◇ ◆ ◇

Legal

Privacy Policy

How we collect, use, and protect your personal information in compliance with POPIA.

1. Introduction

All Things Hookah – Puff & Pass ("we", "us", "our") is committed to protecting your privacy in accordance with the Protection of Personal Information Act (POPIA) of South Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our services.

By using our website and services, you consent to the practices described in this policy.

2. Information We Collect

We may collect the following types of personal information:

  • Identity Information: Name, username, and email address when you register an account.
  • Contact Information: Email address and any other contact details you provide.
  • Booking Information: Details of your hookah bookings, including session dates, hookah preferences, flavour selections, and zone preferences.
  • Payment Information: Payment is processed securely through PayFast. We do not store or have access to your full payment card details.
  • Communication Records: Records of communications related to your bookings or inquiries.
  • Technical Data: IP address, browser type, device information, and usage data collected via cookies and similar technologies.

3. How We Use Your Information

We use your personal information for the following purposes:

  • To process and manage your hookah bookings.
  • To communicate with you regarding your bookings, including confirmations and updates.
  • To process payments and refunds through our payment gateway (PayFast).
  • To improve our website, services, and customer experience.
  • To comply with legal and regulatory obligations.
  • To send you service-related communications (not marketing).

4. Legal Basis for Processing

We process your personal information based on the following legal grounds under POPIA:

  • Consent: Where you have given us explicit consent to process your data.
  • Contractual necessity: To fulfil our obligations under our booking agreement with you.
  • Legal obligation: To comply with applicable laws and regulations.
  • Legitimate interest: For improving our services and ensuring website security.

5. Information Sharing & Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

  • PayFast: Our payment processing partner, solely for the purpose of processing your payments.
  • Legal authorities: When required by law or to protect our legal rights.
  • Service providers: Third-party service providers who assist us in operating our website and business (e.g., hosting providers), subject to strict data protection agreements.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure. These include:

  • SSL/HTTPS encryption on our website.
  • Secure payment processing through PayFast.
  • Access controls and authentication for our systems.
  • Regular security reviews and updates.

7. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Booking records are retained for a minimum of 5 years for tax and legal purposes. Account information is retained until you request deletion.

8. Your Rights Under POPIA

You have the following rights regarding your personal information:

  • Right to Access: Request a copy of the personal information we hold about you.
  • Right to Correction: Request correction of inaccurate or incomplete information.
  • Right to Deletion: Request deletion of your personal information, subject to legal retention requirements.
  • Right to Object: Object to the processing of your personal information for certain purposes.
  • Right to Withdraw Consent: Withdraw your consent at any time where processing is based on consent.
  • Right to Complain: Lodge a complaint with the Information Regulator of South Africa.

9. Cookies

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse website traffic, and understand where our visitors come from. You can control cookie preferences through your browser settings. By continuing to use our website, you consent to our use of cookies as described in this policy.

10. Third-Party Links

Our website may contain links to third-party websites (e.g., PayFast, MacNose Shortleft Cafe). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your personal information.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Changes will be effective immediately upon posting to this page. We encourage you to review this policy periodically. Your continued use of our services after any changes constitutes acceptance of the updated policy.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

Last updated: July 2026