Legal
Privacy Statement
In short
- We collect what we need to sell to you and deliver your order: your name, contact details, delivery address and what you bought. For a Mystery Boxx we also ask what you like. For a GB Kidz Boxx we ask the child’s first name and age, and you confirm that you are the child’s parent or guardian, or have their permission.
- We never see or store your card details. PayFast handles all payments.
- Google Analytics runs only if you accept analytics cookies.
- We share your information only with the companies that help us run the shop (hosting, security, payments, email, delivery), and never sell it.
- We keep it only as long as we need it: unpaid orders 30 days, failed and cancelled orders 90 days, completed orders 7 years (then your name and details, and a child’s name and age, are removed), unused accounts 2 years.
- You can ask to see, correct or delete your information, or object to how we use it: email [email protected]. You can also complain to the Information Regulator.
Who we are
GalaxyBoxx (Pty) Ltd, trading as Galaxy Boxx (“Galaxy Boxx”, “we”, “us”), runs the online shop at galaxyboxx.co.za. We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).
| Registered name | GalaxyBoxx (Pty) Ltd |
|---|---|
| Registration number | 2024/065276/07 |
| Registered address | 43 Neptune Way, Boardwalk, Pretoria, Gauteng, 0082, South Africa |
| [email protected] | |
| Information Officer | Eugene van Rooyen, director, reachable at [email protected] |
| Registration with the Information Regulator | Details available from the Information Officer on request |
Questions about this statement, and requests about your information, go to the Information Officer by email at [email protected]. We deal with questions by email.
What we collect and why
We only ask for what each step needs. Questions marked optional can be left blank.
When you browse the shop
| What | Why | Who handles it |
|---|---|---|
| Your IP address, browser and device type, the pages you ask for | To deliver the pages, keep the shop fast, and block attacks and abuse | Cloudflare (security and caching in front of the shop), Hostinger (our web server’s access log) |
| Cookies the shop needs to work: your cart, your login, your cookie choice | So the cart, checkout and your account work | Us; your choice is stored by our cookie banner (CookieYes) |
| Analytics: pages visited, how you arrived, device type, approximate location | To see what works on the shop and improve it. Only if you accept analytics cookies | Google Analytics. Without your consent the Google tag measures nothing |
You can change your cookie choice at any time with the “Consent Preferences” button on our Cookie Policy, which lists the cookies we use.
When you create an account
Your name, email address, password (stored scrambled, so nobody can read it) and, if you choose, your saved billing and delivery addresses. We use these to let you log in, see your orders and subscriptions, and check out faster. The login form has a human check from Cloudflare (Turnstile), which looks at signals from your browser to tell people from bots.
When you buy
| What | Why |
|---|---|
| Name, email address, phone number, billing and delivery address; company name (optional) | To process the order, deliver it, send you order emails and contact you about it |
| Pudo locker number or name (only when you choose Pudo delivery) | So the courier can deliver to your locker |
| What you bought, prices, delivery choice, order status and payment status | To fulfil the order, handle returns, and keep the sales records the law requires |
| Whether the order is a gift, and a short gift message (optional) | To write the gift card that goes in with the order |
| An order note (optional) | Anything you want us to know about the order |
| Your IP address and browser type, recorded with the order | To spot and prevent fraud |
| For a Mystery Boxx: the franchises and interests you tell us about, for example Pokémon, Marvel, DC Comics, Star Wars, Harry Potter, Dragon Ball Z, Lego or Gaming (optional) | To personalise your Boxx |
| For a GB Kidz Boxx: the child’s first name and age, the theme you choose (Little Scientist, Little Adventurer, Little Collector or Little Hero), and your confirmation that you are the child’s parent or guardian (or, for a gift, that you have the parent’s or guardian’s permission) | To pack a Boxx that is safe and suitable for that child’s age and to personalise it for them. See section 4 |
Payments. You pay on PayFast’s secure pages (card, Instant EFT and the other methods PayFast offers). We never see or store your card or bank details: PayFast tells us only whether the payment succeeded, with its reference.
When you subscribe to a Mystery Boxx
Everything under “When you buy”, plus your plan (tier and term), payment dates, and the history of your Boxxes. For the monthly payments PayFast keeps a secure reference to your payment method (a “token”); we hold only that reference, never the card itself. If you email us to change your franchises, we note the change on your subscription so the next Boxx is packed for it.
When you use our contact form or email us
Your name, email address, the subject (optional) and your message. The form emails your message to [email protected] and stores nothing on the website. To stop spam, the shop keeps a scrambled (one-way coded) form of your IP address for one hour to count messages. Your message then sits in our mailbox, which is hosted by Hostinger, for as long as we need it to deal with your question (see section 7).
When you write a product review
Your name, email address, rating and review. Your name, rating and review are shown publicly on the product page; your email address is not. A coded form of your email address may be sent to Gravatar (Automattic) to show your profile picture if you have one there.
When you follow our WhatsApp channel
You join our drop-alerts channel yourself, inside WhatsApp. WhatsApp (Meta) runs the channel under its own privacy policy. WhatsApp says channel admins cannot see a follower’s phone number unless they already have that number saved as a contact; we may see the name and picture your WhatsApp settings allow. We do not copy followers’ details out of WhatsApp. If you message us on WhatsApp, Facebook, Instagram or X, that platform also processes the conversation under its own policy.
Emails we send you
Order, account and subscription emails are sent through Hostinger’s mail server. Our email log records, for each email, the time, the recipient, the subject and whether it was delivered, so we can tell if an order email failed.
What we do not collect
We do not collect identity numbers, card details, or information about race, health, religion or other special personal information. Please don’t send us any. We do not buy personal information from others or collect it from public sources.
Our legal grounds (POPIA section 11)
| Ground | Used for |
|---|---|
| To carry out our contract with you | Orders, delivery, subscriptions, your account, returns, order emails, personalising your Boxx |
| To meet a legal duty | Keeping sales and tax records; responding to lawful requests from authorities |
| Our legitimate interests, balanced against yours | Security, preventing fraud and abuse, keeping short logs, fixing faults |
| Your consent | Analytics cookies; the optional gift message and interests; product reviews. You may withdraw consent at any time; this does not affect what we did before |
| The consent of a parent or guardian (a “competent person”, POPIA section 35) | A GB Kidz child’s first name and age (section 4) |
Giving us your contact and delivery details is voluntary, but without them we cannot take or deliver an order.
Children’s information
The shop is meant for adults. Children under 18 should not create an account or order without a parent or guardian.
For a GB Kidz Boxx we ask the adult buyer for the child’s first name and age (from a list, 1 to 17). The first name is needed to order a GB Kidz Boxx; the age is optional, but it helps us choose. We use them only to choose items that are suitable and safe for that age and to personalise the Boxx (for example its card) for that child. We do not ask for the child’s surname, birthday, school or picture, and we ask you not to put them in the gift message or order notes.
Under POPIA a child’s personal information may be processed with the prior consent of a “competent person”, usually a parent or legal guardian (section 35(1)(a)). That is why the checkout asks you to tick “I am the parent or guardian of this child”, or, when you mark the order as a gift, “I have the parent’s or guardian’s permission”. A GB Kidz order cannot be placed without that tick. Parents may also simply give their own details as the buyer.
The child’s name and age are used only to pack that Boxx, and are kept and removed with the order (section 7): when an order is anonymised, they are removed with the buyer’s own details.
Information processed outside South Africa
Some of our providers (including Cloudflare, Google and Hostinger) are international companies, so your information may be processed outside South Africa. Under POPIA section 72 we only allow this where the provider is bound by law, binding company rules or an agreement that protects your information to a standard similar to POPIA, or where the transfer is needed to carry out our contract with you, or with your consent.
How long we keep your information
The shop deletes or anonymises information automatically on these periods:
| Information | Kept for | Then |
|---|---|---|
| Unpaid (pending) orders | 30 days | Deleted |
| Failed and cancelled orders | 90 days | Deleted |
| Completed orders (shipped and finalised) | 7 years (84 months), because company and tax law require us to keep sales records | Anonymised: the sale stays in our records, but your name, contact details, addresses, the gift message, interests, order note and a GB Kidz child’s name and age are removed |
| Customer accounts not logged into or used for 2 years | 2 years | Deleted |
| Email delivery log | 30 days | Deleted automatically |
| Shop logs (faults and notices) | 30 days | Deleted automatically |
| Contact form spam counter (coded IP address) | 1 hour | Deleted automatically |
| Our web server’s access log (IP addresses) | Our hosting provider’s rotation period | Deleted or overwritten by Hostinger |
| Emails in our mailbox | 2 years, or longer while an order they relate to must be kept | Deleted |
| Product reviews | Until you ask us to remove them, or the product is removed | Deleted |
| Backups of the shop | Our hosting provider’s rotation period | Deleted or overwritten by newer backups |
The shop also keeps a staff activity log (staff logins and changes) for 30 days; it holds nothing about shoppers.
If you ask us to delete your information sooner, we will, except what we must keep by law (such as the sales record of a completed order), and we will tell you what we kept and why. Information deleted from the shop can stay in a backup until that backup is overwritten.
How we protect your information
- The whole shop runs over an encrypted connection (HTTPS), behind Cloudflare’s protection.
- Card payments happen only on PayFast’s pages; card details never reach us.
- Passwords are stored scrambled. Administrators use two-step login, and the login forms have a human check.
- Our logs are kept short and do not record passwords, card data or payment conversations.
- Only staff who need it can see customer information, and staff actions are logged.
- The shop is backed up daily.
No system is perfectly secure. If we find that your information has been accessed by someone not allowed to, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires.
Cookies
Our Cookie Policy explains the cookies we use and lets you change your choice at any time.
Marketing
We do not send marketing emails, SMSes or WhatsApp messages to individual customers. Order, account and subscription emails are not marketing; they are part of your order.
News about drops and releases goes out only on our WhatsApp channel and our social media pages, which you follow (and can unfollow) yourself.
If we ever start sending marketing messages, we will first ask for your consent (or, for existing customers, offer only our own similar products, with an easy way to say no in every message), as POPIA section 69 requires, and we will update this statement.
Your rights
Under POPIA you may:
- ask whether we hold information about you, and for a copy of it;
- ask us to correct information that is wrong or incomplete;
- ask us to delete information we no longer need or are not allowed to keep;
- object to us using your information on the ground of our legitimate interests, and to direct marketing at any time;
- withdraw any consent you gave (for example, change your cookie choice);
- complain to the Information Regulator (section 12).
We do not make decisions about you by automated means alone.
How to use your rights: email the Information Officer, Eugene van Rooyen, at [email protected] and say what you would like. We may ask you to confirm your identity first, so that we don’t hand your information to someone else. We will reply within 30 days. Asking is free, and so is a copy of your own information. You can also see and change your account details and addresses yourself under My Account.
Complaints
Please contact us first so we can try to put things right. If you are not satisfied, you may complain to the Information Regulator (South Africa):
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIA complaints [email protected]; general enquiries [email protected]; www.inforegulator.org.za.
Links to other websites
The shop links to other websites (for example WhatsApp, Facebook, Instagram, X and Google reviews). Their own privacy policies apply there.
Changes to this statement
We will update this statement when what we collect or how we use it changes. The date at the top shows the latest version. If a change matters to you, for example a new use of your information, we will tell you on the shop (and by email if you have an account or an active subscription) before it takes effect.