Privacy Policy

FXDE. Our full registered entity name and registration number are available on request from customerservice@fxde.co.za.

Our Information Officer is registered with the Information Regulator and can be reached at customerservice@fxde.co.za.

Registering an Information Officer is a genuine legal requirement under POPIA, not an optional formality.

• Name, email address, phone number and delivery address.
• Order history.
• Payment details, processed by our payment provider, FXDE does not store full card numbers.
• The content of your conversation if you contact support or use the chat assistant.

Directly from you at checkout, when you create an account, or when you contact us, plus cookies and analytics tools (Google Analytics 4, Meta Pixel) that collect browsing behaviour on the site.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioural metrics, heatmaps and session replay to improve and market our products and services. Website usage data is captured using first-party and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. Additionally, we use this information for site optimisation, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

To fulfil and deliver orders, provide customer support, send order-related communications, and, only with your separate opt-in consent, send marketing emails. These are kept as genuinely separate consent choices, never bundled into a single checkbox.

Where we rely on your consent, such as for marketing emails, we ask for it clearly and you are never opted in by default. You can withdraw consent at any time using the unsubscribe link in any marketing email, or by contacting us. Withdrawing marketing consent does not affect order and delivery messages, which are a necessary part of fulfilling a purchase you have made.

Payment processors, courier partners, our email service provider (for order updates and, with consent, marketing), and analytics providers. We do not sell personal information.

Some of the services we use process or store data on servers outside South Africa. POPIA permits this where the receiving party is subject to laws or binding agreements providing an adequate level of protection.

The services involved, and what each handles, are:

• Supabase, which hosts our database and file storage, including your account details, orders and any files you upload.
• Cloudflare, which hosts and delivers this website.
• Resend, which sends our transactional email such as order confirmations and shipping updates.
• Google Analytics and Google Tag Manager, which provide website usage analytics.
• Microsoft Clarity, which provides usage analytics and session replay, as described above.

Our payment processing is handled by Yoco, a South African provider. Card details are entered on Yoco's own secure payment page and are never received or stored by FXDE.

We keep personal information only as long as we need it for the purposes above, or as long as the law requires. In practice that means:

• Order and payment records are kept for five years, because South African tax law requires transaction records to be retained for that period.
• Account details are kept for as long as your account is open. If you ask us to delete your account, we remove your details except for any order records we are legally required to keep.
• Marketing consent records are kept for as long as you stay subscribed, and for a reasonable period afterwards so we can show when and how consent was given or withdrawn.
• Support conversations are kept for as long as needed to resolve your query and to handle any follow-up, then deleted in the ordinary course.

When information is no longer needed, we delete or de-identify it.

We take appropriate, reasonable technical and organisational measures to protect your personal information against loss, unauthorised access and misuse, as POPIA requires. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by law.

We use a cookie consent banner that requires your opt-in before any non-essential cookie is set. Your choice is valid for 12 months before we ask again, and you can accept, reject or manage your preferences at any time.

You can request access to, correction of, or deletion of your personal information, and object to processing, at any time by contacting us via the support page. In the event of a data breach we will notify affected individuals and the Information Regulator, as POPIA requires.

If you're unhappy with how we've handled your data, you can lodge a complaint with the Information Regulator of South Africa at justice.gov.za/inforeg.