1. Who we are

This website is operated by M & CO, an online jewelry brand based in South Africa. We are the "responsible party" for your personal information under the Protection of Personal Information Act (POPIA). In this policy, "we", "us" and "our" mean M & CO.

2. What information we collect

Depending on how you use our website, we may collect:

• Contact details: your name, email address and phone number
• Delivery details: your delivery address, or the pickup point you choose
• Order details: what you bought, the price paid, and your order history
• Payment information: processed securely by our payment provider. We never see or store your full card details
• Technical information: your device, browser, IP address and how you use our website, collected through cookies and similar tools
• Messages: anything you send us, such as questions, feedback or reviews

3. How we use your information

We use your personal information to:

• Process and deliver your orders, and keep you updated about them
• Handle returns, refunds, exchanges and customer support
• Send you marketing emails or messages about our offers, discounts and new products, but only if you have agreed to receive them
• Improve our website, products and shopping experience
• Prevent fraud and keep our website secure
• Meet our legal, tax and accounting obligations

4. Why we are allowed to use it

We process your information where it is needed to carry out your order, where we have your consent (for example, for marketing), where the law requires it, or where we have a legitimate interest that does not override your rights, such as keeping our store secure and improving our service.

5. Who we share it with

We do not sell your personal information. We share it only with trusted service providers who help us run our store, and only as much as they need to do their job:

• Shopify, which hosts our online store and processes orders
• Payment providers, who process your payment securely
• Couriers and delivery partners, such as Aramex, PUDO and PostNet, who need your name, address and contact number to deliver your parcel
• Email, marketing and analytics tools, where we use them to communicate with you and understand how our website is used
• Authorities or professional advisers, where the law requires it or to protect our legal rights

6. Storing your information outside South Africa

Some of our service providers, including Shopify, may store or process information on servers outside South Africa. Where this happens, we only use providers that protect your information to a standard comparable to POPIA.

7. Cookies

We use cookies and similar technologies to keep your cart working, remember your preferences, understand how visitors use our website, and measure our marketing. You can control or delete cookies in your browser settings, but some parts of the website, like the cart and checkout, may not work properly without them.

8. How long we keep your information

We keep your personal information only for as long as we need it for the purposes above, including to meet legal, tax and accounting requirements, and to handle any returns or disputes. After that, we delete it or make it anonymous. If you subscribe to our marketing messages, we keep your contact details until you unsubscribe.

9. How we protect it

We take reasonable steps to keep your personal information safe, including using a secure, encrypted checkout and limiting who can access it. No online system is completely secure, but if there is a security breach that puts your information at risk, we will notify you and the Information Regulator as required by law.

10. Marketing and your choices

If you have signed up for our emails or messages, you can unsubscribe at any time by clicking the "unsubscribe" link in any message or by contacting us. You will still receive important messages about your orders.

11. Your rights under POPIA

You have the right to:

• Ask us whether we hold personal information about you, and request a copy of it
• Ask us to correct or update information that is wrong or incomplete
• Ask us to delete your information, where we no longer need it or have no legal reason to keep it
• Object to us using your information, including for direct marketing
• Withdraw your consent at any time, where we rely on consent
• Complain to the Information Regulator (South Africa) if you believe your information has been mishandled

To use any of these rights, contact us using the details below. We may need to confirm your identity first, and we will respond within a reasonable time.

12. Children

Our website is not meant for children under 18, and we do not knowingly collect their personal information. If you believe a child has given us information, please contact us and we will delete it.

13. Links to other websites

Our website may link to other websites, such as courier tracking pages or social media. We are not responsible for their privacy practices, so please read their policies.

14. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.

15. Contact us

For any privacy questions or requests, contact our Information Officer at [your email address] or through our contact page.

You also have the right to contact the Information Regulator (South Africa) at inforegulator.org.za.