Privacy Policy

Last updated: 13 September 2026

CTRLHAUS respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how CtrlHaus (Pty) Ltd, trading as CTRLHAUS, collects, uses, stores and shares personal information when you visit our website, purchase a product, book a demonstration, subscribe to communications or otherwise interact with us.

For purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), CtrlHaus (Pty) Ltd is the responsible party for the personal information described in this policy.

Personal Information We Collect

Depending on how you interact with CTRLHAUS, we may collect the following information:

Information You Provide

• Your name, email address and telephone number;
• Billing, delivery and collection addresses;
• Account login details and preferences;
• Products purchased, returned or added to your cart;
• Demo-booking information;
• Messages, enquiries, reviews and customer-support communications;
• Marketing preferences; and
• Information provided when participating in competitions or promotions.

Payment and Transaction Information

Our payment providers process the payment information needed to complete your transaction.

CTRLHAUS generally does not receive or store your complete payment-card details. We may receive limited payment information, such as the payment method, transaction status and payment reference.

Information Collected Automatically

When you use our website, Shopify and technologies enabled on the website may collect:

• IP address;
• Browser and device information;
• Cookie and device identifiers;
• Pages and products viewed;
• Cart, checkout and purchase activity;
• Referring website or advertisement;
• Approximate location derived from an IP address; and
• Information about how you interact with the website and our advertising.

Information From Other Sources

We may receive information from service providers and business partners involved in operating the store, processing payments, preventing fraud, delivering orders, providing analytics or measuring advertising performance.

Why We Process Your Information

We may process your personal information to:

• Create and manage your account;
• Process payments and fulfil orders;
• Arrange delivery, collection, returns and warranties;
• Manage demonstration bookings;
• Respond to enquiries and provide customer support;
• Detect and prevent fraud, abuse and security threats;
• Maintain and improve our website, products and services;
• Keep business, tax and transaction records;
• Comply with legal and regulatory obligations;
• Send marketing communications where permitted; and
• Measure and improve the effectiveness of our marketing.

We process personal information where:

• It is necessary to enter into or perform a contract with you;
• You have provided consent;
• Processing is required by law;
• Processing protects your legitimate interests; or
• Processing is necessary for our legitimate business interests or those of a third party, provided those interests do not unjustifiably infringe your privacy.

POPIA requires personal information to be processed lawfully, reasonably and only to the extent necessary for its purpose. Sections 9–11 of POPIA

Information You Must Provide

Certain information—such as your name, contact details, delivery address and payment confirmation—is required for us to accept and fulfil an order.

If you do not provide required information, we may be unable to process your purchase, deliver your order, arrange a demonstration or respond effectively to your request.

Providing information for optional marketing is voluntary.

How We Share Personal Information

We may disclose personal information where reasonably necessary to:

• Shopify, which hosts and operates our online store;
• Payment gateways and financial-service providers;
• Couriers, fulfilment providers and collection partners;
• IT, hosting, email and customer-support providers;
• Analytics and fraud-prevention providers;
• Advertising and social-media platforms where those services are enabled;
• Professional advisers, such as accountants, auditors or legal advisers;
• Government authorities, regulators or law-enforcement bodies where required by law; and
• A purchaser or successor if CTRLHAUS undergoes a legitimate sale, merger or restructuring.

These providers receive only the information reasonably necessary for the applicable service and may process it under their own privacy notices or under contractual obligations to CTRLHAUS.

We do not sell personal information in exchange for money.

Shopify

Our store is powered by Shopify.

Information submitted through the store is processed by Shopify to provide services including website hosting, checkout, payments, fraud prevention, analytics and store functionality.

Shopify and its service providers may process information outside South Africa. More information is available in the Shopify Consumer Privacy Policy.

Where Shopify independently determines how personal information is used for its own enhanced services, Shopify may act as a separate responsible party or data controller.

Cookies and Similar Technologies

We use cookies and similar technologies to:

• Operate essential store and checkout functions;
• Remember preferences;
• Maintain security;
• Measure website traffic and performance;
• Understand how visitors use the store; and
• Measure or personalise advertising where permitted.

Some cookies are necessary for the store to function. Other cookies, including certain analytics and advertising cookies, may be controlled through the cookie-preference tool displayed on our website where available.

You may also restrict cookies through your browser. Blocking certain cookies may prevent parts of the website or checkout from functioning correctly.

Disabling browser cookies may not necessarily stop every form of server-side measurement or information already shared with third-party platforms.

Marketing and Advertising

We may send electronic marketing where:

• You have consented; or
• You are an existing customer and the communication concerns our own similar products or services, as permitted by POPIA.

Every electronic marketing message will identify the sender and provide a simple method of opting out. You may unsubscribe at any time without charge.

We may use advertising platforms to measure campaign performance or show relevant advertising, subject to your applicable choices and the permissions configured on our website.

POPIA restricts unsolicited electronic marketing and requires consent or a qualifying existing-customer relationship, together with an opportunity to object. Information Regulator direct-marketing guidance

International Transfers

Shopify and some of our other service providers may store or process personal information outside South Africa.

Where personal information is transferred internationally, we will take reasonably practicable steps to ensure that the transfer complies with section 72 of POPIA. This may include relying on an adequate foreign privacy law, contractual protections, your consent or a transfer necessary to perform a contract with you.

Data Retention

We retain personal information only for as long as reasonably necessary to:

• Fulfil the purposes described in this policy;
• Maintain your account;
• Complete transactions and provide warranties;
• Meet tax, accounting and other legal obligations;
• Prevent fraud;
• Resolve disputes; and
• Enforce our agreements.

When information is no longer required or legally authorised to be retained, we will delete, destroy or de-identify it where reasonably practicable.

Security

We use appropriate and reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, access or processing.

No internet-based system is completely secure, and we cannot guarantee absolute security.

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected individuals as required by POPIA.

Your Rights

Subject to POPIA and other applicable legislation, you may request to:

• Confirm whether we hold personal information about you;
• Access the personal information we hold;
• Correct inaccurate, incomplete, outdated or misleading information;
• Request deletion or destruction where we are no longer authorised to retain the information;
• Object to certain processing on reasonable grounds;
• Withdraw consent where processing relies on consent;
• Object to direct marketing at any time; and
• Lodge a complaint with the Information Regulator.

These rights are not absolute. We may retain or refuse access to information where permitted or required by law.

We may need to verify your identity before processing a request.

Children’s Information

Our store is not specifically directed at children.

We do not knowingly process the personal information of a child without authorisation from a competent person or another lawful basis permitted by POPIA. If you believe a child has provided personal information unlawfully, please contact us.

Third-Party Links

Our website may link to external websites or services that we do not control. Their handling of personal information is governed by their own privacy policies, and we are not responsible for their privacy or security practices.

Changes to This Policy

We may update this Privacy Policy to reflect changes to our business, technology or legal obligations.

The revised version will be published on this page with an updated revision date. Where required, we will provide additional notice.

Contact CTRLHAUS

For privacy questions or to exercise your rights, contact:

Information Officer
CtrlHaus (Pty) Ltd, trading as CTRLHAUS
283 Quelea Avenue
Centurion, Gauteng, 0157
South Africa
Email: hello@ctrlhaus.co.za

Complaints to the Information Regulator

We ask that you contact us first so that we have an opportunity to resolve your concern.

You may also lodge a complaint with the Information Regulator (South Africa):

Website: inforegulator.org.za
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Toll-free: 0800 017 160