Privacy policy
YUM BABY PRIVACY POLICY
Last updated: 9 October 2026
1. WHO WE ARE
Yum Baby is operated by Kirsty Jane Tramontino trading as Yum Baby, a sole proprietor based in South Africa. In this policy, “Yum Baby”, “we”, “us” and “our” refer to this business.
We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information whose purposes and use we determine.
This policy explains how we handle personal information when you visit yumbaby.co.za, place an order, contact us, subscribe to marketing or interact with our social media and advertisements. Our store serves customers in South Africa and is hosted on Shopify.
Privacy contact: Kirsty Jane Tramontino
Email: hello@yumbaby.co.za
Telephone and WhatsApp: +27 82 419 3838
Business address: 6 Sanremo Crescent, Sunninghill, 2191, South Africa
Website: https://yumbaby.co.za
This policy provides information about our practices. Visiting our website or buying a product does not, by itself, constitute consent to every type of processing or marketing described here.
2. INFORMATION WE COLLECT
Depending on how you interact with us, we collect:
• Contact details, such as your name, email address and telephone number.
• Order details, including products, quantities, billing and delivery addresses, payment status, transaction references and order history.
• Customer account information, where you create an account, including account identifiers and preferences.
• Enquiry and support information you provide through forms, email, WhatsApp or social media, including messages about deliveries, refunds or complaints.
• Marketing preferences, subscription status and records of consent, withdrawal or objection.
• Reviews or feedback you submit, together with any name or other information you choose to include.
• Website interaction information, such as pages viewed, products viewed, cart activity, checkout activity and purchases.
• Technical information, such as IP address, browser, device information, approximate location, referral source and cookie or similar identifiers.
Technical and interaction information can be personal information even when it does not include your name.
PayFast processes payment details needed to complete your transaction. We receive payment confirmations and related transaction information. Please do not send payment credentials or full card details to us by email or WhatsApp.
3. WHERE INFORMATION COMES FROM
We receive information directly from you when you shop, subscribe, create an account or contact us. Shopify and connected services process information generated through your use of the store. We also receive relevant information from PayFast, MyCourier and the social platforms through which you contact us or submit an enquiry.
Yum Baby holds customer records transferred as part of the change in business ownership. Possession of those records does not automatically establish permission to send marketing. Marketing use must be supported by valid consent or another applicable lawful basis, including the conditions for existing-customer marketing where these apply.
4. WHY WE USE INFORMATION
We use personal information to:
• Process and fulfil orders, confirm payments and arrange delivery.
• Communicate about orders, preparation, delivery, refunds and support requests.
• Manage customer accounts and maintain transaction records.
• Respond to enquiries and investigate complaints.
• Send marketing in accordance with your choices and applicable law.
• Understand website use and measure advertising performance.
• Protect the store, prevent fraud and investigate unauthorised activity.
• Meet legal, accounting and tax obligations and address disputes.
We rely on the lawful basis appropriate to each purpose. This may be processing necessary to conclude or perform a contract, compliance with a legal obligation, a legitimate interest permitted by POPIA, or your consent. Where POPIA imposes additional conditions, those conditions also apply.
Information needed for payment, delivery and order communication is necessary to complete your purchase. If you do not provide it, we may be unable to fulfil your order. Marketing subscriptions are voluntary. You may decline marketing and still buy from us.
5. EMAIL MARKETING AND YOUR CHOICES
Shopify Messaging is our installed email marketing tool. Our checkout displays an optional email marketing signup that is not preselected. You must actively choose to subscribe.
Where subscription confirmation is used, you will be asked to confirm your subscription before it is activated. This policy does not treat an unconfirmed request as blanket marketing consent.
You can unsubscribe using the link in a marketing email or contact hello@yumbaby.co.za. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. We may keep a limited record of your objection so that we do not send you further marketing against your wishes.
Unsubscribing from marketing does not stop necessary messages about an order, payment, delivery or support request.
Our checkout currently does not offer SMS or WhatsApp marketing signup. Providing a telephone number for delivery does not automatically authorise promotional SMS or WhatsApp messages. If these marketing channels are introduced, we will explain the purpose, provide the required choice and a way to stop messages, and update this policy where necessary.
6. FACEBOOK, INSTAGRAM AND META LEAD FORMS
Our marketing plans include Facebook and Instagram advertising, lead forms, Meta Pixel, Conversions API and retargeting. The following explains how these tools process information when used.
Meta lead forms request your name and email address. A telephone number is optional. We use the details you submit to respond to the enquiry or request described in the form, by email or WhatsApp where you provide a suitable number and request that contact. Ongoing promotional messages require the appropriate marketing permission or other applicable lawful basis.
Meta Pixel can send website activity and technical identifiers to Meta. Conversions API can send selected events directly from the store or connected systems to Meta. These may include product views, cart additions, checkout activity, purchases, transaction values and technical identifiers. Depending on the configured integration, customer contact details may also be transmitted in hashed form to match events with Meta accounts. Hashing does not make this information anonymous.
When enabled, these tools support advertising measurement, conversion reporting and retargeting. Meta may associate the information with an account on its platforms and process it under its own terms and privacy policy.
We do not upload customer email or telephone lists to create Meta advertising audiences. This is separate from event data that may be sent through an enabled Pixel or Conversions API integration.
Meta's privacy policy explains its practices and available controls: https://www.facebook.com/privacy/policy/
7. COOKIES AND SIMILAR TECHNOLOGIES
Cookies and similar technologies support store functions, remember preferences and, where permitted, support analytics, personalisation and advertising.
Essential technologies support functions such as the shopping cart, checkout and security. Non-essential technologies include those used for analytics and advertising.
We have configured Shopify's cookie banner for South African visitors. It offers Accept, Decline and Manage preferences options. Use these controls to choose whether to allow non-essential purposes. Your email marketing choice is separate from your cookie choice.
You can also manage cookies through your browser. Blocking essential cookies may affect checkout or other store functions. Browser cookie controls do not necessarily stop server-to-server processing, such as Conversions API. Any such processing must be handled according to the applicable purpose, lawful basis and consent requirements.
If you cannot access or change a preference, contact us using the details above. Shopify's cookie information is available at https://www.shopify.com/legal/cookies.
8. SHOPIFY AND SHOPIFY NETWORK INTELLIGENCE
Shopify processes information when you visit or buy from our store. Shopify Network Intelligence is enabled. For its Enhanced Services, Shopify combines information from interactions with our store, other merchants and Shopify to support features including personalisation, advertising and improvements to its services. Other merchants cannot view our customer records through this feature.
Information is shared with Shopify and relevant service providers, including providers outside South Africa. Shopify also determines certain processing purposes for its own services. Our policy does not replace Shopify's privacy notice.
Shop remarketing settings are enabled for cart reminders, back-in-stock notifications, price-drop notifications and browse-abandonment reminders. These features may allow Shop to send eligible users email or push reminders based on storefront activity, subject to Shopify's settings and the user's applicable choices.
Learn about Shopify's processing in its Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers.
You can access Shopify's privacy choices and exercise applicable rights directly through https://privacy.shopify.com/. You may also contact us about information held by Yum Baby.
9. WHO RECEIVES INFORMATION
We share information relevant to the services being provided with:
• Shopify, to operate the store, manage orders and provide connected services, including Shopify Messaging and the features described above.
• PayFast, to process payments and related payment issues.
• MyCourier, to arrange delivery, using relevant recipient and delivery details.
• Meta, where you interact with its platforms, submit lead forms or enabled advertising tools process relevant events.
• Email, messaging and technical service providers, where needed to receive enquiries, send communications or operate and protect the store.
• Professional advisers, regulators, courts or other recipients where necessary and lawful for legal obligations, accounting, dispute resolution or protection of rights.
Kirsty manages customer records within the business. Service providers may nevertheless process information as described here. We do not treat information disclosed to a provider as unrestricted permission for unrelated use. Where a provider acts as our operator, appropriate confidentiality, security and processing obligations must apply.
If a future business transfer involves personal information, any disclosure or transfer must meet applicable legal requirements, with notice where required.
10. STORAGE AND INTERNATIONAL PROCESSING
Shopify is our main customer-record system. We do not routinely export customer records to spreadsheets. Enquiries sent through email, WhatsApp or social media are also processed within the relevant communication service.
Shopify's current hosting setting for this store identifies the United States. Shopify, Meta and other service providers may store or process information in additional countries outside South Africa.
International transfers are subject to section 72 of POPIA. An appropriate permitted basis must apply, such as an adequate level of protection provided by applicable law, binding corporate rules or an agreement, or another basis allowed by POPIA. We do not assume that foreign hosting alone provides protection equivalent to POPIA.
11. RETENTION AND SECURITY
Retention depends on the purpose and applicable obligations. Order and payment records may need to be kept for accounting, tax and legal requirements. Enquiries and complaints may need to be retained to provide support or resolve disputes. Marketing preference records may be needed to demonstrate permission or honour an unsubscribe request.
POPIA requires personal information not to be retained longer than necessary unless continued retention is lawfully authorised. When information is no longer needed and retention is not otherwise authorised, it must be deleted, destroyed or de-identified appropriately. A deletion request may therefore not result in immediate removal of every transaction record.
We must apply reasonable technical and organisational safeguards against loss, unauthorised access and unlawful processing. No online system can guarantee complete security. If a security compromise requires notification under POPIA, we will notify the Information Regulator and affected people as required by law.
12. CHILDREN'S INFORMATION AND REVIEWS
Our store is intended for adults purchasing food for children. We do not currently request or intentionally collect identifiable children's details, photographs or health and allergy information. Buying baby food does not require you to provide a child's name or date of birth.
Please avoid sending unnecessary sensitive information about a child. If you believe a child has provided personal information, contact us so that we can assess it and take appropriate steps. Any future intentional collection of children's or health information must meet the additional requirements of POPIA and be explained before collection.
Information included in a publicly displayed review may be visible to other visitors. Avoid including private details about children or others. Contact us if a review contains personal information you want us to assess for correction or removal. This policy does not give us blanket permission to publish private messages or photographs.
13. YOUR RIGHTS
Subject to POPIA and other applicable law, you may:
• Ask whether we hold personal information about you and request access to it.
• Request correction of inaccurate or incomplete information.
• Request deletion or destruction of information that is excessive, irrelevant, outdated, misleading, unlawfully obtained or no longer lawfully retained.
• Object to processing where the law allows and object to direct marketing.
• Withdraw consent where processing relies on consent.
• Exercise applicable protections concerning decisions based solely on automated processing that have legal or substantial effects.
• Lodge a complaint with the Information Regulator.
Send requests to hello@yumbaby.co.za. We may ask for information reasonably needed to verify your identity and protect your records. We will explain any lawful limit on a request, any applicable procedure or permitted fee, and respond within the period required by law or otherwise within a reasonable time.
14. COMPLAINTS
Contact Kirsty Jane Tramontino at hello@yumbaby.co.za about any privacy concern. You may also complain directly to South Africa's Information Regulator. You do not have to obtain our permission or finish an internal complaint process first.
Information Regulator website: https://inforegulator.org.za
Complaints information: https://inforegulator.org.za/complaints/
POPIA complaints email: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
15. CHANGES TO THIS POLICY
We may update this policy when our services, providers, information practices or legal obligations change. We will publish the revised version and update the date above. Where a change requires fresh consent or additional notice, publishing an updated policy alone will not replace that requirement.