PetUnion – Privacy Policy

1. WHAT INFORMATION DO WE COLLECT?

We collect information you provide directly, information collected automatically when you use the Site, and information from third parties where applicable.

Categories of personal information we collect

• Account and identity data: full name, username, email address, telephone number, billing and shipping addresses, hashed password, profile photo.
• Pet profile data: pet name, species, breed, age, sex, medical notes, vaccination dates, microchip ID, dietary notes, pet photos.
• Transaction and marketplace data: order history, cart contents, subscription details, invoices, returns, refund records, vendor and product selections.
• Booking and service data: appointment dates and times, service provider notes, special instructions, booking confirmations.
• Payment metadata: payment tokens and transaction metadata processed by Bob Pay; we do not store full card numbers.
• Log and technical data: IP address, device identifiers, browser and operating system, pages visited, cookies and similar tracking technologies.
• Communications: support tickets, chat transcripts, reviews, ratings and messages between buyers and vendors.
• Location and delivery data: delivery addresses, locker selection, pickup codes, courier tracking numbers.

How we obtain information

Directly from you when you register, create pet profiles, place orders, book services, contact support, or otherwise provide information.

Automatically when you use the Site (cookies, server logs, analytics).

From third parties such as payment processors, courier/locker providers, or public sources when necessary for fulfilment or verification.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process personal information to provide and improve our services and to operate the marketplace.

Primary processing activities

• Account management: create, authenticate and maintain user accounts and pet profiles.
• Order fulfilment: process purchases, manage subscriptions, generate invoices, coordinate shipping and locker pickups, and provide tracking updates.
• Marketplace operations: share order and delivery details with vendors so they can fulfil purchases and provide customer service.
• Bookings and services: schedule and manage appointments and communicate with service providers.
• Communications: send transactional messages about orders, bookings and account activity; respond to support requests.
• Analytics and improvement: analyse usage with Google Analytics and Chipmunk to improve the Site and personalise recommendations.
• Fraud prevention and security: detect and prevent fraud, abuse and security incidents.
• Legal compliance: retain and disclose information as required by law or to respond to lawful requests.

Processing is performed by Pet Union staff and by third‑party processors under contract who act on our instructions.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

Where applicable, we rely on the following legal bases:

• Performance of a contract: to create and manage accounts, process orders, fulfil deliveries, manage subscriptions and provide booked services.
• Legal obligation: to comply with tax, accounting and regulatory requirements.
• Legitimate interests: to operate and secure the Site, prevent fraud, improve services, personalise recommendations and manage the marketplace, balanced against your rights.
• Consent: for marketing communications, optional profiling and non‑essential cookies; you may withdraw consent at any time.
• Compliance with POPIA and GDPR: where applicable, we process data in accordance with data protection laws and your rights under those laws.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We share personal information only as necessary and under contractual safeguards.

Recipients and purposes

• Vendors: when you purchase a vendor’s product we share the buyer’s name, delivery address, contact number and order details with the vendor to enable fulfilment and customer service. Vendors are independent controllers for their own processing of buyer data and must comply with applicable data protection laws and our marketplace rules. Vendors may not use buyer contact details for unrelated marketing unless they obtain separate consent.
• Couriers and locker providers: we share delivery and contact details with Bob Go and other carriers to book shipments and provide tracking. Locker pickup codes are generated and sent to you by email or SMS.
• Payment processors: we share transaction metadata and payment tokens with Bob Pay and other payment processors to authorise and settle payments. We do not store full card numbers.
• Service providers and processors: we share data with hosting, analytics, email/SMS, accounting and other service providers who process data on our behalf under contract (for example, Google Analytics and Chipmunk).
• Legal and safety disclosures: we may disclose information to comply with legal obligations, to respond to lawful requests, to protect rights and safety, or to enforce our Terms & Conditions.
• Business transfers: in the event of a merger, acquisition or sale of assets, personal information may be transferred as part of the transaction subject to confidentiality and data protection safeguards.

We do not sell personal information for direct marketing purposes.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

Our Site may contain links to third‑party websites and services. We are not responsible for the privacy practices or content of those sites. When you follow links to third parties, their own privacy policies govern their collection and use of your information. We recommend you review the privacy notices of any third‑party site before providing personal information.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

Yes. We use cookies and similar technologies for essential site functions, analytics and marketing.

Cookie categories

• Essential cookies: required for login, cart persistence, security and core functionality.
• Analytics cookies: used by Google Analytics and Chipmunk to measure and improve Site performance.
• Marketing cookies: used for personalised advertising and promotions; these are used only with your consent.

A cookie banner appears on first visit to explain categories and obtain consent for non‑essential cookies. You can change cookie preferences at any time via the cookie settings link in the Site footer. For our full Cookies Policy see the Related documents section.

7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

We may use automated tools and AI‑based features to enhance the user experience (for example, personalised product recommendations, search ranking, or content suggestions). These tools process behavioural and profile data to generate recommendations. Automated processes do not make legal or similarly significant decisions about you. Where profiling or automated decision‑making is based on consent, you may withdraw consent at any time by contacting support.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

We retain personal information only as long as necessary for the purposes described and to meet legal obligations.

Retention periods

• Routine account and profile data: retained for six (6) months from the date of last activity unless you request deletion or a longer retention is required for a specific purpose.
• Transaction records: retained for longer where required by law for tax and accounting purposes; we retain only the minimum data necessary.
• Pet health notes and booking records: retained for the period necessary to provide services and to meet legal obligations or resolve disputes.
• Deletion requests: if you request deletion of your account we will remove or anonymise your personal information within a reasonable timeframe, except where retention is required by law or for legitimate business purposes such as fraud prevention or dispute resolution.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

We implement reasonable technical and organisational measures to protect personal information:

• Encryption of data in transit using TLS/HTTPS.
• Access controls and role‑based permissions for staff and vendors.
• Secure hosting with regular security patching.
• Use of reputable third‑party processors that maintain appropriate security standards, including PCI compliance for payment processors.
• Regular backups and incident response procedures.
• Staff training on data protection and confidentiality.

While we take reasonable steps to protect data, no system is completely secure. If a data breach affecting your personal information occurs, we will follow applicable law and notify affected individuals and regulators as required.

10. DO WE COLLECT INFORMATION FROM MINORS?

You must be 18 years or older to create an account on Pet Union. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a person under 18 without appropriate consent, we will take steps to delete that information.

11. WHAT ARE YOUR PRIVACY RIGHTS?

Under POPIA and the GDPR (where applicable), you have rights including:

• Access: request a copy of personal information we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of personal information where legal grounds permit.
• Restriction: request limitation of processing in certain circumstances.
• Portability: request a machine‑readable copy of data you provided to us.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdraw consent: withdraw consent where processing is based on consent.
• Lodge a complaint: with the South African Information Regulator or, if you are in the EU, with your local supervisory authority.

To exercise any of these rights contact support@petunion.co.za. We will verify requests and respond in accordance with applicable law and statutory timeframes.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Some browsers support Do‑Not‑Track (DNT) signals. At present, our Site does not automatically alter behaviour in response to DNT signals. You can control tracking by adjusting cookie preferences in our cookie banner, disabling cookies in your browser, or using privacy tools and browser extensions.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

If you are a United States resident, certain state laws may provide additional rights regarding your personal information. Where applicable, we will honour rights required by state law, such as access, deletion and opt‑out rights. To exercise any rights available under U.S. state law, contact support@petunion.co.za and specify your request and state of residence.

14. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

Residents of the European Union have rights under the GDPR, including access, rectification, erasure, restriction, portability and the right to object. We will process requests from EU residents in accordance with GDPR requirements. Other jurisdictions may provide additional rights; where applicable we will comply with local law.

15. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Policy to reflect changes in our practices, legal requirements or services. When we make material changes we will post the updated Policy on the Site with a revised effective date and, where required, obtain consent for material changes to how we process personal data.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

For questions, requests or complaints contact:

BLUENOVA INTERNET AND AI SOLUTIONS
Email: support@petunion.co.za

If you remain dissatisfied after contacting us you may lodge a complaint with the South African Information Regulator or, if you are in the EU, with your local data protection authority.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You can review and manage certain personal information from your account settings on the Site. To request access, correction, deletion, restriction or portability of your data, or to withdraw consent, contact support@petunion.co.za with a clear description of your request. We will verify your identity and respond in accordance with applicable law and statutory timeframes.

18. RELATED DOCUMENTS

This Privacy Policy covers only privacy and data protection. For other policies referenced on the Site, see:

• Terms & Conditions (site footer)
• Cookies Policy (site footer)
• Vendor Privacy Addendum (vendor onboarding)
• Returns & Refunds Policy (checkout and product pages)