Privacy Policy – Lu Lights

Effective Date: 1 April 2026

1. Introduction

Lu Lights (“we”, “us”, or “our”) is committed to protecting your privacy and ensuring that your personal information is collected and used properly, lawfully, and transparently.

This Privacy Policy complies with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), which regulates how personal information must be processed in South Africa.

By using our website, you agree to the terms of this Privacy Policy.

2. Who We Are

Lu Lights is an online store specialising in custom Soy wax candles.

We act as the “Responsible Party” under POPIA, meaning we determine how and why your personal information is processed.

3. Personal Information We Collect

We may collect and process the following personal information:

  • Name and surname
  • Email address
  • Phone number
  • Delivery address
  • Order and transaction details
  • IP address and browsing data

This information is collected when you:

  • Place an order
  • Contact us via email or forms
  • Subscribe to communications
  • Browse our website

POPIA requires that only relevant and necessary information be collected.

4. How We Collect Information

We collect information:

  • Directly from you (e.g. checkout, contact forms)
  • Automatically (via cookies and analytics tools)
  • From third parties (e.g. payment providers such as PayFast)

5. Purpose of Processing Personal Information

We process your personal information for the following purposes:

  • To process and fulfil your orders
  • To arrange delivery of your products
  • To communicate with you regarding orders or enquiries
  • To send marketing communications (only with your consent)
  • To improve our website and services

Under POPIA, personal information must be collected for a specific, lawful purpose and not used beyond that purpose.

6. Legal Basis for Processing

We process your personal information where:

  • You have given consent
  • It is necessary to fulfil a contract (e.g. completing your order)
  • It is required to comply with legal obligations

7. Sharing of Personal Information

We may share your personal information with:

  • Payment processors (e.g. PayFast)
  • Courier and delivery service providers
  • Website hosting and technical service providers

We do not sell or rent your personal information.

All third parties are required to process your data securely and in accordance with POPIA.

8. International Data Transfers

Some service providers (such as payment platforms or communication tools like WhatsApp) may process data outside of South Africa.

Where this occurs, we ensure that:

  • Adequate data protection safeguards are in place, or
  • You have provided consent

This aligns with POPIA requirements for cross-border data transfers.

9. Cookies and Website Tracking

We use cookies to:

  • Improve your browsing experience
  • Analyse website traffic
  • Remember your preferences

You can disable cookies in your browser settings.

10. Data Security

We take reasonable technical and organisational measures to protect your personal information from:

  • Loss
  • Unauthorised access
  • Misuse or disclosure

This includes secure systems, restricted access, and trusted service providers.

POPIA requires businesses to implement appropriate security safeguards to protect personal data.

11. Data Retention

We retain personal information only for as long as:

  • Necessary to fulfil the purpose it was collected for
  • Required by law
  • Needed for legitimate business purposes

Information that is no longer required will be securely deleted or anonymised.

12. Your Rights Under POPIA

You have the right to:

  • Access your personal information
  • Request correction or updating of your data
  • Request deletion of your data
  • Object to processing
  • Withdraw consent at any time
  • Lodge a complaint with the Information Regulator

These rights are provided under POPIA to protect your personal information.

13. Direct Marketing

We will only send you marketing communications if:

  • You have consented, or
  • You are an existing customer and have not opted out

All marketing communications will include an option to unsubscribe.

14. Information Officer

In terms of POPIA, Lu Lights has appointed an Information Officer responsible for compliance.

For any privacy-related queries, please contact:

📧 lu@lulights.co.za

15. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.