POPIA Notice

About This Notice

This notice is provided in compliance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa. It explains how Baba Bloom processes personal information and outlines your rights as a data subject.

Responsible Party

Baba Bloom (Pty) Ltd is the responsible party for the processing of your personal information.

Purpose of Processing

We process your personal information for the following purposes:

• To provide our baby registry services
• To create and manage your user account
• To track purchases and update registry status
• To communicate with you about your registry
• To process merchant billing and reconciliation
• To improve our services and user experience
• To comply with legal obligations

Categories of Personal Information

We collect and process the following categories of personal information:

• Identifiers (name, email address)
• Contact information (delivery address, phone number)
• Registry preferences and content
• Technical data (IP address, device information)
• Usage data (browsing activity on our platform)

Legal Basis for Processing

We process your personal information based on the following legal grounds under POPIA:

• Consent: When you create an account and registry
• Contract: To fulfil our service obligations to you
• Legitimate interest: To improve our services and prevent fraud
• Legal obligation: When required by law

Your Rights Under POPIA

As a data subject, you have the following rights:

• Right to access: Request a copy of your personal information
• Right to correction: Request correction of inaccurate information
• Right to deletion: Request deletion of your personal information
• Right to object: Object to the processing of your information
• Right to withdraw consent: Withdraw previously given consent
• Right to complain: Lodge a complaint with the Information Regulator

Exercising Your Rights

To exercise any of your rights, please contact our Information Officer at privacy@bababloom.co.za. We will respond to your request within a reasonable time, not exceeding 30 days.

We may need to verify your identity before processing your request.

Third-Party Sharing

We may share your personal information with:

• Partner merchants (limited attribution data for billing purposes)
• Service providers who help us operate our platform
• Authorities when required by law

We require all third parties to respect the security of your personal information and treat it in accordance with POPIA.

Data Security

We have implemented appropriate security measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. When your information is no longer needed, we will securely delete or anonymise it.

Complaints

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with:

Updates to This Notice

We may update this POPIA notice from time to time. The latest version will always be available on our website.