Privacy Policy

Dedicated website helpline: 062 445 6258

PRIVACY POLICY

How Third Kultuur collects, uses, shares and protects personal information

Operator	Third Kultuur (Pty) Ltd
Registration	2026/268426/07
Website	https://superdry.co.za
Effective date	01 July 2026

This Privacy Policy explains how Third Kultuur (Pty) Ltd processes personal information when you visit or use superdry.co.za, place an order, contact us, interact with our marketing, or otherwise engage with Superdry South Africa. It is intended to provide the notification contemplated in section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”).

1. Responsible party

Third Kultuur (Pty) Ltd, registration number 2026/268426/07, is the responsible party for personal information processed for the purposes described in this policy.

· Physical address: 18 Collingwood Road, Observatory, Cape Town, 7925, South Africa

· Privacy and Information Officer contact: info@thirdkultuur.co.za

· Customer service: service@superdry.co.za | 062 445 6258

· Website: https://thirdkultuur.co.za

2. Scope

This policy applies to personal information processed through the Website, online store, customer-service channels, email, WhatsApp, social-media interactions, promotions, surveys and related digital services. A third party that processes information for its own purposes may be a separate responsible party and its own privacy notice may also apply.

3. Personal information we collect

Depending on how you interact with us, we may collect:

· Identity and contact information, such as name, delivery and billing address, email address and telephone number.

· Account information, such as login credentials, account preferences and saved details.

· Order and transaction information, such as products purchased, order value, returns, refunds, delivery status and transaction references.

· Payment-related information. Payment providers generally process full card or account credentials; we may receive limited payment status, token, fraud-screening and transaction information.

· Customer-service information, including correspondence, call or WhatsApp content, complaints, returns and supporting photographs.

· Marketing information, including subscriptions, consent choices, campaign interactions, competition entries and communication preferences.

· Technical and usage information, such as IP address, device and browser information, cookie identifiers, pages viewed, clicks, referring URLs and approximate location derived from technical data.

· Social-media and advertising information when you interact with our pages, adverts or tracking technologies.

· Fraud, security and compliance information reasonably required to protect transactions, the Website and our legal rights.

4. How we collect information

We collect personal information:

· directly from you when you create an account, place an order, subscribe, communicate with us or enter a promotion;

· automatically through cookies, pixels, tags, logs and similar technologies;

· from service providers such as Shopify, payment providers, delivery partners, Meta, Google, Moosend and WhatsApp;

· from publicly available sources or business partners where lawful; and

· from another person acting for you, such as a purchaser sending a gift, provided the information is lawfully supplied.

5. Purposes of processing

We process personal information to:

· operate the Website and create or manage customer accounts;

· process payment, fulfil orders, arrange delivery and administer returns, exchanges and refunds;

· provide customer support and respond to requests or complaints;

· authenticate users, prevent fraud and protect the security of customers, transactions and systems;

· maintain business, accounting, tax and transaction records;

· analyse Website performance, customer journeys and campaign effectiveness;

· personalise content, measure advertising and show relevant advertising where permitted;

· send marketing where you have consented or another lawful basis applies;

· manage competitions, promotions, surveys and loyalty activities;

· exercise or defend legal rights and comply with legal or regulatory obligations; and

· improve our products, services, Website and operations.

6. Legal grounds

We process personal information only where a lawful justification applies, which may include:

· your consent;

· processing necessary to enter into or perform a contract with you;

· compliance with a legal obligation;

· protection of your legitimate interests;

· our legitimate interests or those of a third party, where your rights and interests do not override them; or

· another justification permitted by POPIA or applicable law.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal or processing justified on another lawful ground.

7. Mandatory and voluntary information

Information marked as required at checkout or in a form is generally necessary to create an account, process an order, deliver goods, prevent fraud or comply with law. If you do not provide required information, we may be unable to complete the transaction or provide the requested service. Information not marked as required is ordinarily voluntary.

8. Cookies and similar technologies

We and authorised service providers use cookies, pixels, software development kits, tags and similar technologies to keep the Website functioning, remember preferences, secure transactions, understand usage, measure campaigns and support advertising.

These technologies may include:

· Strictly necessary technologies required for checkout, security, account access and core Website functions.

· Functional technologies that remember settings and improve convenience.

· Analytics technologies, including tools associated with Shopify and Google, that help us understand Website use and performance.

· Advertising technologies, including Meta and Google technologies, that help measure campaigns, build audiences and present relevant advertising.

Where required, non-essential technologies will be used only after an appropriate choice or consent. You can manage available choices through the Website’s cookie controls and your browser or device settings. Blocking some technologies may affect Website functionality.

9. Marketing communications

We may use email, WhatsApp and other electronic channels for marketing where you have provided valid consent or where POPIA otherwise permits communication with an existing customer about our own similar products or services.

You may opt out at any time by using the unsubscribe facility in a message, replying or following the instructions provided, or contacting info@thirdkultuur.co.za. Opting out of marketing does not prevent necessary transactional or service communications about an order, account, security matter or customer-service request.

We use Moosend and may use Meta, Google, Shopify and WhatsApp-related services to manage, deliver, personalise or measure communications and advertising. These providers may process identifiers and interaction data in accordance with their roles and applicable terms.

10. Sharing personal information

We may share personal information only where reasonably necessary and lawful, including with:

· Shopify and other hosting, e-commerce, IT, security and support providers;

· Peach Payments, Apple Pay, Payflex, Mobicred and other payment or fraud-prevention providers selected at checkout;

· couriers, warehouses and fulfilment providers;

· Meta, Google, Moosend and WhatsApp-related providers for analytics, communication and advertising purposes;

· professional advisers, auditors, insurers, banks and contracted service providers;

· Superdry brand licensors or authorised brand partners where necessary for licensed brand operations, quality, reporting or rights protection;

· regulators, law-enforcement bodies, courts or other authorities where required or permitted by law; and

· a purchaser, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

We do not sell personal information for money. Some advertising technologies may involve disclosures or matching of identifiers to provide and measure advertising; these activities are governed by this policy, your choices and applicable law.

11. Operators and security obligations

Where a service provider processes personal information for us as an operator, we require appropriate contractual, confidentiality and security commitments. Some providers may act as independent responsible parties for aspects of their services, particularly payment, credit, social-media or communications services.

12. Cross-border processing

Some service providers, systems or support teams may be located outside South Africa, which may result in personal information being transferred to or accessed from another country. We will make such transfers only where permitted by section 72 of POPIA, including where the recipient is subject to adequate protection, appropriate contractual safeguards apply, you consent, or the transfer is necessary for the performance of a contract or another permitted purpose.

13. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to comply with tax, accounting, consumer, corporate or other legal obligations, to resolve disputes, and to establish or defend legal claims.

Retention periods vary by record type. When information is no longer required, we will delete, destroy or de-identify it in a reasonably secure manner, subject to lawful archival or backup cycles.

14. Security

We use appropriate, reasonable technical and organisational measures intended to protect personal information against loss, damage, unauthorised destruction, unlawful access and unlawful processing. Measures may include access controls, supplier due diligence, encryption or tokenisation where appropriate, monitoring, backups and staff or contractor confidentiality requirements.

No system is completely secure. If a security compromise involving personal information creates a notification obligation, we will notify the Information Regulator and affected data subjects as required by POPIA, subject to lawful restrictions.

15. Your rights

Subject to POPIA and other applicable law, you may have the right to:

· ask whether we hold personal information about you and request access to it;

· request correction, completion, deletion or destruction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information;

· object to processing on reasonable grounds where the law permits;

· object to direct marketing and withdraw marketing consent;

· request information about the identity of third parties that have had access to your information where applicable;

· not be subject to certain solely automated decisions where POPIA applies; and

· complain to the Information Regulator or seek another remedy available by law.

To exercise a right, contact info@thirdkultuur.co.za. We may need to verify your identity and may request information reasonably required to locate the relevant records. Rights can be subject to lawful grounds for refusal, retention requirements and prescribed processes or fees.

16. Automated processing and advertising

We and our providers may use automated tools to detect fraud, assess transaction risk, recommend products, segment audiences or measure advertising. Where a decision has legal or substantial effects and is based solely on automated processing, we will apply the protections required by POPIA.

Credit or deferred-payment providers such as Mobicred or Payflex may independently perform eligibility, identity or credit assessments under their own terms and privacy notices. Third Kultuur does not control those independent decisions.

17. Children

The Website is a general retail service and is not directed specifically at children. A person who lacks legal capacity must use the Website with the assistance or authorisation of a parent, guardian or other competent person. We do not knowingly seek consent from a child for processing that requires authorisation under POPIA. If you believe a child has supplied information unlawfully, please contact info@thirdkultuur.co.za.

18. Third-party websites and services

Links to third-party websites, apps or services are provided for convenience. Their processing is governed by their own privacy notices when they determine the purposes and means of processing. We encourage you to review those notices.

19. Complaints

Please send privacy questions or complaints to info@thirdkultuur.co.za so that we can investigate and respond. You may also lodge a complaint with the South African Information Regulator. Current complaint channels and prescribed forms are available at https://inforegulator.org.za.

20. Changes to this policy

We may update this policy to reflect changes in law, technology, providers or our operations. The current version will be published on the Website with its effective date. Where an update materially changes how we use personal information, we will provide additional notice or obtain consent where required.