This Privacy Policy explains how Gwyneth Lewin collects, uses, shares and protects your personal information, and what rights you have. It is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who Is Responsible for Your Information

1.1. The responsible party is Lynda Gwyneth Jaros, trading as Gwyneth Lewin, a sole proprietorship based in Johannesburg, Gauteng, South Africa.

1.2. The Information Officer is Lynda Gwyneth Jaros, who can be reached at hello@gwynethlewin.co.za or +27 67 441-9747.

2. What We Collect

2.1. Information you give us. Your name, email address, delivery address, telephone number, and any message you send us.

2.2. Payment information. We accept bank transfer (EFT) only. We collect your order reference and details of the payment you make to us. We do not accept card payments and do not collect or store card details. If we owe you a refund, we will ask for the bank account details to which it should be paid, and use them only for that purpose.

2.3. Information collected automatically. When you visit the Site, cookies and similar technologies collect your IP address, browser and device type, and how you move through the Site.

2.4. We do not seek to collect special personal information as defined in POPIA, and ask that you do not send it to us.

3. Why We Collect It, and Whether You Have to Give It

3.1. We use your information to take and fulfil your order, to make and deliver your bag, to communicate with you about your order, to handle returns and refunds, to keep the records the law requires us to keep, and to run and improve the Site.

3.2. Providing your name, contact and delivery details is voluntary, but we cannot process an order without them.

3.3. We rely on the following grounds for processing: performing our contract with you, complying with our legal obligations, our legitimate interests in running the business, and your consent where we ask for it.

4. Marketing

4.1. If you are not already a customer, we will only send you marketing emails if you have asked us to, in line with section 69 of POPIA.

4.2. If you are a customer, we may email you about similar products. Every message includes an unsubscribe link, and you can opt out at any time at no cost by using it or by emailing us.

5. Who We Share It With

5.1. We do not sell, rent or trade your personal information.

5.2. We share it only with operators who help us run the business, and only as far as they need it: our website host, our email and newsletter provider, and the courier delivering your order. They are required to keep it confidential and secure.

5.3. We may disclose information where the law requires it, or to establish or defend a legal claim.

6. Information Sent Outside South Africa

6.1. Some of our service providers, including our email and newsletter provider, store information on servers outside South Africa.

6.2. Where that happens we take reasonable steps to ensure the recipient is subject to laws or binding agreements offering protection substantially similar to POPIA, as section 72 requires.

7. How Long We Keep It

7.1. We keep order and transaction records for as long as the law requires, which for tax purposes is generally five years from the end of the relevant tax year.

7.2. We keep marketing contact details until you unsubscribe. Enquiries that do not lead to an order are deleted once they are no longer needed.

8. How We Protect It

8.1. We take reasonable technical and organisational steps to secure your information, including encrypted connections to the Site and restricted access to our systems.

8.2. If your personal information is accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as section 22 of POPIA requires.

8.3. No system is completely secure, and we cannot guarantee absolute security.

9. Your Rights

9.1. Under POPIA you have the right to:

a) be told what personal information we hold about you, and to be given a copy of it (section 23);

b) ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);

c) object to our processing of your information on reasonable grounds (section 11(3));

d) withdraw consent where our processing relies on it;

e) opt out of direct marketing at any time;

f) complain to the Information Regulator; and

g) institute civil proceedings for a breach of your rights under POPIA.

9.2. To exercise any of these rights, email hello@gwynethlewin.co.za. We may ask you to confirm your identity first, and will respond within a reasonable time.

10. Cookies

10.1. Cookies keep your basket working, remember your preferences and help us understand how the Site is used. You can block or delete cookies in your browser settings, though parts of the Site may not work properly if you do.

11. Children

11.1. Our Site is intended for adults. Under POPIA a child is anyone under the age of 18, and we do not knowingly collect or process a child's personal information without the consent of a competent person.

11.2. If you are a parent or guardian and believe a child has given us personal information, please contact us and we will delete it.

12. Complaints

12.1. Please raise any concern with our Information Officer first, at hello@gwynethlewin.co.za.

12.2. You also have the right to complain directly to the Information Regulator:

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200  |  Toll free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

13. Changes to this Policy

13.1. We may update this Policy. The current version is always posted on this page with its date.

14. Contact Us

Email: hello@gwynethlewin.co.za
Telephone: +27 67 441-9747

Last updated: August 2026