Privacy Notice

The Great Yellow Brick (Pty) Ltd Privacy Notice

Introduction:
This notice explains how we obtain, use and disclose your personal information, in accordance with the requirements of the Protection of Personal Information Act (“POPIA”).

The Great Yellow Brick (Pty) Ltd (including this website: greatyellowbrick.co.za) are committed to protecting your privacy and to ensure that your personal information is collected and used properly, lawfully and transparently.

Who we are:
The Great Yellow Brick Company is the licensed operator of the LEGO Certified Store in South Africa. GYBC was started in 2017 by three partners: Robert Greenstein, Hayley Greenstein and Greg Bergh who were excited to bring the official LEGO awesomeness to all the LEGO fans (adults and kids alike) of South Africa. GYBC works closely with the LEGO Group to ensure our customers receive a world class shopping experience. The LEGO Certified Store is now available in Johannesburg, Pretoria, Cape Town and Durban as well as Online.

The type of personal information we collect:

We currently collect and process the following information:

• Customers: Customer name, surname, email address, telephone number, marketing consent, delivery address, order details, purchase history
• Employees: Employee name, surname, ID number, email address, bank details, physical address, contact number, next of kin, marital status, income tax number, spouses name and surname, postal address 

We collect and process your personal information mainly to contact you for the purposes of our loyalty program and for the marketing of new products and promotions, and delivering services accordingly. For this purpose we will collect contact details including your name and email address.

We collect information directly from you where you provide us with your personal details.  Where possible, we will inform you what information you are required to provide to us and what information is optional.

Website usage information may be collected using “cookies” which allows us to collect standard internet visitor usage information.

How we get the personal information and what we use it for:

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Customer: general service delivery, customer sales, delivery of orders, subscription to marketing, subscription to loyalty program, review of products
• Employee: purposes of vetting, purposes of employment

We will use your personal information only for the purposes for which it was collected and agreed with you.  In addition, where necessary your information may be retained for legal or user experience optimisation purposes, enabling us to provide you with an enhanced shopping experience at The Great Yellow Brick (Pty) Ltd. 

For example:

• To gather contact information;
• To confirm and verify your identity or to verify that you are an authorised user for security purposes;
• For the detection and prevention of fraud, crime, money laundering or other malpractice;
• To conduct market or customer satisfaction research or for statistical analysis;
• To obtain a product review on the products that you purchased from us;
• For audit and record keeping purposes;
• In connection with legal proceedings.

We also receive personal information indirectly, from the following sources in the following scenarios:

• Customer: none
• Employee: criminal and credit checks

We use the information that you have given us in order to:

• Customer: for purposes of service delivery, to facilitate our loyalty program, to market our products and promotions, to deliver orders, and to obtain product reviews
• Employee: for purposes of employment, for future employment 

We may share this information with:

• Customer: loyalty system, 3^rd party couriers, accountant, trusted 3rd parties for the purposes of product reviews
• Employee: accountants, future employers

We may disclose your personal information to our service providers who are involved in the delivery of products or services to you. We have agreements in place to ensure that they comply with the privacy requirements as required by the Protection of Personal Information Act. When we ask other companies like e.g. couriers, shipping and warehouse service provides, payment providers, IT platform providers, fraud detection and prevention providers, survey providers, product catalogue providers, rate and review product system providers and customer service suppliers to deliver services on our behalf; we have contracts with the companies to make sure they only use your personal information for agreed services and meet legal requirements.

We may also disclose your information:

• Where we have a duty or a right to disclose in terms of law or industry codes;
• Where we believe it is necessary to protect our rights.

International Transfer of Personal Information

In some cases, the third parties to whom we may disclose your personal information may be located outside your country of residence (for example, in a cloud service, system or server, third party service providers), and may be subject to different privacy regimes. When we disclose personal information overseas, we will take appropriate safeguards to protect your personal information to ensure that the recipient will handle the information in a manner consistent with this policy and the level of protection provided for in POPIA.

Collection of Information by “Cookies”

You are aware that information and data is automatically collected through the standard operation of the Internet servers and through the use of "cookies." "Cookies" are small text files a Website can use to recognise repeat users, facilitate the user's ongoing access to and use of the Website and allow a Website to track usage behaviour and compile aggregate data that will allow content improvements and targeted advertising. Cookies are not programs that come onto your system and damage files. Generally, cookies work by assigning a unique number to you that has no meaning outside the assigning site. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature; however, you should note that cookies may be necessary to provide you with certain features (e.g., customized delivery of information) available on our Websites.

When will we process your personal information:

In terms of the Protection of Personal Information Act (POPIA), the justification ground which we base our processing on consist out of the following:

• The data subject or a competent person where the data subject is a child consents to the processing. Kindly note that you have the right to withdraw your consent;
• The processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party;
• The processing complies with an obligation imposed by law on the business;
• The processing protects a legitimate interest of the data subject;
• The processing is necessary for the proper performance of a public law duty by the business; or
• The processing is necessary for pursuing the legitimate interests of the business or of a third party to whom the information is supplied. 

How we store your personal information:

Your information is securely stored as follows:

• Customers: securely in the cloud, access-controlled and password protected
• Employees: Password protected, access-controlled folders, printed in files locked away, accounting system – access controlled

We keep your information for 3 years. We will then dispose your information by deleting electronic files and shredding paper documents.

Your data protection rights:

• You are entitled to access your personal data by sending a written request to playwell@thebrick.co.za. We may charge you a fee for this service.
• You may also request The Great Yellow Brick (Pty) Ltd to correct or supplement any of your personal data which we will undertake as soon as practicable.
• You may also request The Great Yellow Brick (Pty) Ltd to correct or supplement any of your personal data which we will undertake as soon as practicable.
• You may request the destruction of your personal data. The Great Yellow Brick (Pty) Ltd will consider your request in light of any other laws or regulations prohibiting us from destroying your personal data.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at playwell@thebrick.co.za if you wish to make a request.

 

Contact details:

Name:  Hayley Greenstein

Address: Shop L51C, Lower Level, Sandton City, Corner Rivonia road & 5^th Street, Sandton

Phone Number: 011 662 1777

E-mail: playwell@thebrick.co.za

How to complain:

If you have any concerns about our use of your personal information, you can email a complaint to us at playwell@thebrick.co.za.

You can also complain to the Information Regulator if you are unhappy with how we have used your Information.

Their contact details are as follows:

The Information Regulator (South Africa)

33 Hoofd Street
Forum III, 3rd Floor Braampark
P.O Box 31533
Braamfontein, Johannesburg, 2017

Complaints email: complaints.IR@justice.gov.za