De Haas and van den Berg (Pty) Ltd
Effective date: 15 September 2026

1. Who we are

This website, https://corinnedehaas.com, belongs to De Haas and van den Berg (Pty) Ltd. We are a private company registered in South Africa. Our registration number is 2015/018320/07. Our address is 14 Harbour Road, Kleinmond, 7195, South Africa.

Our Information Officer is Alexander Willem van den Berg. Send all privacy questions and requests to privacy@corinnedehaas.com.

We process personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect, why we collect it, who receives it, and how long we keep it.

This policy covers the information that we collect through this website. It also covers the information that we collect when you contact us about a trade or wholesale order. POPIA protects a company as well as a person, so this policy applies to both. Our separate written trade agreement can add terms about confidentiality and about trade information. That agreement adds to this policy. It does not replace it.

2. What we collect

When you place an order, we collect your name, your delivery address, your telephone number, your email address, the contents of your order, and any delivery instruction that you give us. We use these items to accept your order, to deliver it, and to invoice it. We cannot accept an order without them. If you give us the details of another person, tell that person that you gave them to us.

We do not offer customer accounts. You order as a guest.

When you pay, our payment provider processes your card on its own systems. We never see or store your card number. If you pay by EFT, we receive your payment reference and your proof of payment. If we owe you an EFT refund, we ask you for your bank account details, and we delete them after we pay you.

When you use the contact form, we collect your name, your email address, and the content of your message. We use them to answer you. The form also collects your IP address and your browser user agent string to detect spam. You do not have to use the form. You can send us an email instead.

When you ask about a trade order, we collect what you send us. This is usually the name of the business, its registration number, its VAT number, its address, its website address, and what the business wants to order. If we open a trade account, we also collect the name, the job title, the telephone number and the email address of the person who is authorised to buy, and of the person who handles accounts. We collect the full name, the identity number and the signature of the person who signs our trade form, so that we can confirm that this person can bind the business. We use these items to answer you, to quote, to supply you and to invoice you.

A business that gives us the details of its staff must tell those people that it gave the details to us.

When you order a commission, we agree the piece with you by email. We collect what you send us in those messages. This can include a photograph, a description of the piece, a name or a date to put on it, and the name and address of the person who will receive it. We use these items to make the piece and to deliver it. If you pay your deposit by EFT, we also receive your payment reference and your proof of payment. Send us only what we need for the piece.

When you visit any page, the web server writes a log entry. The log holds your IP address, the date and time, the page that you requested, your browser user agent string, and the page that sent you to us. We use the log to keep the site secure and to count visitors.

3. Cookies and browser storage

The shop sets three cookies. They hold the contents of your cart and link your browser to that cart. Two of these cookies end when you close your browser. A third stays for two days, and it holds your cart after you close and open the browser again.

The shop also keeps a copy of your cart in your browser’s own storage. This copy stays on your device. It goes away when you clear your browsing data.

The map on our contact page stores data in your browser. Google sets this, not us. Clause 5 explains the map.

We set no advertising cookies. We use no tracking pixels. We run no third-party analytics scripts.

4. Who receives your information

We give your name, your delivery address, your telephone number and your email address to The Courier Guy. The courier needs these items to deliver your parcel and to send you a tracking number.

These parties also process information for us:

• Yoco processes card payments. It operates in South Africa.
• Our hosting company hosts this website, sends our email, and produces visitor statistics. It operates in South Africa.
• A spam filtering service checks contact form messages for spam. It operates in the United States.

The map on our contact page comes from Google Maps, a service of Google LLC in the United States.

We sell no personal information. We share no personal information for marketing.

5. Information that leaves South Africa

Two services process information outside South Africa. Both are in the United States.

Our spam filtering service receives your IP address and the content of a contact form message. It checks the message against a spam database.

Google receives your IP address when the map on our contact page loads. If you do not want this, do not open the contact page.

The United States has no single data protection law that matches POPIA. Each service is bound by its own published terms, which require it to protect the information that it receives.

6. How long we keep your information

We keep orders, invoices and tax records for a minimum of five years. The Tax Administration Act and the Companies Act require this period.

We keep contact form messages for 12 months.

We keep order, return and commission correspondence for 12 months after we deliver your order. The order, the invoice and the tax record stay for the five-year period above.

We keep server logs for 2 months.

We keep a signed trade form for as long as the trade account is open, and for 12 months after it closes.

7. Security

We protect your information with the technical and organisational measures that POPIA requires. No system is completely secure. If a breach affects your personal information, we tell you and the Information Regulator.

8. Marketing

This website has no newsletter signup form. We use your email address to confirm your order, to send your invoice, and to tell you about the delivery. We send you no marketing email.

9. Your rights

You can ask us what personal information we hold about you. You can ask us to correct information that is wrong, misleading or incomplete. You can ask us to delete information that we no longer need. You can also object to our processing of your information.

Send your request to privacy@corinnedehaas.com. We reply within five business days. If your request is complex, we tell you and we complete it within 30 days.

We cannot delete order records, invoices or tax records before the five-year period ends. The law requires us to keep them.

If our answer does not satisfy you, complain to the Information Regulator of South Africa, https://inforegulator.org.za.

10. Changes to this policy

We can change this policy. The date at the top shows the last change. Our shipping and returns policy explains delivery, returns and refunds.