Privacy & POPIA Notice

1. Who is responsible and how to contact us

Bull ^ Bush (PTY) LTD, operating Panda Labs, is responsible for the customer information collected through this website. Business contact address: Linbro Business Park, Sandton 2090.

Send privacy, access, correction, objection or deletion requests to sales@pandalabs.co.za. We may ask for proportionate proof that a request concerns your information before acting on it. Do not email an ID document or full ID number unless a secure, necessary process has first been agreed.

2. Information we collect

For registration we collect your name, email address, password, ID type and ID or passport number, together with records of your terms acceptance, privacy-notice acknowledgement and qualified-researcher/age declaration. Passwords are stored as password hashes, not readable passwords.

For orders we collect your delivery name, contact number, address, ordered products, order history and payment references or verification status. PayFast collects payment information on its own secure checkout; this website does not collect your card number or card security code.

If you contact us, submit a review or separately subscribe to updates, we process the information you submit for that purpose. Hosting and security systems may also process technical information such as request times, network addresses, cookies and operational logs.

3. Why we collect it and whether it is required

We use account details to identify your customer account, authenticate access and show your own orders. We request an ID or passport number as a declared identity record supporting accountability for researcher-only purchases and our age requirements. We do not perform a government identity check, and collecting a number is not proof of verified identity or research qualifications.

The registration fields and declarations are required to create a purchase-ready account. If you choose not to provide them, you may browse subject to the entry-age restriction, but you cannot complete checkout. Existing customers may view their account and past orders but must complete the new requirements before purchasing again.

We use order and delivery details to process payments, fulfil purchases, communicate about orders, handle disputes and meet applicable legal obligations. We rely on appropriate lawful grounds under POPIA, including steps necessary for a contract, legal obligations, legitimate interests where justified, or consent where applicable. Marketing subscriptions are separate and optional.

4. Privacy and security safeguards

We aim to keep your information as private as reasonably possible and apply reasonable safeguards. ID and passport numbers are encrypted by the application before database storage. They are not included in routine customer-session responses, order summaries or order emails, and are not displayed in the ordinary customer or admin order screens.

Accounts use password hashing, session-based access controls and checks that customers access only their own account orders. Operational access is limited to what is needed for the task. We do not use ID or passport numbers for marketing.

No website, service or transmission can be guaranteed completely secure. If a security compromise occurs, we will assess and respond to it and make notifications to the Information Regulator and affected people where required by POPIA. Please report suspected misuse to our contact email.

5. Service providers, sharing and overseas processing

We share information only where needed for the relevant purpose: PayFast for payments, the selected courier for delivery, hosting and database providers for operating the service, and email providers for communications. These providers may process information under their own applicable legal duties and privacy notices. We may also disclose information where legally required.

Some hosting, email, backup or support processing may take place outside South Africa. POPIA restricts cross-border transfers; appropriate lawful grounds and safeguards must apply to any such transfer. Contact us for information about the providers relevant to your data. This notice is not a claim that data always remains in South Africa.

6. Retention and deletion

We retain personal information only for as long as reasonably necessary for its stated purpose or a lawful retention requirement. Account and encrypted identity records are kept while required for the account and purchase-eligibility record; order, accounting, security or dispute records may need to be retained separately for applicable legal periods.

You can request account closure or deletion through sales@pandalabs.co.za. We will assess the request and explain any information that must be retained, the reason, and any applicable charges or procedures before proceeding. Deletion may not immediately remove information from restricted backups, which follow the provider's retention processes. We do not promise an automatic deletion schedule that this website does not implement.

7. Your POPIA rights

Subject to POPIA's conditions and lawful exceptions, you may ask whether we hold your personal information, request access, ask for correction or deletion, object to certain processing, withdraw consent where processing relies on consent, and complain about misuse. Withdrawing marketing consent does not automatically erase records needed to fulfil an order or meet legal obligations.

Contact sales@pandalabs.co.za to exercise these rights. If we cannot resolve a concern, you may complain to the Information Regulator of South Africa using its current complaint procedures and contact details.

8. Cookies, browser storage and marketing

The website uses session cookies to keep you signed in and browser storage for functions such as your cart, checkout continuity and age acknowledgement. Anyone using a shared device should sign out and take care with information left in that browser.

We do not automatically enrol registered customers in marketing. If you separately subscribe to email updates, you can ask to unsubscribe by replying or contacting sales@pandalabs.co.za. Necessary order and account communications are different from marketing.

9. Changes to this notice

We will publish updates with an effective date and request renewed acknowledgement where required. Contact us if you need an explanation before submitting information. A published policy does not, by itself, certify POPIA compliance; our handling of data must also meet the law in practice.