Lute Diamonds (Pty) Ltd respects your privacy. This policy explains what personal information we collect when you visit www.lutediamonds.com, why we collect it, who we share it with, and the rights you have over it.

We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). We are the responsible party for the information described here.

Questions about this policy, or requests about your personal information, should go to our Information Officer:

• Email: luteig@gmail.com
• Post: Lute Diamonds (Pty) Ltd, 25 Villiers Street, Kimberley, 8301, South Africa

We keep this deliberately minimal. Depending on how you use the site, we may hold:

• Account details — your name, email address and an encrypted version of your password. We do not ask for a phone number or a social login to register.
• Order details — delivery address, contact number for the courier, the items you bought, and your order history.
• Correspondence — messages you send us by email, the contact form or social media, and our replies.
• Content you post — product reviews, ratings and wishlist items.
• Technical information — IP address, browser and device type, pages viewed and referring links, collected through cookies and server logs.

• To fulfil your order — process payment, arrange delivery, handle returns and honour warranties. This is necessary to perform our contract with you.
• To manage your account — authenticate you, show your order history and wishlist, and reset your password.
• To support you — answer questions and resolve complaints.
• To meet legal obligations — tax and accounting records, and any obligations relating to the trade in precious stones and metals.
• To protect the business — detect and prevent fraud and abuse. This is our legitimate interest.
• To send marketing — only if you have opted in, or if you are an existing customer and we are telling you about similar pieces. You can opt out at any time.

We do not sell your personal information, and we never rent or trade it. We share only what is necessary, with:

• PayGate — to process and verify your payment
• Courier partners — your name, delivery address and contact number, so they can deliver your parcel
• Hosting and email providers — who store the site and send transactional emails on our behalf
• Professional advisers — our accountants and, where necessary, our attorneys
• Authorities — where the law requires it, or to establish or defend a legal claim

These operators may only use your information to provide their service to us, and are required to keep it secure and confidential.

Some of our service providers — for example hosting and email delivery — operate servers outside South Africa. Where information leaves the country, we only use providers who are subject to laws or binding agreements that give your information a level of protection comparable to POPIA, as required by section 72.

Cookies are small files stored by your browser. We use them for:

• Essential functions — keeping you signed in and remembering your cart and wishlist. The site cannot work without these.
• Analytics — understanding which pages are visited so we can improve the store. This data is aggregated.

You can block or delete cookies in your browser settings, but blocking essential cookies will stop you from signing in or checking out.

• Order and invoice records — at least five years, as required by South African tax law
• Account details — until you ask us to close your account
• Marketing consent — until you withdraw it
• Support emails — up to three years after the matter is closed

When information is no longer needed, we delete it or de-identify it so it can no longer be linked to you.

The site runs over encrypted HTTPS connections and passwords are stored hashed, never in plain text. Access to customer data is limited to staff who need it. No system is completely secure, but if a breach ever affects your personal information we will notify you and the Information Regulator as POPIA requires.

Under POPIA you have the right to:

• Ask what personal information we hold about you, and get a copy of it
• Ask us to correct or complete anything that is inaccurate
• Ask us to delete or destroy information we no longer have a reason to keep
• Object to processing based on our legitimate interests
• Withdraw your consent to marketing at any time
• Complain to the Information Regulator

Email luteig@gmail.com to exercise any of these. We may ask you to verify your identity first, and will respond within a reasonable time. Some records — such as tax invoices — must be kept even after you close your account.

We only send marketing where you have opted in or where you have bought from us before. Every marketing email has an unsubscribe link, and you can also reply asking to be removed. Transactional emails — order confirmations, dispatch notices, password resets — are part of the service and will still be sent.

This store is intended for adults. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us their information, contact us and we will delete it.

If you believe we have handled your personal information unlawfully, please raise it with us first. You also have the right to lodge a complaint with:

• The Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Website: inforegulator.org.za

We may update this policy as our business or the law changes. The revision date at the top of the page tells you when it last changed. Material changes will be communicated by email or a notice on the site. Our Terms & Conditions should be read together with this policy.