We reserve the right to make changes or amendment to this Privacy Policy at any time and for any reason. Such amendments shall supersede and replace any previous version(s). We will alert you about any changes by updating the “Last Updated” date.
The Protection of Personal Information Act 4 of 2013 (“POPIA”, the “POPI Act”) is aimed at the protection of Personal Information which is processed by both public and private bodies.
The purpose of the POPI Act is to address the recognition and protection of the right to privacy which is a fundamental human right enshrined in our Constitution. The Act stipulates requirements and conditions that businesses must comply with when processing Personal Information.
Ferndale Flowers (Pty) Ltd, Registration Number: 2018/102762/07 (“Ferndale Flowers, “us”, “we”) respects your, the user and/or customer’s, privacy and Personal Information and is committed to ensuring that your Personal Information is processed and safeguarded as prescribed in terms of the POPI Act.
Ferndale Flowers is a Supplier of flowers, flower arrangements, hampers, gift baskets, etc. (“Goods”). The Goods which are offered, advertised and available for sale, can be viewed, order and purchased at https://ferndaleflowers.co.za/ (“Website”).
This Privacy Policy applies to the processing of Personal Information that you, the user and/or customer, provides to and/or is processed by Ferndale Flowers and it forms part of the Terms and Conditions between you and Ferndale Flowers.
The purpose of this policy is to inform customers and users of the website, inter alia, of the type of Personal Information we collect, how we collect it, the purpose of collecting Personal Information and the safeguarding thereof.
By using the website and/or by submitting the applicable Personal Information, you acknowledge that you have reviewed the Policy and agree and consent that we may collect and process your Personal Information. In the event that you submit Personal Information relating to someone else, you confirm that you have obtained the necessary consent from such person that Ferndale Flowers may process the applicable Personal Information.
Personal Information relates to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person (such as an organisation), including, but not limited to information concerning:
race, gender, sex, pregnancy, marital status, national or ethnic origin, colour, sexual orientation, age, physical or mental health, disability, religion, conscience, belief, culture, language, and birth of a person;
information relating to the education or the medical, financial, criminal or employment history of the person;
any identifying number, symbol, email address, physical address, telephone number, location information, online identifier, or other particular assignment to the person;
the biometric information of the person;
the personal opinions, views, or preferences of the person;
correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
the views or opinions of another individual about the person;
the name of the person if it appears with other Personal Information relating to the person or if the disclosure of the name itself would reveal information about the person.
Special Personal Information is information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject or the criminal behaviour of a data subject.
POPIA defines “processing” to mean:
“any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including —
the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use, dissemination by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of information.”
In terms of the POPI Act a “data subject” means the person to whom Personal Information relates. When the definition of “data subject” is read together with the definition of “Personal Information”, it is clear that a “data subject” can be an identifiable, living, natural person and/or an identifiable, existing juristic person.
Any company (responsible person) who processes (collects, receives, records, organises, storages, etc.) Personal Information (name and surname, trading name, identification number, registration number, age, race, gender, email address, telephone number, physical address, educational qualification, criminal history, financial information, biometric information, etc.) of a data subject (the natural or juristic person to whom the Personal Information belongs or relates) must comply with POPIA.
Certain Personal Information is collected when you submit and provide the Personal Information when using the Website, ordering and purchasing Goods and/or submit an enquiry through the “Contact Us” form on the Website.
We may receive and/or collect Personal Information including, but not limited to:
Name and Surname;
Contact number;
Email address;
Billing address;
Delivery address;
Payment details such as order number, payment method, purchase amount and payment date; and/or
Information you submit through the Website using the “Contact Us” form (the html form on the Website).
It is the user’s responsibility to ensure that the information provided is true, accurate and correct.
Take note that we do not receive and/or collect any bank card or banking information. We utilise a secure payment system / portal / gateway which interacts with the Website by way of API (application programming interface).
In terms of Sections 9 of POPIA, Ferndale Flowers will collect and process clients’ Personal Information in a lawful and reasonable manner that does not infringe the privacy of the user / customer.
We may collect Personal Information from following sources:
Directly from the user / customer when you submit and provide the Personal Information when using the Website, ordering and purchasing Goods and/or submit an enquiry through the “Contact Us” form on the Website (HTML form on the Website);
From customers when they provide us with your information if you are the recipient of the Goods ordered and purchase through the Website;
Depending on your browser settings, from your web browser;
From the payment portal and platform, such as PayFast;
From the Website’s database; and/or
From third parties, if you interact with them through the use of the Website.
In terms of Section 12 of POPIA, in some circumstances, Personal Information is not collected directly from the user / customer and/or data subjects.
In the following situations, Personal Information may not be collected directly from clients and/or data subjects:
If the Personal Information is derived from public records;
If the Personal Information has been made public by the data subject;
From other sources which will not prejudice the legitimate interest of our clients / customers;
From other sources for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated;
From other sources to maintain our legitimate interest;
If the collection of Personal Information directly from clients / customers and/or data subjects would prejudice a lawful purpose of the collection; and/or
If compliance and collection of Personal Information directly from clients / customers and/or data subjects is not reasonably practicable in the circumstance.
In terms of Section 13 of POPIA, Personal Information may only be collected and processed for a specific, defined and lawful purpose which is related to a function or activity of Ferndale Flowers.
We collect, use and process Personal Information to inter alia:
Process orders and transactions;
Provide and deliver the Goods ordered and purchased;
Respond to customer enquiries;
Obtain information relating to the Goods ordered or the delivery thereof;
Inform customers of any relevant information relating to the Website, Goods advertised and/or Goods ordered and purchased;
Adhere to our contractual obligations and to perform in terms of the Terms and Conditions;
Maintain internal recordkeeping and to monitor and manage our business activities and operations;
Administer and manage staff;
Retain and maintain accounting and other records;
Adhere to a legal obligation (for example as prescribed by legislation).
In terms of Section 10, the above purposes for collecting and processing Personal Information is adequate, relevant and not excessive.
In terms of Section 11 of POPIA, we will only process or share your Personal Information if:
You have consented to the use and/or processing of your Personal Information;
The processing of your Personal Information is necessary to carry out actions for the conclusion or performance of a contract between you and us;
The processing of your Personal Information complies with an obligation imposed by law;
The processing of your Personal Information protects your legitimate interest; and/or
The processing of your personal information is necessary for pursuing a, or our, legitimate interest.
It is sometimes necessary for Ferndale Flowers to disclose customers’ / Website users’ Personal Information to third parties and other recipients on the following basis:
Customer / user has consented to the disclosure;
In terms of a legal obligation and/or as prescribed by law;
Processing is necessary for the provision of the Goods;
To service providers and / or consultants who are involved in the provision of the Goods;
To employees and staff of Ferndale Flowers as part of the provision of the Goods;
To protect the legitimate interests of Ferndale Flowers; and/or
To service providers if it required for our business activities and operation.
Where necessary or required, Ferndale Flowers shares Personal Information with, inter alia:
Third Party payment processors or platforms such as PayFast;
Employees, directors and/or shareholders of the Company;
Regulatory, legal and statutory bodies and government;
Service providers, suppliers, consultants, etc. (including service providers who offer cloud, online and other data storage services);
Banks or other financial institutions;
SARS; and/or
Accountant and auditors.
Ferndale Flowers may retain any record, which may contain personal information, even after the provision of the Goods, as the retention may be required in terms of a legal obligation and/or for the lawful purpose and functions of Ferndale Flowers.
We retain personal information for the purpose for which it was collected and processed as stipulated herein.
As soon as reasonably possible after the reason or purpose for the processing of your Personal Information ceases or lapses or when no legitimate legal and/or business reason or purpose exist for the processing and/or retention of your Personal Information, we will either delete and/or destroy or de-identify your Personal Information.
Any personal information kept indefinitely for statistical purposes, will be de-identified.
Ferndale Flowers may from time to time need to share Personal Information with third parties (suppliers and/or service providers) in other countries and transmit Personal Information transborder, which Personal Information may be stored in data servers / data centres hosted outside South Africa. We will endeavour to ensure that these third parties make all reasonable efforts to secure the Personal Information and/or that these countries have adequate data protection laws.
You, the user / customer, acknowledge and agree that it may be necessary for Ferndale Flowers to transfer your Personal Information outside South Africa in the following instances:
If and when we use an email service provider (like Microsoft Outlook or Microsoft Office 365 email) which is hosted outside South Africa;
If you provide us with an email address that is hosted outside South Africa; and/or
To administer certain services and for information operations and security, for example, cloud-based storage (data centre, OneDrive, SharePoint).
In terms of Section 34 of the POPI Act, there is a general prohibition on the processing of Personal Information of children.
We will not and do not intentionally and knowingly collect or process the Personal Information of children.
In accordance with our Terms and Conditions, by using the Website, placing an order and/or purchasing Goods, you acknowledge that you are at least 18 years old or, if minor, a competent person (parent or guardian), has consented to you using the Website, placing an order and purchasing the Goods and providing your Personal Information.
The user / customer may only provide us with a child’s Personal Information if the user / customer has obtained the consent of the child’s parent or guardian.
Should we become aware that a minor has provided Personal Information without the necessary consent or if Personal Information of a minor child has been collected, we will delete and destroy such Personal Information.
Ferndale Flowers makes use of technology and safeguarding measures to ensure the protection of Personal Information, such as:
Anti-Virus software and applications;
Physical security of office space;
Physical security of devices and documents;
Password protocols; and
Website SSL certificate to encrypt data sent to and from our Website.
In accordance with Section 22 of the POPI Act, if there are reasonable grounds to believe that the user’s / customer’s personal information has been accessed or acquired by any unauthorised person, we will notify the Regulator and if required, you, the data subject.
Although we take all reasonable measures to secure the Personal Information and data provided, collected and/or in our possession we cannot guarantee the unauthorised access thereto and/or use thereof. The user / customer agrees and acknowledges that the use and continued use of Ferndale Flowers’ Website, ordering and purchasing Goods and/or providing Personal Information is at the user’s own risk.
A data subject has the right to have his, her or its Personal Information processed in accordance with the conditions for the lawful processing of Personal Information as referred to in Chapter 3, including the right—
5. A data subject has the right to have his, her or its Personal Information processed in accordance with the conditions for the lawful processing of Personal Information as referred to in Chapter 3, including the right—
(a) to be notified that—
Personal Information about him, her or it is being collected as provided for in terms of section 18; or
his, her or its Personal Information has been accessed or acquired by an unauthorised person as provided for in terms of section 22;
(b) to establish whether a responsible party holds Personal Information of that data subject and to request access to his, her or its Personal Information as provided for in terms of section 23;
(c) to request, where necessary, the correction, destruction or deletion of his, her or its Personal Information as provided for in terms of section 24;
(d) to object, on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its Personal Information as provided for in terms of section 11(3)(a);
(e) to object to the processing of his, her or its Personal Information —
at any time for purposes of direct marketing in terms of section 11(3)(b); or
in terms of section 69(3)(c);
(f) not to have his, her or its Personal Information processed for purposes of direct marketing by means of unsolicited electronic communications except as referred to in section 69(1)
(g) not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its Personal Information intended to provide a profile of such person as provided for in terms of section 71;
(h) to submit a complaint to the Regulator regarding the alleged interference with the protection of the Personal Information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74; and
to institute civil proceedings regarding the alleged interference with the protection of his, her or its Personal Information as provided for in section 99.”
In terms of Section 11(3) of POPIA the data subject has the right to objection to the processing of Personal Information in accordance with Form 1 of the Regulations.
In terms of Section 23(1) & (2) of POPIA the data subject has the right to request the Company to confirm, free of charge, whether the Company hold any Personal Information about the data subject.
In terms of Section 24 the data subject has the right to request, where necessary, the correction, destruction or deletion of his/her/its Personal Information in accordance with Form 2 of the Regulations.
If you want to enforce any right and/or require information regarding the manner and form of the above objection and/or request(s), you can contact Ferndale Flowers at info@ferndaleflowers.co.za.
In terms of Section 74(1) of POPIA Clients and Data Subjects have the right to submit a compliant the Information Regulator regarding the alleged interference with the protection of the Personal Information.
The contact details of the Information Regulator are as follows:
The Information Regulator (South Africa)
33 Hoofd Street, Forum III, 3rd Floor Braampark
P.O Box 31533, Braamfontein, Johannesburg, 2017
Mr Marks Thibela, Chief Executive Officer
Tel No. +27 (0) 10 023 5200, Cell No. +27 (0) 82 746 4173
Complaints email: complaints.IR@justice.gov.za
General enquiries email: inforeg@justice.gov.za
Website: https://www.justice.gov.za/inforeg/
