← Back to Holoza

Privacy policy.

Last updated: 20 July 2026

Holoza (“we”, “us”) runs the card shop and waitlist at holoza.club. We are the responsible party for the personal information collected here, as defined in the Protection of Personal Information Act, 2013 (POPIA). This page explains exactly what we collect, why, who we share it with, and what your rights are. We collect what an order needs, nothing more. We still don't even ask your name.

What we collect

When you order: your email address, an optional phone number (the courier uses it for delivery-day SMS and locker PINs), and where to send the parcel: either a street address (street, suburb, city, province, postal code, home or business) or the PUDO locker you picked. We keep what you ordered and what you paid as your order history. Your cart lives on our server against an anonymous random ID, not your identity.

When you join the waitlist: your email address, plus the referral code if you arrived via a shared link. When you ask for a back-in-stock alert: your email address and the item, with the timestamp of your consent. Your IP address is used briefly in server memory to stop abuse (rate limiting); it is not stored in our database.

Why we collect it

Specific purposes, per POPIA: to take your payment, get your parcel to you, send you the emails an order needs (receipt, order status, tracking), and answer you when something goes wrong. Waitlist mail and back-in-stock alerts are opt-in only (you actively tick a consent box, never pre-ticked) and are used for exactly what the box said. We will not use your details for anything else.

Who we share it with

Only the operators who make your order happen, each for that purpose alone:

  • The Courier Guy (Shiplogic): your delivery address, email, and phone number, so they can quote, deliver, and send you tracking SMS.
  • PUDO: the locker network, when you choose locker delivery; your collection PIN arrives by SMS via the courier.
  • Yoco(Yoco Technologies (Pty) Ltd): our payment processor. You pay on Yoco's secure page by card, Apple Pay or Google Pay; your payment details go to Yoco, never to us. We never see or store them.
  • Resend: the service that delivers our emails, holding the addresses we send to.

That's the whole list. We never sell your information and we never share it with anyone for their own marketing.

Cookies

Functional cookies only, with no advertising and no cross-site tracking:

  • hz_cart: the anonymous ID of your cart, kept for 60 days.
  • hz_checkout_<order>: lets the browser that placed an order see that order's status page; expires after a day.
  • hz_drop_<drop>: your early-access pass when you open a drop link from a waitlist email; expires after 12 hours.
  • hz_admin: staff sign-in for the back office. Not set for customers.

How long we keep it

Order records are kept: we need them to honour returns, sort out warranty and delivery disputes, and meet our record-keeping obligations. Idle carts are deleted after 60 days. A back-in-stock request is used once: after the alert goes out we never email you about that item again, and unsubscribing deletes every pending request for your address. Waitlist addresses stay on the list until you unsubscribe or ask us to delete them.

Unsubscribe anytime

Every waitlist email and every stock alert carries a one-click unsubscribe link. Click it and you're out: no questions, no delay. Order emails (receipt, tracking) aren't marketing; they arrive only because you ordered.

Your POPIA rights

You may ask us at any time what personal information we hold about you, ask us to correct it, or ask us to delete it. We'll delete everything we're not legally required to keep, and tell you plainly what remains and why. You may also lodge a complaint with the Information Regulator (South Africa) at inforeg.org.za.

Contact

Anything about your data: hello@holoza.club. We answer.