Privacy policy
Last updated: 20/09/2026
Who we are
Shady Co. is a trading name of Ninety Six South (Pty) Ltd, registration number 2025/541409/07. We're the responsible party for your personal information under South Africa's Protection of Personal Information Act (POPIA).
- Address: 96 Besembos Street, Mayberry Park
- Email: hello@shadyco.co.za
- Information Officer: Michael Boswell
Who this applies to
This policy applies to you if you're a visitor to our website, or a customer who has ordered or asked about what we make.
Our store is for people over 18. We don't knowingly collect anything from a child. If you believe we hold information about a child, email us and we'll delete it.
What we collect
When you buy something: your name, delivery address, email address, phone number and order details. Your card or bank details go straight to our payment provider — we never see them or store them.
When you join the waitlist or the newsletter: your email address.
When you browse: device and browser information, the pages you look at, and how you found us. That's collected through cookies and similar technology.
Why we use it
- To process, pack and deliver your order, and to handle returns
- To send order confirmations and delivery updates
- To answer your questions
- To send marketing emails, only if you've asked us to
- To understand how the site is used, so we can improve it
- To meet our legal and tax obligations
We don't sell your personal information, and we don't share it with anyone except the service providers below.
Most of what we hold is because we need it to fill your order. Tax records we hold because the law requires it. Analytics we hold on our own legitimate interest in knowing how the shop is used.
Everything else rests on your consent, and you can withdraw that whenever you like.
Marketing
We'll only email you about our own pieces, and only if you've asked us to — by joining the waitlist, subscribing, or ticking the box at checkout.
Every message carries our name and a way to stop them. Unsubscribing ends the marketing. You'll still get the emails that belong to an order — your confirmation, and your tracking number.
Who we share it with
- Shopify — hosts our store and processes orders on our behalf
- Stitch — processes payments
- Courier partners — deliver your order, and need your name, address and phone number
- Zoho — sends our emails
- Google Analytics — measures how the site is used
- Government or law enforcement, where we're legally required to
Inside Shady Co., your information is seen only by the people who need it to fill your order or answer your question.
Where your information goes
Shopify and some of our providers store data outside South Africa. POPIA allows this where the receiving country offers comparable protection, or where the provider is contractually bound to equivalent standards. That's the case here.
Shopify
Our store runs on Shopify, so what you send us passes through their systems.
Shopify also uses some of that information for its own purposes across the stores it runs, personalised advertising in particular. For that, Shopify is the responsible party rather than us. You can read what they do with it in the Shopify Consumer Privacy Policy, and exercise your rights over it directly through the Shopify Privacy Portal.
Other sites
Where we link somewhere that isn't ours, that site's privacy policy applies and not this one.
Cookies and analytics
Our site uses cookies to keep your cart working, remember your preferences and measure traffic. You can block cookies in your browser, but parts of the store — the cart in particular — will stop working properly.
We use Google Analytics to see which pages people read and where they arrive from.
How long we keep it
Order records: 7 years, which covers what tax and company law require of us. Marketing subscriptions: until you unsubscribe. Everything else: only as long as it's needed for the reason it was collected.
Your rights
Under POPIA you can:
- ask what personal information we hold about you, and get a copy
- have it corrected or deleted
- object to us using it for direct marketing
- withdraw your consent at any time
- complain to the Information Regulator if you think we've mishandled it
Email hello@shadyco.co.za and we'll respond within 30 days. Before we act on a request we'll check that you are who you say you are. If someone is asking on your behalf, we'll need proof that you've asked them to.
Information Regulator of South Africa — enquiries@inforegulator.org.za
Keeping it safe
Our store runs over an encrypted connection, and payments are handled by a PCI-compliant provider. Access is limited to the people who need it. No system is perfectly secure. We don't hold card details.
Email isn't a secure channel. Don't send us card numbers or anything else confidential that way.
Change of ownership
If Shady Co. is sold or merged, your information moves with it, and the buyer is bound by this policy until they tell you otherwise. If you'd rather we deleted yours first, email us and we will.
Changes
If we change this policy we'll update the date at the top. If the change is material, we'll tell everyone on our mailing list.
General
This policy is governed by South African law. If any part of it turns out to be unenforceable, the rest still stands.