PAIA access requests are generally decided within 30 days, subject to lawful extensions. Other POPIA requests will be handled within the applicable prescribed or reasonable period. For correction or deletion requests, we will give written notification of the action taken within the period required by regulation 3.6 of the POPIA regulations. We will communicate the outcome and any lawful reason for refusing a request.
This policy does not replace a PAIA manual. Contact Hivex for the company’s PAIA access procedure, relevant manual and request forms.
21. Complaints to the Information Regulator
You are welcome to raise a concern with Hivex so we can investigate. You do not have to obtain our permission or complete our internal enquiry process before lodging a POPIA complaint with the Information Regulator.
Information Regulator (South Africa)
Website: inforegulator.org.za
Complaint guidance: How to lodge a complaint
Online complaints: Information Regulator eServices portal
General assistance: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Toll-free: 0800 017 160
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, South Africa.
The Regulator’s current complaint guidance directs users to register a profile and submit complaints through its eServices portal. Check its website for the current process or contact it for assistance. Separate requirements may apply to a PAIA complaint about access to records.
22. External websites and public submissions
External websites, payment services and social platforms may have their own privacy practices. A link to them does not place all their processing under Vape Queen’s control. We remain responsible for any information we disclose to them and any processing for which the law makes us responsible.
If you use a public review or comment feature, the information identified for publication may be visible to others. Avoid including contact details, payment information or another person’s private information in a public submission. Private support enquiries are not intended for publication.
23. Changes to this policy
We may update this policy to reflect changes in our activities, systems or legal obligations. The version published on our website will show the date of the latest update. Where a change materially affects how your information is used, we will provide additional notice where appropriate and obtain new consent where required.
An update does not retrospectively authorise unlawful processing or remove choices you have already exercised. Nothing in this policy limits a right or remedy that South African law does not allow us to exclude.