Old Tree Yard · Legal
Privacy Notice
Old Tree Yard · www.oldtreeyard.co.za
We collect the minimum information needed to get bonsai substrate and wire to your door, we protect it, and we never sell it. This notice explains the details, as required by the Protection of Personal Information Act (POPIA).
1. Who is responsible for your information
The "responsible party" under POPIA is Wesley van der Walt trading as Old Tree Yard, a sole proprietorship, of 23 Sunbirdway, 1 Fish Eagle Drive, Hilltop Estate, Ballito, KwaZulu-Natal, 4420, South Africa.
Our Information Officer is Wesley van der Walt, reachable at wesley@oldtreeyard.co.za or 071 480 5552. Any privacy question, request, or complaint can go directly to them.
2. What we collect, and why
When you place an order: your name, email address, phone number, and delivery address; the items you ordered and amounts paid; and Payfast's payment confirmation reference. We use this to process your order, deliver it, send you order and tracking emails, handle returns and warranty claims, keep the financial records the law requires, and prevent fraud. We never see or store your card number: you enter it on Payfast's secure page, not ours.
When you contact us: your messages and contact details, used to help you and to keep a record of how we resolved things.
When you browse the site: standard technical logs (IP address, browser type, pages visited) generated by our hosting provider and store platform, used for security and to keep the site working. We don't run advertising trackers.
If you opt in to our newsletter: your email address, used only to send you what you signed up for, until you unsubscribe.
We don't collect more than this, we don't collect special personal information (such as health, religious, or biometric data), and we don't make automated decisions about you.
3. Our lawful grounds
We process your information because it's necessary to carry out the sale you've asked for (the contract between us), because certain laws require us to keep records (tax and consumer law), because we have a legitimate interest in running the site securely and preventing fraud, and, for marketing only, because you've given consent, which you can withdraw at any time.
4. Who processes your information for us
A small set of service providers ("operators" under POPIA) handle specific jobs, under written terms, and only on our instructions:
| Provider | What they do | What they see |
|---|---|---|
| Payfast | Processes your payment | Payment details you enter on their page; we receive only confirmation and a reference |
| Bob Go + The Courier Guy | Deliver your parcel | Name, delivery address, phone number (on the waybill) |
| Resend | Sends our transactional emails | Your email address and order email content |
| Cloudflare | Hosts the website and stores order records | Order details and technical logs |
| Ecwid (by Lightspeed) | Runs our online store: the product catalogue, cart, checkout, and order records | Your name, email, phone number, delivery address, and what you ordered |
Beyond these, we share information only where the law requires it (for example with SARS, or under a court order). We never sell or rent your information to anyone.
5. Direct marketing
We only send marketing email if you've opted in; the newsletter box at checkout is unticked by default. Every marketing email identifies us and carries a one-click unsubscribe. Order and delivery emails aren't marketing; you'll always receive those for your own orders.
6. Information leaving South Africa
Ecwid, Cloudflare, and Resend store data on infrastructure that may sit outside South Africa. POPIA allows this where the recipient is bound to protect your information to an adequate standard, and for these transfers we rely on contractual commitments and data-processing terms that require appropriate protection of personal information in accordance with POPIA, which we hold on record.
7. How long we keep things
Order and financial records are kept for 5 years (tax law requires it, and it also lets us honour the 6-month warranty and resolve disputes), after which they're deleted or de-identified. Newsletter details are kept until you unsubscribe. Support conversations are kept as long as needed to resolve the matter and for a reasonable period after.
8. How we protect it
The site runs over HTTPS end to end; order data lives in access-controlled systems that only two authorised people can reach; payments happen entirely on Payfast's PCI-compliant infrastructure; and we keep the amount of personal information in circulation as small as the job allows. If, despite this, your personal information is ever compromised, we will notify the Information Regulator and you as soon as reasonably possible, where required under section 22 of POPIA, and tell you what happened and what to do.
9. Children
Our store is not aimed at anyone under 18, and we don't knowingly collect children's information.
10. Your rights
You may, at any time: request confirmation of whether we hold personal information about you; ask what personal information we hold about you and get a copy; ask us to correct or delete it; object to processing based on our legitimate interests; withdraw marketing consent; and formally request records under the Promotion of Access to Information Act using our PAIA Manual (published on this site). Start with a message to our Information Officer; most requests are resolved in a day or two.
If you believe we've mishandled your personal information and we haven't fixed it, you may complain to the Information Regulator (South Africa):
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- P.O. Box 31533, Braamfontein, Johannesburg, 2017
- 010 023 5200
- General enquiries: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- PAIA complaints: PAIAComplaints@inforegulator.org.za
- www.inforegulator.org.za
11. Cookies
The site uses only the cookies it needs to work: keeping your Crate together while you shop (a cookie set by Ecwid, the platform that runs our store), and the security cookies our hosting provider (Cloudflare) sets to protect the site. No advertising or cross-site tracking cookies.
12. Changes
If we change this notice, the new version is published here with a new date. Material changes affecting how we use your information will be flagged clearly on the site.
Wesley van der Walt (sole proprietor) trading as Old Tree Yard · 23 Sunbirdway, 1 Fish Eagle Drive, Hilltop Estate, Ballito, KwaZulu-Natal, 4420, South Africa · Information Officer: Wesley van der Walt, wesley@oldtreeyard.co.za