Legal
Privacy Policy
Last updated: 24 September 2026
Merchhaus respects your privacy and processes your personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect, why, who we share it with, and the rights you have.
1. Who we are
MerchHaus (Pty) Ltd (registration number 2026/414364/07), trading as Merchhaus ("Merchhaus", "we", "us"), is the responsible party for personal information collected through merchhaus.co.za, merchhaus.store, our social media pages, our event merchandise stands and our direct communications with you.
2. What we collect
| When you... | We collect |
|---|---|
| Send an enquiry or request a quote | Name, company name, email, phone number, and the details of your request |
| Join the Fan Club | Name, email address, mobile number and your marketing consent |
| Place an order or pre-order | Name, email, phone, billing and delivery address, and order history. Card details are handled by our payment provider, not stored by us |
| Collect an order at an event | Name, order number and, where needed, proof of identity to release the order |
| Work with us as a corporate client | Contact details of your staff, company details, logos, artwork and sizing information |
| Browse our websites | Device and browser type, IP address, approximate location, pages visited and how you interact with the site. See our Cookie Policy |
| Contact us on social media | Your profile name and the content of your messages |
We collect most of this directly from you. We do not knowingly collect special personal information (such as health, religious or biometric information).
3. Why we use it
We only process personal information for a specific, lawful purpose, as POPIA requires:
- To perform our contract with you: processing orders, pre-orders and payments, arranging delivery or event pickup, and producing branded goods.
- To respond to you: answering enquiries, preparing quotes and providing customer support.
- With your consent: sending you Fan Club updates, marketing and early access offers.
- For our legitimate interests: improving our websites and products, preventing fraud, and keeping our systems secure.
- To meet legal obligations: keeping tax and accounting records and responding to lawful requests from authorities.
4. Direct marketing and your consent
We will only send you electronic marketing (email, SMS or WhatsApp) if:
- You have opted in. For example, by joining the Fan Club or ticking the marketing consent box. These boxes are never pre-ticked.
- Or you are an existing customer. We may then tell you about our own similar products and services, and you can opt out at any time.
Every marketing message includes a free, easy way to unsubscribe. You can also opt out by emailing hello@merchhaus.co.za. Opting out of marketing does not affect service messages about an order you have placed.
We never sell your personal information, and we do not share it with third parties for their own marketing without your separate, explicit consent.
5. The Fan Club
When you join the Fan Club, we create a customer profile for you in our online store so you can access members-only products. Joining means you agree to receive Fan Club communications. You can leave at any time by unsubscribing or contacting us, and we will stop sending you Fan Club messages.
If you are under 18, you need a parent or guardian's consent to join. We may ask for confirmation of that consent.
6. Who we share it with
We share personal information only where necessary and only with parties bound to protect it:
- Service providers (operators): our e-commerce platform (Shopify), website hosting, email delivery services, payment provider YOCO, analytics (Google), and business email (Microsoft 365).
- Collections: event merchandise is collected at the Merchhaus store or pop-up stand at the event. We do not currently use a courier.
- Event and artist partners: only what's needed to run merchandise sales or pickup at an event, such as the name on a pickup order.
- Authorities: where the law requires it.
Our operators may only process your information on our instructions and must keep it secure and confidential.
7. Transfers outside South Africa
Some of our service providers store data on servers outside South Africa, including in the United States, Canada and the European Union. We only use providers that are subject to data protection laws or binding agreements that give your information protection comparable to POPIA.
8. How long we keep it
We keep personal information only for as long as we need it for the purpose it was collected, or as the law requires. For example, we keep financial and tax records for at least five years. Fan Club details are kept until you leave the Fan Club. When we no longer need information, we delete or de-identify it.
9. How we protect it
We use reasonable technical and organisational measures to protect your information, including encrypted connections (SSL), access controls and reputable service providers. No system is completely secure, however. If we believe your personal information has been accessed without authorisation, we will notify you and the Information Regulator as POPIA requires.
10. Your rights
Under POPIA you have the right to:
- Ask whether we hold personal information about you, and request a copy of it.
- Ask us to correct or update inaccurate information.
- Ask us to delete information we no longer have a lawful reason to keep.
- Object to us processing your information, including for direct marketing.
- Withdraw your consent at any time, without affecting processing that happened before.
- Lodge a complaint with the Information Regulator.
To exercise any of these rights, contact our Information Officer below. We may need to verify your identity first.
11. Contact us
- Information Officer: Julien van Wyk
- Email: hello@merchhaus.co.za
- Phone: +27 82 562 1522
- Address: 6 10th Close, Brandwacht aan Rivier, Stellenbosch, Western Cape, 7600, South Africa
If you're not satisfied with our response, you can contact the Information Regulator (South Africa) at inforegulator.org.za or enquiries@inforegulator.org.za.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.