Legal
Dataprotection
notice.
Written to satisfy the EU/UK GDPR, South Africa's Protection of Personal Information Act (POPIA) and the Botswana Data Protection Act, 2018. This is our own statement of practice, not independent legal advice.
Version 2026-08-v1 · Last updated 7 August 2026
Who is responsible
LITT CO. is a subsidiary of Itsoseng (Pty) Ltd, registration number 2015/264659/07.
Litt Co. is the responsible party (POPIA) / data controller (GDPR and the Botswana DPA) for the personal information collected through this website. Reach our data-protection contact at privacy@littco.co.za.
What we collect and why
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order | Performance of a contract (GDPR Art. 6(1)(b), POPIA s11(1)(b), Botswana DPA s14(b)) |
| Responding to contact and team-quote enquiries | Your consent, given by ticking the consent box on the form |
| Sending marketing emails and publishing reviews | Your consent, withdrawable at any time |
| Fraud prevention, accounting and tax records | Legal obligation and our legitimate interests |
Consent
Where we rely on consent, we ask for it explicitly with an unticked box, we keep the exact wording and version you agreed to, and we record the date and time. Consent is never bundled with our terms, and refusing optional consent never blocks a purchase.
Your rights
- Access the personal information we hold about you
- Correct information that is inaccurate or incomplete
- Delete your information where we have no overriding legal duty to keep it
- Object to or restrict processing, including direct marketing
- Receive your information in a portable, machine-readable format
- Withdraw consent at any time, without affecting processing already carried out
- Lodge a complaint with the Information Regulator (South Africa), the Data Protection Commission (Botswana) or your EU/UK supervisory authority
We respond to verified requests within 30 days at no charge.
Retention
Order records are kept for five years to meet tax and consumer-protection duties. Contact and quote enquiries are kept for 24 months. Marketing consent records are kept until you unsubscribe, plus 12 months as proof of consent. Published reviews stay live until you ask us to remove them.
Security and cross-border transfers
Data is encrypted in transit and at rest, access is limited to staff who need it, and payment card details never touch our servers. Some processors host data outside South Africa and Botswana. Where that happens we rely on providers bound by contractual safeguards offering protection substantially similar to POPIA s72, the Botswana DPA and GDPR Chapter V.
Sharing
We share only what is needed with payment processors, courier partners, email providers and our hosting platform. We never sell personal information and we do not use it for automated decision-making or profiling.
See also our Privacy Policy and Terms of Service, or contact us.