Privacy policy

Last updated: 24 September 2026

Merchhaus respects your privacy and processes your personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect, why, who we share it with, and the rights you have.

1. Who we are

[Registered company name] (registration number [registration number]), trading as Merchhaus ("Merchhaus", "we", "us"), is the responsible party for personal information collected through merchhaus.store, merchhaus.co.za, our social media pages, our event merchandise stands and our direct communications with you.

2. What we collect

When you...	We collect
Place an order or pre-order	Name, email, phone, billing and delivery address, and order history. Card details are handled by our payment provider through Shopify's secure checkout, not stored by us
Join the Fan Club	Name, email address, mobile number and your marketing consent
Collect an order at an event	Name, order number and, where needed, proof of identity to release the order
Send an enquiry or contact us	Name, email, phone number, and the details of your message
Browse our store	Device and browser type, IP address, approximate location, pages visited and how you interact with the store, collected using cookies
Contact us on social media	Your profile name and the content of your messages

We collect most of this directly from you. We do not knowingly collect special personal information (such as health, religious or biometric information).

3. Why we use it

We only process personal information for a specific, lawful purpose, as POPIA requires:

To perform our contract with you: processing orders, pre-orders and payments, and arranging delivery or event pickup.
To respond to you: answering questions and providing customer support.
With your consent: sending you Fan Club updates, marketing and early access offers.
For our legitimate interests: improving our store and products, preventing fraud, and keeping our systems secure.
To meet legal obligations: keeping tax and accounting records and responding to lawful requests from authorities.

4. Direct marketing and your consent

We will only send you electronic marketing (email, SMS or WhatsApp) if:

You have opted in. For example, by joining the Fan Club or ticking the marketing consent box at checkout. These boxes are never pre-ticked.
Or you are an existing customer. We may then tell you about our own similar products, and you can opt out at any time.

Every marketing message includes a free, easy way to unsubscribe. You can also opt out by emailing hello@merchhaus.co.za. Opting out of marketing does not affect service messages about an order you have placed.

We never sell your personal information, and we do not share it with third parties for their own marketing without your separate, explicit consent.

5. The Fan Club

When you join the Fan Club, we create a customer profile for you in our store so you can access members-only products. Joining means you agree to receive Fan Club communications. You can leave at any time by unsubscribing or contacting us, and we will stop sending you Fan Club messages.

If you are under 18, you need a parent or guardian's consent to join. We may ask for confirmation of that consent.

6. Who we share it with

We share personal information only where necessary and only with parties bound to protect it:

Service providers (operators): Shopify, which hosts our store and processes checkout; our payment provider; email delivery services; analytics (Google); and business email (Microsoft 365).
Couriers: to deliver your order.
Event and artist partners: only what's needed to run merchandise sales or pickup at an event, such as the name on a pickup order.
Authorities: where the law requires it.

Our operators may only process your information on our instructions and must keep it secure and confidential. You can read how Shopify handles personal information at shopify.com/legal/privacy.

7. Transfers outside South Africa

Some of our service providers, including Shopify, store data on servers outside South Africa, including in Canada, the United States and the European Union. We only use providers that are subject to data protection laws or binding agreements that give your information protection comparable to POPIA.

8. Cookies

Our store uses essential cookies to run the cart, checkout and your account, and analytics cookies to understand how visitors use the store. Where a cookie banner is shown, you can accept or decline non-essential cookies. You can also block or delete cookies in your browser settings, although the cart and checkout may stop working if you block essential cookies.

9. How long we keep it

We keep personal information only for as long as we need it for the purpose it was collected, or as the law requires. For example, we keep financial and tax records for at least five years. Fan Club details are kept until you leave the Fan Club. When we no longer need information, we delete or de-identify it.

10. How we protect it

We use reasonable technical and organisational measures to protect your information, including encrypted connections, access controls and reputable service providers. No system is completely secure, however. If we believe your personal information has been accessed without authorisation, we will notify you and the Information Regulator as POPIA requires.

11. Your rights

Under POPIA you have the right to:

Ask whether we hold personal information about you, and request a copy of it.
Ask us to correct or update inaccurate information.
Ask us to delete information we no longer have a lawful reason to keep.
Object to us processing your information, including for direct marketing.
Withdraw your consent at any time, without affecting processing that happened before.
Lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer below. We may need to verify your identity first.

12. Contact us

Information Officer: [Information Officer name]
Email: hello@merchhaus.co.za
Address: [physical address]

If you're not satisfied with our response, you can contact the Information Regulator (South Africa) at inforegulator.org.za or enquiries@inforegulator.org.za.