Privacy policy

Last updated: August 2026

About Advanced 4x4

Advanced 4x4 is a proudly South African manufacturer and specialist retailer of premium 4x4 accessories and equipment, based at 36 De Kock Street, Strand, 7140, Western Cape. We are committed to protecting your privacy and handling your personal information with the same care and integrity we apply to everything we do.

This Privacy Policy is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa's data protection law. Advanced 4x4 operates this store and website, including all related information, content, features, tools, products, and services, to provide you with a curated shopping experience (the "Services"). Advanced 4x4 is powered by Shopify, which enables us to provide the Services to you.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand how your personal information is collected, used, and disclosed.

Who Is Responsible for Your Information

Under POPIA, Advanced 4x4 is the "responsible party" for the personal information described in this policy — meaning we determine why and how it's processed. Shopify, our payment processors, couriers, and other service providers who process personal information on our instruction act as "operators."

Personal Information We Collect or Process

We may collect or process the following categories of personal information, depending on how you interact with the Services:

  • Contact details including your name, address, billing address, shipping address, phone number, and email address.
  • Payment information. We offer several payment options at checkout, including PayFast, Stitch (which enables Capitec Pay, Apple Pay, and Google Pay), and the Buy Now, Pay Later services Payflex and Mobicred. Card and payment details are collected and processed directly by these providers, not stored on our own systems — we retain transaction records (amount, date, order reference, payment status, and which provider was used) but not full card numbers. If you choose Payflex or Mobicred, please note these are credit providers: completing a purchase through them involves a separate credit or affordability assessment conducted directly between you and that provider, under their own privacy terms, which may involve them processing additional personal information beyond what Advanced 4x4 collects. We recommend reviewing PayFast's, Stitch's, Payflex's, and Mobicred's own privacy policies before using them at checkout.
  • Account information including your username, password, security questions, preferences, and settings.
  • Transaction information including items you view, add to cart, add to a wishlist, or purchase, return, exchange, or cancel, and your past transactions.
  • Communications with us, including information you include when contacting customer support.
  • Device information including your device, browser, network connection, IP address, and other identifiers.
  • Usage information regarding how and when you interact with the Services.

Personal Information Sources

We may collect personal information:

  • Directly from you — when you create an account, use the Services, or communicate with us.
  • Automatically through the Services — from your device and through cookies and similar technologies.
  • From our service providers — including Shopify and others who process information on our behalf.
  • From our partners or other third parties.

How We Use Your Personal Information, and Our Legal Basis

Every use of your personal information rests on a lawful basis under POPIA — typically your consent, the necessity of processing to fulfil a contract with you (like an order), or our legitimate business interests, balanced against your rights.

  • Provide, tailor, and improve the Services (contractual necessity) — processing payments, fulfilling orders, remembering preferences, managing your account, arranging shipping, and handling returns and exchanges.
  • Marketing and advertising (consent, or the existing-customer exception described below) — see the dedicated Direct Marketing section.
  • Security and fraud prevention (legitimate interest / legal obligation) — authenticating your account, securing payments, detecting fraud.
  • Communicating with you (contractual necessity / legitimate interest) — customer support and enquiries.
  • Legal reasons (legal obligation) — complying with applicable law or valid legal process.

Direct Marketing

South African law treats electronic marketing (email, SMS, WhatsApp, and marketing phone calls) differently from postal marketing, under Section 69 of POPIA:

  • If you're a new subscriber who isn't yet a customer, we will only send you electronic marketing communications if you've given prior, specific consent — for example, by opting in through a signup form. We will not add you to marketing lists by default or through a pre-ticked box.
  • If you're an existing customer, we may send you electronic marketing about our own similar products or services without separate consent, because we obtained your details in the context of a sale — but only if we give you a clear, free opportunity to opt out, both when we first collect your details and in every marketing message we send.
  • Every marketing communication we send will identify us clearly and include a working way to opt out.
  • You can opt out of promotional emails at any time using the unsubscribe link in our emails, or by contacting us directly. Once you opt out, we will stop marketing to you electronically and keep a record of your objection so it's respected going forward.

How We Disclose Personal Information

We may disclose your personal information to:

  • Shopify and other service providers who perform services on our behalf (IT management, data analytics, customer support, cloud storage, fulfilment, and shipping).
  • Payment and checkout providers, specifically PayFast, Stitch, Payflex, and Mobicred, who process your payment or credit application directly when you select them at checkout.
  • Business and marketing partners, to provide marketing services, where permitted under the Direct Marketing section above.
  • Third parties you direct us to, such as when you request us to ship products to a third party, or through your use of social media widgets or login integrations.
  • Our affiliates or corporate group.
  • In connection with a business transaction such as a merger, to comply with legal obligations, to enforce our terms or policies, or to protect the Services, our rights, or the rights of others.

Relationship with Shopify

The Services are hosted by Shopify, which processes personal information about your access to and use of the Services on our behalf, as our operator. Information you submit will be transmitted to and shared with Shopify, and potentially with third parties located outside South Africa — see Cross-Border Transfers below. To learn more about Shopify's own practices, visit the Shopify Consumer Privacy Policy or the Shopify Privacy Portal.

Third-Party Websites and Links

The Services may link to websites or platforms operated by third parties. We don't guarantee and aren't responsible for the privacy or security practices of those sites, and a link doesn't imply our endorsement.

Children's Personal Information

The Services aren't intended for use by children. We don't knowingly collect personal information from children without the consent of their parent or legal guardian, as required under Sections 34–35 of POPIA. If you're a parent or guardian and believe your child has provided us with personal information without your consent, please contact us so we can delete it.

Security and Data Breach Notification

No security measures are perfect or impenetrable, and we can't guarantee "perfect security." We recommend avoiding unsecured channels for sending us sensitive or confidential information. If a data breach occurs that may compromise your personal information, Section 22 of POPIA requires us to notify the Information Regulator and affected individuals as soon as reasonably possible — we will do so, along with what steps we recommend you take.

Retention of Your Information

We retain your personal information only for as long as necessary for the purpose it was collected — for example, to maintain your account, provide the Services, comply with legal or tax obligations, or resolve disputes and enforce our agreements and policies.

Your Rights

Under POPIA, you have the right to:

  • Access — request confirmation of, and access to, the personal information we hold about you, and information about how it has been processed (Section 23).
  • Correction — request that we correct or update inaccurate, irrelevant, excessive, out of date, incomplete, or misleadingly obtained personal information (Section 24).
  • Deletion — request that we delete personal information we no longer have authority to retain (Section 24).
  • Object — object, on reasonable grounds, to the processing of your personal information (Section 11(3)), including objecting to direct marketing at any time, free of charge (Section 69).
  • Withdraw consent — where processing is based on your consent, withdraw that consent at any time.

As a courtesy, we're also generally able to provide you with a copy of the personal information we hold about you in a usable format on request, though this isn't a separately named right under POPIA the way it is under some other countries' laws.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before processing your request, and will respond within the timeframes required by POPIA.

Complaints

If you're unhappy with how we've handled your personal information, please contact us first so we can try to resolve it directly. You also have the right to lodge a complaint with South Africa's Information Regulator:

The Information Regulator (South Africa)
Email: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za / 010 023 5200
Website: inforegulator.org.za

Cross-Border Transfers

We may transfer, store, and process your personal information outside South Africa — for example, through Shopify's infrastructure, or where a payment provider you select is based outside the country. Where we do, Section 72 of POPIA requires that the transfer meet one of the following conditions: the recipient is subject to a law, binding agreement, or binding corporate rules that provide an adequate level of protection substantially similar to POPIA; you've consented to the transfer; the transfer is necessary to perform a contract with you or in your interest; or the transfer otherwise benefits you and it's not reasonably practicable to obtain your consent first. We rely on our service providers' own compliance arrangements, including standard contractual protections they put in place with the territories they operate in, to help meet this requirement.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal, or regulatory reasons. We'll post the revised policy on this website and update the "Last updated" date accordingly.

Contact Us: