Privacy Policy

Haus of Crumbs operates this website and decides what happens to the personal information collected through it. Under the Protection of Personal Information Act that makes us the responsible party.

Information officer: Ethan Marx. Any question about your information, including a request to see or delete it, goes to .

Only what a given task actually needs. There is no tracking for advertising, no profiling, and nothing is sold to anyone.

When you place an order

• Your name, email address and phone number — to confirm the order and to reach you about it.
• Your delivery address — to get the parcel to you.
• What you ordered, and the price you paid — to fulfil it, and because tax law requires the record to be kept.
• A billing address, if it differs from the delivery address.

Card details are not collected. Payment happens on PayFast's own system, and the card number never reaches this website or its database.

When you send a custom fabrication enquiry

• Your name and the contact details you choose — email, phone or WhatsApp.
• The vehicle, engine, turbo and application details you supply, along with the material, wastegate arrangement and any notes about the project.
• Any photographs you choose to attach.

All of it exists for one purpose: to work out whether the job is possible, what it involves, and what it costs, so that you get an accurate quote rather than a guess. Vehicle and engine details are technical requirements, not marketing data.

Photographs you attach are stored with the enquiry so we can see what you are working with. Before they are saved they are resized and re-encoded, which removes the location, camera and other hidden details a phone writes into a photo. They are kept on our hosting provider’s storage and deleted along with the enquiry. You can also send photos by email or WhatsApp instead.

If you sign up for emails

• Your email address.
• When and where you signed up, and the exact wording you agreed to — the record that you asked to hear from us.

Used only to send specials and news about new parts, and only because you ticked the box asking for them. Every marketing email carries an unsubscribe link, and you can also simply ask us. Once you unsubscribe, your address is kept on a do-not-email list so it is never emailed by mistake. Placing an order or sending an enquiry does not sign you up.

If you create an account

• Your name and email address.
• A cryptographic hash of your password — the password itself is never stored and cannot be recovered, only reset.
• A record of the orders linked to your account, so you can see what you have bought and track it.

An account is optional. Everything on this site can be bought as a guest, and a guest order is tracked with its order number and the private link you are given.

Automatically, as the site runs

• A cookie that identifies your shopping basket, and one that keeps you signed in if you have an account. Neither follows you to other websites.
• Your IP address, briefly, to limit how often forms can be submitted. That is a defence against abuse, not a way of identifying you.
• An anonymous count of the pages you view: which page, the website you arrived from, the kind of device, your country, and anything you type into the site search.

There are no advertising cookies and no third-party analytics on this site. Visits are counted by the site itself, and anonymously: no cookie is used for it, your IP address is not stored, and the visitor code it creates is replaced every day, so visits cannot be linked to each other or back to you. If your browser sends a “Do Not Track” or Global Privacy Control signal, you are not counted at all.

Only the services needed to actually run the shop, and only the part each one needs:

Your information is never sold, rented or handed to anyone for marketing. It is disclosed otherwise only where the law requires it.

Hosting and database servers may sit outside South Africa. POPIA permits this where the receiving country or the provider offers comparable protection, which these do.

• Orders and invoices — 5 years. This is not a choice: tax law requires business records to be kept, so an order cannot be erased on request even if the account behind it is closed.
• Custom fabrication enquiries — 24 months, then deleted.
• Anonymous visit counts — 13 months, then deleted.
• Email sign-ups — until you unsubscribe; after that, only on the do-not-email list.
• Account details — for as long as the account exists. Ask and it is closed.
• Baskets that were never checked out — cleared automatically.

POPIA gives you the right to ask what personal information is held about you, to have it corrected, to have it deleted where there is no legal reason to keep it, to object to how it is used, and to complain to the Information Regulator.

Email and say what you want done. There is no charge, and no need to explain why.

If you are not satisfied with the answer, the Information Regulator of South Africa takes complaints at inforegulator.org.za.

The site is served over an encrypted connection throughout. Passwords are stored only as hashes. Access to the order database is limited to the people who run the business.

No system is perfect. If a breach ever affects your information, POPIA requires us to tell you and the Information Regulator, and we will.

If this policy changes, the date in the margin changes with it. See also our Terms & Conditions.