Privacy policy

Who is responsible

Milan's Spiritual & Cultural Store is the responsible party for the personal information described here.

What we collect, and why

• Order and delivery details — your name, email address, mobile number and delivery address. We collect these only when you check out, and we use them to process your order, deliver it, and contact you about it.
• Order contents — the items you bought, including any hamper contents and gift-card message, so we can pack the right parcel.
• Payment reference — the reference PayFast returns to us. We never see, receive or store your card number, PIN or banking login.

We do not create shopper accounts, and we do not run advertising or analytics trackers on this site.

Your cart stays in your browser

Your shopping cart is stored in your own browser's local storage under the key milans-cart-v1. It is not sent to us until you check out, and clearing your browser data removes it. We do not use cookies to track you.

Who else processes your information

• PayFast (Payfast (Pty) Ltd) — our payment operator. You complete payment on PayFast's own secure page; they handle your card details and email your payment confirmation directly to you.
• Google Firebase — hosts our product catalogue and order records.
• Vercel — hosts and serves this website.
• Our courier — receives the name, address and contact number needed to deliver your parcel.

Your order information is stored in South Africa. Our database is hosted in Google's Johannesburg region, and the servers that process your checkout run in Cape Town. Some of these providers are international companies and may access data from abroad for support purposes; where that happens we rely on their contractual data-protection commitments, and we share only the minimum needed to fulfil your order. We never sell your personal information.

How long we keep it

Order records are kept for as long as we need them to fulfil the order, honour returns, and satisfy tax and consumer-protection record-keeping obligations (generally five years). Checkouts that are started but never paid are removed automatically after 48 hours.

How we protect it

Order data is stored in an access-controlled database that is closed to public reads and writes. Only allow-listed staff accounts can view orders, and every administrative action is authenticated. The site is served over HTTPS.

Your rights

Under POPIA you may ask us to confirm what personal information we hold about you, to correct it, or to delete it where we are not legally required to keep it. You may also object to our processing it. Email info@milans.co.za and we will respond within a reasonable time. If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Changes to this policy

If this policy changes we will update the date at the top of this page. Please also read our terms and conditions.