At Casablunta, privacy is not merely a compliance checkbox—it is a foundational principle. We architect our data practices with the same precision and intentionality that defines The Higher Standard. This Privacy Policy outlines how we collect, process, protect, and respect your personal information across all jurisdictions, ensuring your digital sovereignty remains uncompromised.

This policy applies to all Residents who engage with Casablunta through our digital platforms, whether you reside in South Africa, the European Union, or anywhere else in the world. We are committed to maintaining full compliance with the Protection of Personal Information Act (POPIA), the General Data Protection Regulation (GDPR), and emerging global privacy frameworks.

1. The Foundation (Regulatory Compliance)

Casablunta operates under a multi-jurisdictional compliance framework:

• POPIA (South Africa): As a South African entity, we are fully compliant with the Protection of Personal Information Act 4 of 2013. Our Information Officer ensures adherence to all eight conditions for lawful processing.
• GDPR (European Union): We honor the rights of EU residents under Regulation (EU) 2016/679, including enhanced consent mechanisms, data portability, and the right to erasure.
• UK GDPR: For UK residents, we comply with the Data Protection Act 2018 and the UK GDPR as retained EU law.
• Global Standards: We continuously monitor and adapt to emerging global privacy frameworks, including the CCPA/CPRA where applicable to our international Residents.

2. Collection Protocols (What We Harvest)

We collect information only where it is essential to provide the Casablunta experience. This data falls into three categories:

2.1 Information You Explicitly Provide

• Identity Data: Full name, username, and date of birth (to verify legal age).
• Contact Data: Email address, telephone number, billing address, and physical delivery coordinates.
• Financial Data: We do not store full credit card numbers. All payments are processed via Level 1 PCI-DSS compliant gateways. We receive only confirmation of payment and truncated card details for identification.
• Transaction Data: Detailed history of the artifacts you have commissioned and your interaction with our checkout flow.
• Communication Data: Records of support inquiries, preferences, and feedback provided to The Collective.

2.2 Automated Data Acquisition (The Digital Footprint)

• Technical Attributes: IP address, browser architecture, time zone settings, and device operating systems.
• Engagement Metrics: Pages viewed, duration of residency on our platform, navigation paths, and interaction with visual assets.

2.3 Third-Party Intelligence

We may receive information about you from:

• Analytics providers (such as Google Analytics).
• Payment gateways and fraud prevention agencies.
• Logistics partners regarding delivery status.

3. Legal Foundations for Processing

We process data only when one of the following legal pillars is present:

• Contractual Necessity: To fulfill your order and deliver your artifacts.
• Legitimate Interest: To improve our platform, prevent fraud, and maintain security.
• Legal Obligation: To comply with tax, audit, and regulatory requirements.
• Explicit Consent: For marketing communications and non-essential tracking.

4. Usage & Protection (The Fortress)

Your data is never for sale.

We use your information strictly to curate your experience, process transactions, and protect the integrity of the Casablunta ecosystem. Protection measures include:

• End-to-End Encryption: All data in transit is secured via Transport Layer Security (TLS).
• Restricted Access: Only essential personnel within The Collective have access to personal data, governed by strict Role-Based Access Controls (RBAC).
• Infrastructure Security: We utilize hardened cloud infrastructure with continuous monitoring and automated threat detection.

5. Data Sharing & Global Transfers

We share data only with vetted Service Providers who adhere to our privacy standards (logistics, payments, cloud hosting). Because Casablunta is a global entity, your data may be processed in jurisdictions outside your own. We ensure all such transfers are protected by:

• Standard Contractual Clauses (SCCs).
• Adequacy decisions by relevant data authorities.
• Binding Corporate Rules for global processing.

6. Your Rights (Digital Sovereignty)

As a Resident of the Casablunta ecosystem, you hold the following inalienable rights:

• Right to Access: Request a copy of all data we hold about you.
• Right to Rectification: Correct any inaccuracies in your profile.
• Right to Erasure: Request the total deletion of your personal information.
• Right to Restriction: Limit how we process your data.
• Right to Portability: Request your data in a structured, machine-readable format.
• Right to Object: Withdraw consent for marketing or automated profiling.

To exercise these rights, contact our Information Officer at support@casablunta.com.

7. Data Retention (The Archive)

We retain your information only as long as necessary:

• Transaction Records: Retained for 7 years to comply with statutory tax and audit obligations.
• Account Data: Retained for the duration of your active residency plus 2 years of inactivity before anonymization.
• Marketing Profiles: Purged immediately upon withdrawal of consent.

8. Protection of Minors

The Casablunta experience is intended for individuals aged 18 and older. We do not knowingly collect or solicit data from minors. If we discover that a minor has provided us with personal information, we will initiate immediate deletion protocols.

9. Cookies & Tracking Technologies

We use cookies to enhance functionality and analyze traffic. You may manage your preferences through our Cookie Consent Manager or your browser settings.

• Essential Cookies: Required for site security and core functionality. Cannot be disabled.
• Functional Cookies: Remember your preferences and language settings.
• Analytical Cookies: Collect aggregated usage data to improve site performance.
• Marketing Cookies: Track activity to deliver personalized advertising. Deployed only with your consent.

10. Policy Evolution & Amendments

As digital landscapes shift and regulatory frameworks evolve, we reserve the right to modify this Privacy Policy. Material changes will be communicated via email or prominent website notice at least 30 days before taking effect. Your continued use of our services after amendments constitute acceptance of the revised policy.

11. Contact & Correspondence

For questions, concerns, or to exercise your data rights, The Collective remains accessible:

We will respond to all legitimate inquiries within one month. Complex requests may require an additional two months; we will notify you of any extension and explain the reason.