Privacy Policy

Last updated: 17 June 2026

Golazo (“Golazo”, “we”, “us”, or “our”) operates golazo.co.za.

Business details
Business name: Golazo
Legal status: Private Company
Address: 183 King Dinizulu Road, Durban, KwaZulu-Natal, 4001, South Africa
Email: info@golazo.co.za
Phone: +27 68 891 3022

This Privacy Policy explains how we collect, use, share, protect, and retain personal information when you use our website, place an order, contact us, create an account, sign up for marketing, or otherwise interact with us. This policy should be read together with our Terms of Service, Shipping Policy, and any Cookie Settings or consent tools made available on our website. 

What information we collect

We may collect the following categories of personal information:

  • identification and contact information, such as your name, email address, phone number, and delivery or billing address;
  • order and transaction information, such as products ordered, order value, payment status, delivery method, and order history;
  • account information, such as login credentials and account preferences, if you create an account;
  • communications, such as messages you send to customer support and records of our responses;
  • technical and usage information, such as IP address, browser type, device information, pages viewed, referring URLs, and interactions with our website; and
  • marketing and consent information, such as whether you subscribed to email or SMS marketing, your cookie preferences, and your communication preferences.

Some information is collected directly from you, some is collected automatically through your browser or device, and some may be received from service providers that help us operate our store, process payments, deliver orders, prevent fraud, or support analytics and website functionality. 

How and why we process personal information

We process personal information only where a lawful justification under applicable law exists. Depending on the context, we may process your information because:

  • you consented to the processing;
  • the processing is necessary to conclude or perform a contract with you, including processing and delivering your order;
  • the processing is necessary to comply with a legal obligation; or
  • the processing is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your rights and interests.

We use personal information to operate our website and store, process and deliver orders, communicate with you about your order, provide customer support, detect and prevent fraud, keep records required by law, improve website performance, manage returns and refunds, and maintain the security and integrity of our systems. 

Marketing communications

If you opt in to receive marketing, we may send you promotional emails, SMS messages, or similar communications about our products, offers, and store updates. Where permitted by law, we may also communicate with existing customers about our own similar products or services, but we will always give you a simple way to opt out. You can unsubscribe at any time by using the unsubscribe link in the communication or by contacting us at info@golazo.co.za. 

Cookies and similar technologies

We use cookies and similar technologies for several purposes, including:

  • essential website and checkout functionality;
  • remembering your preferences;
  • analytics and performance measurement; and
  • advertising or marketing measurement, where enabled.

Essential cookies may be active by default because they are necessary for the operation of the website, checkout, security, or other core functions. Non-essential cookies or tracking technologies should only be activated in accordance with your consent choices where consent is required. Our Cookie Settings or banner allows you to accept, reject, or manage non-essential cookies. Depending on your Shopify configuration, customer data collection for analytics, marketing, or personalization may be limited until consent is given in the selected region. 

Payments

Card and wallet payments are processed by third-party payment service providers, including Yoco where enabled. Depending on the checkout method used, we may receive limited payment-transaction data such as payment status, transaction reference, card brand, or masked payment details, but the payment provider processes the payment itself. We publish only the payment methods that are actually available at checkout. 

Sharing your information

We do not sell your personal information.

We may share personal information only where reasonably necessary, including with:

  • Shopify and related ecommerce infrastructure providers that host or support our storefront and checkout;
  • payment service providers, such as Yoco, to process and verify transactions;
  • courier and logistics providers, such as Aramex and PAXI, to dispatch and deliver orders or facilitate collection;
  • service providers that help with fraud prevention, customer support, analytics, communications, or technical operations;
  • professional advisers where reasonably necessary; and
  • regulators, courts, law-enforcement bodies, or other authorities where required or permitted by law.

Where third parties process personal information on our behalf, we seek to ensure that they do so only for permitted purposes and with appropriate safeguards. POPIA also requires written operator arrangements where an operator processes information for a responsible party. 

International transfers

Some of our service providers may process or host personal information outside South Africa. This can include Shopify and related service providers, and may also include other technology, communications, or cloud-service partners used in the operation of our store. Where we transfer personal information outside South Africa, we do so only where permitted by applicable law, including where the recipient is subject to adequate protection obligations, where the transfer is necessary for the performance of a contract, where you have consented, or where another lawful basis under section 72 applies. Where appropriate, we rely on contractual safeguards and provider data-processing commitments. 

Data retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected or subsequently processed, unless a longer retention period is required or permitted by law, contract, or legitimate business need. For example:

  • order and transaction records may be retained for accounting, tax, legal, and audit purposes;
  • account information may be retained while your account remains active and for a reasonable period afterward;
  • marketing-consent records may be retained until you unsubscribe and for a reasonable period afterward to maintain suppression records; and
  • support correspondence may be retained for service, training, fraud-prevention, or legal purposes.

When we are no longer authorised to retain a record, we will destroy, delete, or de-identify it as soon as reasonably practicable, in a manner that prevents reconstruction in intelligible form, where required. 

Security

We use reasonable technical, organisational, and physical safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration, or destruction. These safeguards may include secure service providers, encryption in transit where appropriate, access controls, authentication measures, and restricted internal access. No method of transmission or storage is completely secure, but we take steps appropriate to the nature of the information and the risks involved. We avoid making statements about specific security technologies unless they are verified in our actual environment. 

Security compromise notification

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible where required by law, taking into account any lawful delay permitted for investigative or system-restoration reasons. We may notify affected persons by email, website notice, or another lawful method, depending on the circumstances. 

Children’s privacy

Our website is intended for a general audience. We do not knowingly collect personal information from children except where permitted by applicable law and, where required, with the consent of a parent, guardian, or other competent person. If you believe that a child has provided personal information to us in circumstances where this should not have occurred, please contact us so that we can investigate and take appropriate action. 

Your rights

Subject to applicable law, you may have the right to:

  • ask us to confirm whether we hold personal information about you;
  • request access to your personal information;
  • request correction, deletion, or destruction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained, or no longer authorised to be retained;
  • object to certain processing, including direct marketing;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with the Information Regulator.

We may ask for adequate proof of identity before acting on a request. We may also refuse or limit a request where the law allows us to do so. Requests may be made by emailing info@golazo.co.za with the subject line “Data Request” and a description of your request. Where appropriate, requests may also be made using a form substantially similar to the Information Regulator’s Form 1 or Form 2. 

Complaints

We encourage you to contact us first if you have any privacy concern. If you are not satisfied with our response, you may lodge a POPIA complaint with the Information Regulator through its eServices Portal or other channels made available by the Regulator.

Information Regulator (South Africa)
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Phone: 010 023 5200
Toll-free: 0800 017 160
Email: enquiries@inforegulator.org.za 

Information Officer

Privacy requests relating to personal information may be directed to:

Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date. If the changes are material, we may take additional steps to draw them to your attention where appropriate.