Privacy Policy

1. Who we are

This policy explains how Lapanza 3D Creative Lab ("Lapanza", "we", "us") collects, uses, and protects your personal information when you use this website or buy from us, in line with South Africa's Protection of Personal Information Act (POPIA).

Lapanza 3D Creative Lab is a partnership owned and operated by Johan Barkhuizen and Linandi Barkhuizen. Johan Barkhuizen is our Information Officer — the person responsible for POPIA compliance and your point of contact for any privacy question or request.

• Address: 23 Gladiator Rd, Pierre van Ryneveld, Centurion, Gauteng, South Africa
• Email: lapanzaonline@gmail.com
• Phone: 082 663 9608

2. What we collect, and why

We only collect what we actually need to run the shop, talk to you, and keep the site working. Here's every point personal information reaches us:

Placing an order or creating an account

Name, email, phone number, delivery address, and (for a registered account) a password — which we never see or store in plain text, only as a securely hashed value. Used to process and deliver your order, send order/account emails, and let you log in to view your order history.

Payment

Card, wallet and Instant EFT payments are handled entirely by Payfast — we never see or store your card or banking details. We do receive and keep a record of the payment confirmation Payfast sends us (amount, payment method, and a payment reference) against your order, for accounting and fraud/dispute purposes.

Custom design requests

If you submit a custom design/print request, we collect your name, email, phone (optional), a description of what you need, and any reference image or file you upload. Used to quote and fulfil your request.

Uploaded design files are treated as confidential: they are used only to quote and produce your request, are accessible only to the two owners, and are never shared with third parties or used for other customers' work. Files are automatically deleted 12 months after your request is finalized (the request record itself is kept for business records); you can also ask us to delete your files earlier at any time via the contact details above.

Newsletter

Just your email address, only if you opt in yourself, confirmed via a double opt-in email before we send you anything. You can unsubscribe with one click at any time.

WhatsApp updates

If you separately opt in to WhatsApp updates, we use the phone number on your account to send order/product updates via WhatsApp. This is always opt-in, and you can opt out at any time from your account or by telling us.

Website usage

We track basic, first-party visit data — which pages are viewed, roughly how many people are browsing, and shopping-flow interactions such as adding an item to the cart, starting checkout, or requesting a quote — to understand how the site is used. This is tied to a random, anonymous ID stored in your browser, not your IP address (we don't record IP addresses for this). If you're logged in to your account while browsing, this visit data is associated with your account, so we and our systems can, for example, show an admin which of your pages you're currently viewing — the same way any logged-in website session works.

3. Cookies & similar technology

We keep this deliberately minimal — we don't use advertising or third-party tracking cookies, so we don't run a cookie-consent banner. Here's exactly what's used:

• Session cookies — a strictly-necessary cookie that keeps you logged in to your account (or, for us, the admin area). It's essential for the site to function and contains no readable personal information, just a random session token.
• Local browser storage (not a cookie, but similar) — used to remember your shopping cart, your light/dark theme preference, and the anonymous visit-tracking ID mentioned above. This stays on your device and isn't sent to us unless you check out.
• Google Fonts — this site loads typefaces directly from Google's servers, which as a normal part of serving a font receives your device's IP address. We don't control what Google does with that; see Google's own privacy policy for detail.

4. Who we share your information with

We use a small number of trusted service providers to run the business — we don't sell or rent your information to anyone, ever. Each of the following only receives what it needs to do its job:

• Payfast — processes your payment. Receives your name, email, and order amount to complete the transaction.
• Google (Gmail) — we send all order confirmations, account, and notification emails through Gmail's infrastructure, so your email address and the email content (which may include your name and order details) passes through Google's systems as part of sending it.
• Google Drive — our database backups (which include order and customer records) are automatically mirrored to a private Google Drive folder each night, purely as an off-site disaster-recovery copy in case of a server failure. This isn't shared publicly or with any other party.
• Meta (WhatsApp Business) — if you've opted in to WhatsApp updates, your phone number and the message content are sent via Meta's WhatsApp Business platform to deliver that message.

Some of these providers (Google, Meta) may process or store information on servers outside South Africa as part of their normal global infrastructure. Where that happens, it's only for the specific purposes listed above, with those providers' own standard security and data-protection commitments in place — we don't otherwise transfer your information out of South Africa or share it with anyone for their own marketing purposes.

We may also disclose information where required by law, to comply with a legal process, or to protect our rights, safety, or property.

5. How long we keep it

We keep personal information for as long as we reasonably need it: while your account is active, for as long as needed to fulfil an order and handle any warranty/returns period after it, and beyond that where we're legally required to keep financial/accounting records. Website backups are kept on a rolling basis (the most recent ones only, older ones are automatically removed) both locally and in the off-site Google Drive copy described above. If you'd like your account and personal information removed sooner, contact us and we'll action it, subject to anything we're legally required to keep on record (e.g. completed order/financial history).

6. How we protect it

Passwords are never stored in readable form — only as a one-way cryptographic hash. Our admin area requires a separate authenticated login, session cookies are set to be inaccessible to page scripts (httpOnly), and admin login attempts are rate-limited against brute-force attempts. As with any online service, no method of transmission or storage is 100% secure, but we take reasonable, proportionate steps for a business our size to keep your information safe.

7. Your rights under POPIA

You have the right to:

• Ask us to confirm what personal information we hold about you, and get a copy of it.
• Ask us to correct information that's inaccurate, out of date, or incomplete.
• Ask us to delete personal information we no longer have a valid reason to keep.
• Object to us processing your information for direct marketing at any time — and withdraw newsletter/WhatsApp consent whenever you like.
• Lodge a complaint with us directly, or with South Africa's Information Regulator, if you believe we've mishandled your information.

To exercise any of these, email our Information Officer at lapanzaonline@gmail.com. We'll respond as promptly as we reasonably can.

You can also contact the Information Regulator directly: inforegulator.org.za, complaints via POPIAComplaints@inforegulator.org.za, general enquiries via enquiries@inforegulator.org.za or toll-free on 0800 017 160.

8. Children

This website isn't directed at children, and we don't knowingly collect personal information from anyone under 18 without a parent or guardian's consent.

9. Changes to this policy

We may update this policy as our tools or processes change — for example, if we add a new service provider. The version published here is always the current one; we'll update the "last updated" date whenever we make a change.