This policy explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Responsible party and Information Officer
Dear John (Pty) Ltd (registration number 2025/829242/07), Heartbreak House, Turley, Lonehill, Sandton. Information Officer: Claudia Correia, hushhush@dearjohn.co.za. Our Information Officer is registered with the Information Regulator (South Africa) under registration number 2026-069244.
2. What we collect
- About you: name, email, phone number, order and payment status, and what you tell us in your briefing. Payments are processed by our payment provider; we do not receive or store card details.
- About the recipient: their name, the contact details needed to deliver (email, phone number or address), and the background you share with us.
- Website data: cookies and basic analytics, only as you allow in our cookie banner.
3. Special personal information
Your briefing may include special personal information, such as details about sex life, health or beliefs. We only process it with your explicit consent, which you give when you accept our Terms of Service, and only as needed to write your message. Please share only what we need.
4. Why we use it
To deliver the service you booked, communicate with you, process payments, deliver gifts, handle complaints and refunds, and meet our legal obligations. We do not send marketing unless you opt in, and you can opt out at any time.
5. Legal basis
The contract with you; your consent; the legitimate interest of you and of Dear John in delivering a communication to the person it concerns; and compliance with the law.
6. The recipient
We collect the recipient’s information from you, not from them. When we first contact the recipient we tell them who we are and that we act for someone they know. We use their information only to deliver the agreed communication or gift. If they ask us to stop, we do. They may ask us what we hold about them, ask us to correct or delete it, or object, by writing to hushhush@dearjohn.co.za.
7. Who we share it with
Only the operators who help us deliver: our payment provider, florists, chocolatiers, a licensed liquor retailer, couriers, and our email and hosting providers. They are bound to keep it confidential and use it only for that purpose. We never sell personal information.
8. Cross-border transfers
Some providers, such as email or cloud services, may store information outside South Africa. We only use providers subject to protection comparable to POPIA.
9. Retention
Briefings and drafts are deleted 90 days after delivery unless you ask us to keep them. Financial records are kept for 5 years, as required by tax law.
10. Security
Access is limited to the people handling your order, and information is kept on secured, password-protected systems. If we become aware of a security compromise affecting you, we will notify you and the Information Regulator as POPIA requires.
11. Your rights
You may ask what personal information we hold about you, ask us to correct or delete it, object to processing or withdraw consent, by writing to hushhush@dearjohn.co.za. You may also complain to the Information Regulator: inforegulator.org.za.
