Privacy Policy
Last updated 29 September 2026
Your information, clearly explained
We use your details to process orders, arrange delivery and help with support requests. This notice also explains advertising measurement, service providers and your privacy rights.
1. Who we are
LASA Africa is a trading name of PROPER TIME TRADING CC (registration number 2010/157437/23, VAT 4150257279), 28 Angus Crescent, Longmeadow Business Estate, Johannesburg, South Africa. Phone +27 11 089 8888.
We are the "responsible party" for your personal information under the Protection of Personal Information Act, 2013 (POPIA).
Information Officer: the Information Officer of PROPER TIME TRADING CC is responsible for privacy requests. Contact the Information Officer through LASA Sales at sales@lasa.africa (subject "Privacy"), or phone +27 11 089 8888 (press 1 for Sales).
2. What we collect
- Contact and identity: name, email address, phone number, company name and VAT number if you give them.
- Delivery: delivery address and delivery instructions.
- Orders: products, quantities, prices, assembly choices, invoices, returns and refunds.
- Payment status: whether and how your payment was completed (for example card, Apple Pay, Instant EFT). Payments are processed by PayFast; we never see or store your full card number.
- Account and rewards: your LASA account, password (stored as a one-way hash), loyalty points.
- Support: messages you send us and our replies.
- How you found us (marketing attribution): the page you arrived on, the website or app that referred you, and campaign tags or ad click identifiers in the link (for example from Google, Facebook or Instagram).
- Device and usage: IP address, browser type, pages viewed, and — only if you accept — session recordings (see section 6).
To complete an order, we need the contact and order details marked as required at checkout. A delivery address is needed when you choose delivery. If you do not provide those required details, we may be unable to process or deliver the order. Company details and optional account information are requested separately where relevant.
3. Why we use it (and our lawful basis)
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Take your order, take payment, deliver, assemble, invoice, handle returns and refunds | Performing our contract with you |
| Tax and accounting records, fraud prevention on payments | Legal obligation / legitimate interest |
| Customer support and service quality | Contract / legitimate interest |
| Understanding which channels bring customers, measuring our advertising | Legitimate interest (you can object — see section 6) |
| Marketing emails or messages | Your consent; every message has an unsubscribe option |
4. Who we share it with
Only what each needs to do its job:
- PayFast — payment processing.
- Couriers (The Courier Guy, Internet Express, via Ship Logic) and our own LASA drivers — delivery and collection.
- Zoho — our business email.
- Google (Analytics, Ads, Merchant Center) and Meta (Facebook and Instagram) — advertising measurement. After a purchase our server may send each of them a purchase confirmation so they can measure our ads (details below). We do not sell your information.
- Hotjar — website session recordings, only if you accept (never on checkout, order or password pages).
- Our website hosting provider in South Africa.
- Authorities when the law requires it.
What the purchase confirmations contain. To Google: the ad click identifier from the link you arrived through, an order reference, the time, the order value and currency — no name, email or phone number. To Meta: the products, quantities and prices, the order value, an order reference, and your email address, phone number and a customer reference in hashed (scrambled) form so Meta can match the purchase to an ad; if you arrived from a Meta ad it may also include Meta's browser identifiers, your IP address and browser type. Hashing is not anonymity: Meta can match a hashed email to its own users. We delete the stored IP address and browser type after 30 days.
Some of these providers (Google, Meta, Hotjar, Zoho) store information outside South Africa. When information goes outside South Africa we rely on the grounds POPIA section 72 allows, such as the provider's binding data-protection terms, or the transfer being needed to perform our contract with you.
5. How long we keep it
- Orders, invoices and payment records: for the applicable tax and accounting retention period. Tax records are generally retained for at least five years from the applicable return-submission date or tax-period end, and longer where an unresolved audit, dispute or other legal requirement applies.
- Support messages: as long as needed to resolve the matter and protect the order record, and kept with the related order record.
- Account and rewards: while your account is active; you can ask us to close it.
- How you found us (landing page, referrer, campaign tags and ad click identifiers): stored on the order record and kept with it.
- Cookie choices: 12 months.
6. Cookies and similar tools
When you first visit, a banner lets you Accept or Reject non-essential cookies.
- Essential: needed for the cart, checkout, login and security. Always on.
- Analytics and advertising (Google Analytics, Meta Pixel): on by default when your device is set to South Africa (we use its time zone and language); off until you accept otherwise. Reject stops measurement in your browser immediately and clears the advertising identifiers saved by the main website. Identifiers still stored on our measurement host remain inactive and are reset before measurement starts again. We remember your choice for 12 months.
- Session recording (Hotjar): currently paused. Accepting advertising cookies does not turn on session recording.
Purchase confirmations from our server (section 4) follow the same choice. If you choose Reject, we do not send Google or Meta any information about purchases you make on lasa.africa while that choice is saved in your browser: your choice is recorded with your order and our server checks it before anything is sent, including any retry.
If you have not made a choice in the browser you order from (for example a new device, or after clearing cookies), we apply our South African default and may send the purchase confirmations described in section 4. This also applies to visitors outside South Africa, because our server cannot see where you are.
You can object at any time: email sales@lasa.africa with the subject "Privacy" from the address you used for your orders, or quote an order number. We will then stop sending purchase information to Google and Meta for your past orders not yet sent and for all future orders with that email address. Information already sent (usually within minutes of payment) cannot be recalled by us. We still keep campaign and click information on the order for our own sales reporting.
You can change your cookie choice at any time: Cookie settings (also at the bottom of every shop page).
7. Your rights
You can ask us to: tell you what information we hold about you and give you a copy; correct it; delete it (unless the law requires us to keep it, e.g. invoices); stop using it for marketing; or object to other processing based on our legitimate interest. Email sales@lasa.africa with the subject "Privacy". We may need proportionate proof of identity before providing or changing personal information. We respond within the period required by applicable law; where more information or time is needed, we explain the next step.
If you are not satisfied, you may complain to the Information Regulator (South Africa): inforegulator.org.za/complaints (online complaint form), enquiries@inforegulator.org.za.
8. Security
We protect your information with access controls, encrypted connections (HTTPS), one-way password hashes, and by limiting staff access to what each role needs. If a security compromise affects your information, we will notify you and the Information Regulator as POPIA requires.
9. Children
Our website is not aimed at children under 18 and we do not knowingly collect their information.
10. Changes
We will post any change on this page with a new date. Last updated: 9 October 2026.