Studio Extrait (trading as studioextrait.co.za) is the responsible party for the personal information processed through this website. We are based in South Africa and we sell our fragrances online to customers in South Africa.

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

Information you give us: your first and last name, email address, alternative email address (optional), mobile number, delivery address, delivery instructions, order history, and any messages you send us by email or WhatsApp.

Account information: if you create an account, we store your email address and your order history. Passwords are handled by Firebase Authentication and are stored in hashed form; we never see your password.

Payment information: payments are processed by Yoco on their secure payment page. We receive only the payment status, payment reference, the amount paid and, where available, the card scheme and a masked card number (for example VISA **** 1234). We never receive or store your full card number, CVV or bank login details.

Technical information: your browser type, device type, general location derived from your IP address, pages visited and error logs, collected through our hosting, content delivery and analytics providers.

Cart and preference data: your shopping bag, selected scents and site preferences stored in your browser's local storage so that your bag is still there when you return.

To process and deliver your order, including confirming payment, packing and dispatching your parcel, sending waybill tracking links and handling returns, exchanges and refunds.

To provide customer support and respond to your questions, warranty claims and complaints.

To send marketing emails and SMS messages where you have opted in. You can unsubscribe at any time using the link in any marketing email, or by asking us to remove you.

To prevent and detect fraud and abuse, to keep our website and payment process secure, and to comply with our legal, accounting and tax obligations.

We process your information because it is necessary to conclude and perform our contract of sale with you, because we have a legitimate interest in running and securing our business, because you have consented (for example for marketing), or because the law requires us to keep certain records.

Where you provide us with information about someone else (for example a gift recipient's delivery address), you confirm that you have their permission to share it with us for that purpose.

We do not sell your personal information, and we do not share it for anyone else's marketing.

Yoco (payment processor) to process your payment and confirm that it succeeded. Yoco processes your information under its own privacy policy and PCI-DSS obligations.

The Courier Guy (delivery partner) to deliver your parcel and to send you tracking updates.

Google Firebase / Google Cloud (hosting, database, authentication and address autocomplete) and Cloudflare (content delivery and security) as our technology service providers.

Where a service provider processes information outside South Africa, we require them to apply protections that are substantially similar to POPIA.

We may also disclose information where we are legally required to do so, for example to a court, regulator or law enforcement agency, or to our professional advisers under confidentiality.

We use essential cookies and browser local storage to keep your shopping bag, your login session and your display preferences working, and to remember whether you have an active discount. Without these, the shop and checkout cannot function.

We and our service providers may also use analytics cookies to understand how the site is used so that we can improve it. You can block or delete cookies and site data in your browser settings at any time; doing so may empty your shopping bag or sign you out.

Order, invoice and payment records are kept for at least five years after the end of the tax year in which the order was placed, as required by South African tax and company law.

Customer support messages and account records are kept for as long as your account is active, and for a reasonable period afterwards so that we can deal with any later query or claim.

Marketing consent records are kept until you unsubscribe or object, plus a short period to prove that you opted out. Data that we no longer need is deleted or anonymised.

You may ask us to confirm what personal information we hold about you and to provide a copy of it; ask us to correct or update information that is inaccurate; ask us to delete information that we are not required to keep; object to processing that is based on our legitimate interest; withdraw marketing consent at any time; and object to unwanted direct marketing.

To exercise any of these rights, email [email protected] or send a WhatsApp message to +27 68 917 6485. We respond to verified requests within a reasonable time and normally within 30 days. We may ask you to verify your identity before we release information, to protect your privacy.

Our website runs over HTTPS, and access to our order database and administrative tools is restricted to authorised personnel with authentication and access control in place.

Our checkout is hosted by Yoco, so card data is captured and processed on their PCI-DSS compliant platform rather than on our servers. If we ever become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA.

Our website and our fragrances are intended for adults. We do not knowingly collect personal information from children under 18. If a child has provided us with personal information, contact us and we will delete it.

We only send marketing emails and SMS messages where you have opted in, and every message includes a way to unsubscribe. You may also opt out at any time by contacting us directly. Transactional messages about an order you placed are not marketing and will still be sent.

We may update this policy from time to time to reflect changes in our practices or in the law. The current version is always published on this page. This version was last updated on 19 September 2026.

If you believe we have processed your personal information unlawfully, please contact us first so that we can put it right. You also have the right to lodge a complaint with the Information Regulator of South Africa at [email protected], by telephone on 010 023 5200, or through their website at inforegulator.org.za.