Privacy Policy

Last updated: 21 July 2026

Cravio operates this online store and website, including the information, content, features, products, tools and services available through it.

Our online store is powered by Shopify, which provides the ecommerce platform that enables us to sell our products and provide our services to you.

This Privacy Policy explains how Cravio collects, uses, stores, shares and protects your personal information when you visit our website, place an order, contact us, subscribe to marketing communications or otherwise interact with us.

Cravio processes personal information in accordance with applicable South African law, including the Protection of Personal Information Act 4 of 2013, commonly referred to as POPIA.

For purposes of POPIA, Cravio is the responsible party for the personal information described in this policy.

Personal Information We Collect

The personal information we collect depends on how you interact with our website and services.

We may collect the following information:

Contact and identification information

This may include your:

• Name and surname;
• Email address;
• Telephone or mobile number;
• Billing address;
• Delivery address; and
• Postal code.

Order and transaction information

This may include:

• Products you view or add to your cart;
• Products you purchase;
• Your selected Pick & Mix sweets;
• Treat Box selections;
• Order number;
• Order history;
• Delivery method;
• Payment confirmation;
• Refund or return information; and
• Communications relating to your order.

Payment information

Payments are processed through Shopify and the payment provider available during checkout.

Cravio does not ordinarily receive or store your full debit card, credit card or banking details. Payment providers may process your payment information according to their own privacy and security policies.

Account information

Where customer accounts are available, we may collect information such as your:

• Email address;
• Password;
• Order history;
• Saved delivery details; and
• Account preferences.

You are responsible for keeping your account login information secure.

Communications with us

We collect information that you provide when you:

• Complete our contact form;
• Email or telephone us;
• Ask a question about a product;
• Report an incorrect or damaged order;
• Request a return or refund; or
• Communicate with us through social media.

Device and website information

When you visit our website, certain technical information may be collected automatically, including:

• Your IP address;
• Browser type;
• Device type;
• Operating system;
• Network information;
• Pages viewed;
• Time spent on the website;
• Products viewed;
• Cart activity; and
• How you reached or navigated through our website.

This information may be collected through cookies and similar technologies.

Marketing preferences

Where you subscribe to our newsletter or agree to receive promotional communications, we may collect:

• Your email address;
• Your marketing preferences;
• Your consent record; and
• Information about your interaction with our marketing emails.

How We Collect Personal Information

We may collect personal information:

• Directly from you when you place an order, create an account, contact us or provide your details;
• Automatically when you visit or interact with our website;
• Through cookies and similar technologies;
• From Shopify and our service providers;
• From payment providers;
• From delivery providers;
• From marketing, analytics or social-media platforms; and
• From other parties where you have authorised the sharing of your information or where permitted by law.

How We Use Your Personal Information

We may use your personal information to:

Process and fulfil orders

We use your information to:

• Process your order and payment;
• Prepare and pack your products;
• Confirm your order;
• Arrange delivery;
• Send delivery and tracking information;
• Communicate with you about your order;
• Process approved refunds or returns; and
• Provide customer support.

Operate and improve our store

We may use information to:

• Operate and maintain our website;
• Understand how customers use our store;
• Improve our products and services;
• Improve the shopping experience;
• Remember your preferences;
• Diagnose technical problems; and
• Analyse store performance.

Communicate with you

We may use your contact details to:

• Answer questions;
• Respond to customer-service requests;
• Provide order updates;
• Communicate about delivery issues;
• Inform you about refunds or returns; and
• Send important notices relating to our store or policies.

Prevent fraud and maintain security

We may process information to:

• Verify transactions;
• Detect or prevent fraudulent activity;
• Protect our website and customer accounts;
• Investigate suspicious orders;
• Protect Cravio, our customers and our service providers; and
• Comply with security requirements.

Meet legal obligations

We may process or retain information where necessary to:

• Comply with applicable South African laws;
• Maintain tax, accounting and transaction records;
• Respond to lawful requests from authorities;
• Establish, exercise or defend legal claims;
• Investigate possible breaches of our policies; or
• Protect our legal rights.

Marketing Communications

Where permitted by law, we may send you information about:

• New products;
• Pick & Mix options;
• Treat Boxes;
• Special offers;
• Promotions;
• Competitions; and
• Cravio news.

We will send electronic marketing communications where we have an appropriate legal basis to do so, including your consent where required.

You may unsubscribe at any time by:

• Clicking the unsubscribe link in a marketing email; or
• Contacting us at hello.craviosa@gmail.com.

Unsubscribing from marketing will not prevent us from sending necessary communications relating to your orders, payments, deliveries, customer-service requests or refunds.

POPIA regulates direct marketing through unsolicited electronic communications and provides individuals with rights to object or withdraw consent.

Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

• Keep the website functioning;
• Remember items placed in your cart;
• Remember your preferences;
• Enable secure checkout;
• Understand website traffic;
• Analyse customer interactions;
• Improve website performance; and
• Support advertising or marketing where enabled.

Some cookies are necessary for the website and checkout to function. Other cookies may be used for analytics, personalisation or advertising.

You may manage cookies through your browser settings or through any cookie-management options provided on our website. Disabling certain cookies may affect how the website functions.

How We Share Personal Information

We may share personal information only where reasonably necessary to operate our business, fulfil orders, provide services or comply with the law.

Your information may be shared with:

Shopify

Our store is hosted by Shopify. Shopify processes personal information to provide and improve the ecommerce platform, checkout, security and related services.

Payment providers

Payment providers process information required to authorise and complete payments.

Delivery providers

We may share your name, delivery address, contact number and other necessary delivery information with courier providers such as:

• Aramex;
• PUDO;
• The Courier Guy; or
• Another delivery provider used to fulfil your order.

Service providers

We may share information with companies that help us provide services, including:

• Website-hosting providers;
• IT and technical-support providers;
• Cloud-storage providers;
• Email and communication providers;
• Analytics providers;
• Marketing platforms;
• Customer-support providers; and
• Professional advisers.

These parties may process information only as needed to provide their services or as otherwise permitted by law.

Legal and regulatory authorities

We may disclose information where required to:

• Comply with applicable law;
• Respond to a lawful request;
• Comply with a court order;
• Investigate fraud or illegal activity;
• Protect our rights or property; or
• Protect the safety and rights of customers or others.

Business changes

Personal information may be disclosed as part of a merger, sale, restructuring, financing, insolvency or transfer of all or part of the Cravio business.

Relationship With Shopify

Shopify collects and processes information relating to your access to and use of our online store.

Information submitted through our store may be shared with Shopify and Shopify’s service providers to:

• Operate the website;
• Process orders;
• Enable checkout;
• Prevent fraud;
• Maintain security; and
• Improve Shopify’s services.

Shopify may process or store information in countries outside South Africa.

Cravio remains responsible for reviewing its Shopify privacy settings and ensuring that its policy reflects the store’s actual operations and connected services.

International Processing and Transfers

Although Cravio currently sells and delivers within South Africa, some of our service providers may process or store personal information outside South Africa.

These providers may include Shopify, payment providers, cloud-service providers, analytics providers and communication platforms.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer is permitted under POPIA and that appropriate safeguards are used to protect the information.

POPIA regulates the transfer of personal information outside South Africa.

How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary to:

• Fulfil the purpose for which it was collected;
• Complete and manage orders;
• Maintain customer accounts;
• Provide customer service;
• Meet tax, accounting and legal requirements;
• Resolve disputes;
• Prevent fraud;
• Enforce our agreements; and
• Protect our legal rights.

When information is no longer required, we will take reasonable steps to delete, destroy or de-identify it, subject to any legal retention requirements.

Security of Personal Information

We take reasonable technical and organisational measures to protect personal information against:

• Loss;
• Unauthorised access;
• Misuse;
• Disclosure;
• Alteration; and
• Destruction.

However, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

Please do not send sensitive payment information, passwords or confidential financial information through unsecured communication channels such as ordinary email or social-media messages.

POPIA requires responsible parties to apply appropriate safeguards to protect the integrity and confidentiality of personal information.

Children’s Personal Information

Cravio’s online store is not intended for children under the age of 18 to use independently without the involvement or consent of a parent or legal guardian.

We do not knowingly collect personal information from children without the required authorisation.

A parent or guardian who believes that a child has provided personal information to us may contact us and request that the information be reviewed or deleted, subject to applicable law.

Your Rights Under POPIA

Subject to applicable law, you may have the right to:

• Ask whether Cravio holds personal information about you;
• Request access to personal information held about you;
• Request the correction of inaccurate, outdated or incomplete information;
• Request the deletion or destruction of information where legally permitted;
• Object to certain processing of your information;
• Withdraw consent where processing is based on consent;
• Object to receiving direct marketing;
• Request information about how your personal information is used; and
• Lodge a complaint with the Information Regulator South Africa.

These rights are not absolute. We may need to retain certain information to complete an order, comply with legal obligations, prevent fraud, maintain financial records or resolve disputes.

We may ask you to verify your identity before responding to a request.

To exercise your rights, contact:

Email: hello.craviosa@gmail.com
Telephone: +27 83 742 3596

POPIA provides rights relating to access, correction, deletion and objection to processing. The Information Regulator also provides official forms for these requests.

Complaints

Please contact Cravio first if you have concerns about the way we collect, use, share or protect your personal information.

We will investigate your complaint and respond as soon as reasonably possible.

You also have the right to lodge a complaint with the Information Regulator South Africa if you believe that your personal information has been processed in a manner that does not comply with POPIA.

Complaints may be submitted through the Information Regulator’s official complaints or eServices process.

Third-Party Websites and Links

Our website may contain links to websites, social-media platforms or services operated by third parties.

Cravio is not responsible for the privacy, security, content or practices of third-party websites. We recommend reviewing the privacy policy of any third-party website before providing personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our business;
• Changes to our services;
• Changes to the Shopify platform;
• Changes to legal requirements; or
• Changes to the way we process personal information.

The updated policy will be published on this website with a revised “Last updated” date.

Contact Cravio

For questions about this Privacy Policy, our privacy practices or your personal information, contact:

Cravio
Email: hello.craviosa@gmail.com
Telephone: +27 83 742 3596
Location: Boksburg, Gauteng, South Africa