Privacy Policy

1. Who we are (Responsible Party)

The responsible party under POPIA is Lizz Meiring Productions (Pty) Ltd ("we"), South Africa, operator of lizzmeiring.com. For any privacy enquiry, or to exercise your rights below, contact our Information Officer at info@lizzmeiring.com. For technical issues with the website, contact the webmaster at webmaster@themasked.co.za.

The website is technically developed and hosted by The Masked House (Pty) Ltd, which acts as an operator under sections 20–21 of POPIA — processing personal information on our behalf only with our authority and subject to confidentiality and security obligations.

2. What information we collect

What you provide yourself: name, surname, email address, phone number, delivery address, account password (stored encrypted), the content of contact forms, and for message requests: the recipient's name and the information you provide about that person. Automatically: the essential cookies below, standard server logs (IP address, date/time) for security and fault-finding, and our own visitor statistics as set out in section 6. We do not knowingly collect special personal information (such as health or religion) — please do not include it in forms.

Payment information: payments are processed entirely by our payment providers (PayFast, Yoco, Ozow) as independent responsible parties. Your card or bank details never reach or get stored on our server. We only receive confirmation that payment succeeded, with a reference number.

3. Lawful basis and purposes of processing

We process personal information only (a) to perform a contract with you — orders, message requests, accounts; (b) with your consent — e.g. when you send the contact form; (c) where a law requires it — e.g. financial record-keeping; and (d) for our legitimate interest in keeping the website secure. We send no marketing material without consent, and you may withdraw any consent at any time.

4. Information about other people (message recipients)

When you request a personal message you provide information about a third person. By doing so you confirm that you are entitled to share that information. We use it solely to create the message, share it with no one else, and it is archived with the recording and eventually deleted as set out in section 7.

5. Sharing of information

We never sell or rent personal information. It is shared only with: the courier company (name, address, phone number — to deliver your order); our payment providers (to process payment); our webmaster/host (technical maintenance, under a duty of confidentiality); and authorities where a law or court order requires it. All information is hosted in South Africa; no cross-border transfer takes place without POPIA compliance.

6. Cookies

Only two essential cookies: your login session and your language choice (AF/EN). No advertising, analytics or tracking cookies. Where Cloudflare Turnstile is used on forms, Cloudflare may set a functional cookie to confirm you are human — see Cloudflare's own privacy policy.

Visitor statistics. We keep our own statistics on how the website is used. This is done entirely on our own server — we do not use Google Analytics or any other third-party service, and no information about your visit is passed to anyone outside our organisation. There is no analytics cookie either.

For each page visited we record: the date and time, the page, the language, your IP address, your browser and operating system (from the user-agent), and the website you followed a link from. We do this to understand which content is being read, where visitors come from, and to detect misuse of the website — our legitimate interest under section 11(1)(f) of POPIA.

We recognise that an IP address is personal information. It is not used to identify you personally, is not shared with anyone, is not used for marketing or profiling, and is deleted automatically along with the rest of the visit record when the retention period expires (365 days by default). You may ask us to delete your visit records at any time — see section 8.

7. Security and retention (sections 19 and 14)

We apply reasonable technical and organisational measures: HTTPS encryption, encrypted passwords, role-based access control, security headers, login throttling and input validation. Personal message recordings are available via a secured link for 10 days only, after which they move to a non-public archive; archives and outdated records are periodically deleted. Account and transaction records are retained as long as the law (e.g. tax legislation) requires, after which they are deleted or anonymised. Should a security compromise affect personal information, we will notify the Information Regulator and affected persons as required by section 22.

8. Your rights (sections 23–25 and 11(3))

You have the right to: ask what information we hold about you (free of charge); request correction or deletion; object to processing; withdraw consent; and lodge a complaint with the Information Regulator of South Africa: JD House, 27 Stiemens Street, Braamfontein, Johannesburg · POPIAComplaints@inforegulator.org.za · inforegulator.org.za. Send requests to info@lizzmeiring.com; we respond within a reasonable time and will first verify your identity.

9. Children

The website is not directed at children under 18. Purchases and message requests may only be made by persons 18 and older, or with the consent of a parent/guardian.

10. Changes

We may update this policy from time to time; the "last updated" date above will change. Material changes will be announced on the website.