Privacy Policy

Effective date: 05 October 2026

This policy explains how Bathroom Shop collects, uses, shares and protects personal information when you browse our website, request a quotation, contact us or deal with us about an order. It also explains your privacy choices and rights under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).

1 Who is responsible for your information

Bathroom Shop is the trading name of Zakhe Masimini Group Pty Ltd (we, us or our). We are the responsible party for the personal information we determine how and why to process.

Location: Online store, Randburg, Johannesburg
Privacy enquiries: sales@bathroomshop.co.za
Telephone: 010 500 7354
Website: https://bathroomshop.co.za/

Personal information means information about an identifiable living person and, where applicable, an identifiable existing company or other juristic person. Processing includes collecting, storing, using, sharing and deleting that information.

2 Information we collect and where it comes from

The information depends on your interaction with us. We collect only information reasonably needed for the relevant purpose. It may include:

  • Contact and enquiry details: your name, email address, telephone number, enquiry subject, messages and information you choose to provide by website form, email, telephone or WhatsApp.
  • Quotation and transaction details: products, quantities, finishes, project requirements, quotation and order history, company or billing information, delivery details, invoices, payment references or status, and return or warranty correspondence.
  • Technical information: IP address, browser and device details, request times, page or request information and session identifiers, where generated by the website, its hosting or security services.

We usually receive information directly from you. We may also receive information from someone authorised to act for you, a business customer naming you as a contact, or a supplier or delivery provider handling your request. Where required, we will tell you about information collected from another source.

Please provide accurate information, tell us about relevant changes and avoid sending information we do not need. If you give us another person’s information, you must have authority or another lawful reason to do so and tell them about this policy.

3 Why we use information and our lawful grounds

We process personal information only where a lawful ground under POPIA applies. Depending on the interaction, the purposes and grounds are:

  • Enquiries and quotations: to understand your requirements, check products and pricing, prepare a quote and respond to you. This is necessary to take steps at your request towards a contract or to pursue our legitimate interest in responding to a genuine enquiry.
  • Orders and customer service: to administer an agreed purchase, issue invoices, arrange delivery and handle returns, warranties or disputes. We rely on contractual necessity, applicable legal obligations and legitimate interests in administering the customer relationship.
  • Business administration and security: to keep appropriate records, reconcile transactions, maintain the website, investigate misuse and protect our customers and business. We rely on applicable legal obligations and legitimate interests, subject to your rights.
  • Marketing: only on the basis explained in section 5. Where consent is required, we ask for it separately and keep a record of your choice.

Relevant legal obligations may include those under tax, company, consumer-protection, access-to-information and data-protection laws. We will identify a specific compulsory legal requirement where it applies to a request for information. If we need to use information for a materially different purpose, we will ensure that the use is lawful and give any additional notice or obtain consent required by law.

4 Whether you must provide information

You can browse the catalogue without submitting an enquiry. Forms indicate required fields where applicable. Supplying enquiry or quotation information is generally voluntary, but we may be unable to respond, prepare an accurate quotation, fulfil an order or resolve a claim without the details needed for it. Optional information is your choice.

The website’s quote-list process does not require online payment. If you proceed with a purchase, we use the necessary transaction and delivery information to administer it. Do not send card numbers, passwords or one-time security codes through enquiry forms, email or WhatsApp.

5 Marketing and your choices

Submitting an enquiry or requesting a quotation does not automatically sign you up for promotional messages. We may contact you about the request itself, including the information needed to prepare your quote or administer your order.

If we send electronic direct marketing, we will do so with your consent or under POPIA’s existing-customer exception. That exception applies only where we obtained your details in a sale, market our own similar products or services, and gave you a free, simple opportunity to object when the details were collected and in every marketing message.

Marketing messages will identify us and provide a way to stop further marketing. You can also contact us using section 13. Withdrawing marketing consent or objecting to marketing will not affect necessary service messages. We may keep the minimum suppression record needed to respect your choice.

6 Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies can store browser information or recognise a device or session. They may contain identifiers that are personal information. Website functions such as a quote list, session management, preferences and security may depend on these technologies.

Where we rely on consent for optional tracking, we will obtain it before that tracking is used and provide a way to withdraw it. We do not treat continued browsing as blanket consent. You can also manage or remove cookies using your browser settings; blocking necessary cookies may affect website or quote-list functions.

Cookie consent management: We use Cookiez by Elementor to display cookie choices and keep a record of them. Elementor receives consent/category choices, browser information and our homepage URL for this purpose. This may involve processing outside South Africa. You can use Cookie preferences to change your choice. See Elementor’s Privacy Policy.

Optional Google Analytics is now configured to measure visits and successfully submitted quote requests after you allow Analytics cookies. Google receives browser/device and session information, limited page and referral information and a quote-success event. Network connections also expose your IP address to Google. Our integration is configured to exclude names, contact details, quote contents, order identifiers and payment details, and to keep advertising features off. Reporting and end-to-end checks are in progress. You can withdraw consent through Cookie preferences; this changes future measurement and cannot recall information already sent. We set Analytics cookies to expire after 180 days without extending on each visit. Google may process information outside South Africa. See Google’s Privacy Policy.

7 When we share information

We share only the information reasonably needed for a lawful purpose. Depending on your interaction, recipients may include:

  • Service providers supporting website hosting, email, communications, maintenance, security and record keeping.
  • Product suppliers or manufacturers helping with availability, a quotation, an order or a warranty; and delivery providers needing relevant recipient and delivery information.
  • Professional advisers, auditors, insurers or authorities where a lawful obligation, claim or other justified purpose requires disclosure.

People and providers processing information on our behalf must act within our authorisation. Where a provider is an operator under POPIA, we require a written agreement addressing the required security safeguards and confidentiality. Some recipients act as independent responsible parties for their own lawful purposes and have their own privacy notices.

We do not sell personal information. We do not give a supplier permission to use your information for unrelated marketing merely because it helps us with your quote or order.

8 Information processed outside South Africa

Online hosting, communications or support arrangements can involve processing in another country. Any transfer we make outside South Africa must satisfy section 72 of POPIA. This may include adequate protection under the recipient’s law, binding corporate rules or a binding agreement, including appropriate onward-transfer safeguards, or another permitted basis such as consent or contractual necessity.

9 External websites and messaging platforms

Links to supplier websites or third-party services take you to services with their own privacy practices. If you choose to contact us using WhatsApp or another external platform, that platform also processes information under its terms and privacy notice. We remain responsible for our own use of information we receive.

10 How long we keep information

We retain personal information only for as long as needed for its purpose or as otherwise permitted or required by law. The period depends on whether an enquiry remains open, whether a quotation becomes an order, the customer relationship, applicable tax or accounting requirements, warranty matters, and any claim, investigation or legal hold.

When retention is no longer justified, we delete, destroy or de-identify information as soon as reasonably practicable. Information retained for a legal hold is restricted to the relevant purpose. You may ask us about the retention approach applying to your information.

11 Security and security compromises

We are required to protect the integrity and confidentiality of personal information with appropriate, reasonable technical and organisational measures. This includes identifying foreseeable risks, maintaining safeguards, checking their effectiveness and updating them as risks change. No internet transmission or storage system can be guaranteed completely secure.

If there are reasonable grounds to believe that an unauthorised person has accessed or acquired personal information, we will investigate and take appropriate remedial steps. We will notify the Information Regulator and affected people as soon as reasonably possible where POPIA requires, subject to its permitted exceptions or delays. Operators acting for us must notify us immediately when they have reasonable grounds to believe that such a compromise has occurred.

12 Your rights and how to exercise them

Subject to POPIA and other applicable law, you may:

  • Ask, free of charge, whether we hold personal information about you and request access to it, including information about third parties or categories of third parties that have had access.
  • Ask us to correct or delete information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained, or destroy or delete a record we are no longer authorised to retain.
  • Object on reasonable grounds relating to your circumstances to processing based on certain legitimate-interest grounds, unless legislation provides for it, and object at any time to direct marketing.
  • Withdraw consent for future processing where we rely on it. This does not affect the lawfulness of processing before withdrawal or processing supported by another lawful ground.
  • Subject to POPIA’s exceptions, not be subject to a decision based solely on automated processing intended to profile you where that decision has legal consequences or substantially affects you.
  • Complain to the Information Regulator and exercise other remedies available under applicable law.

Contact our Information Officer using section 13 and explain your request. We will take reasonable steps to verify your identity and authority without collecting unnecessary information. Access is subject to applicable legal procedures, refusal grounds and any permitted prescribed fee; we will explain any fee before proceeding. We will respond within the applicable legal period and explain if we cannot grant all or part of your request. These rights do not require us to delete information that must lawfully be retained.

13 Contact us or lodge a complaint

For privacy questions, an objection or a request to exercise your rights, contact Bathroom Shop’s Information Officer using the details in section 1. Please use “Privacy request” as your email subject where possible.

Email: sales@bathroomshop.co.za
Telephone: 010 500 7354

You may contact us to help resolve a concern, but you do not have to do so before complaining to the Information Regulator (South Africa).

Information Regulator (South Africa)
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
POPIA complaints email: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200 or 0800 017 160
Website and current complaint instructions: https://inforegulator.org.za/complaints/
Online complaints portal: https://eservices.inforegulator.org.za/complaints/default.aspx

14 Children and sensitive information

Our quotation and ordering services are intended for adults acting for themselves or an authorised organisation. We do not ask children to submit their personal information. A parent, guardian or other legally competent person should contact us where a child’s information is genuinely needed. We will process it only where POPIA permits and will obtain the required consent or other lawful authorisation.

Please do not send identity documents, health information or other sensitive information unless we specifically explain why it is needed and how to provide it appropriately. If you believe a child has provided information without the required authorisation, contact us so we can assess and address it.

15 Changes to this policy

We may update this policy when our services, practices or legal requirements change. The current version and effective date will appear on the website. Where a change requires additional notice or consent, we will provide that notice or request that consent. A policy update does not itself authorise a new use of your personal information.