Last updated: 10 June 2026
No Bad Surprises is operated by Morz Group (Pty) Ltd., the Responsible Party for personal information that we determine the purpose and means of processing under the Protection of Personal Information Act 4 of 2013 (POPIA).
Morz Group (Pty) Ltd.
CIPC registration number: 2018/111266/07
VAT number: 4910320086
General contact: info@morzgroup.com
Privacy / PAIA: privacy@morzgroup.com
Place of registration: South Africa
When you register, we process your name, email address and authentication information. Passwords are stored in hashed form under the current system design.
We store wish-list items, notes, sharing settings and claim status so that you can create lists, share them with people you choose and coordinate gifts.
We may process IP address, device and browser information, operating-system information, session information, pages or features used, performance data and error information.
If you contact us for support, we process the information you provide, such as your contact details and the contents of your enquiry.
Account and wish-list information is supplied by you. Technical information may be collected automatically by the Service or relevant providers. Support information is supplied by you when you contact us.
Basic account information is required to create and maintain an account. You choose what wish-list content to add and with whom to share it. Support information is voluntary, although we may need sufficient information to investigate your request. Analytics that depend on consent or an equivalent user choice will not be activated unless the required choice has been made.
Under POPIA, we process personal information only where permitted. Depending on the activity, this may include your consent; processing necessary to take steps at your request or perform an agreement with you; compliance with a legal obligation; protection of your legitimate interests; or pursuit of our or a third party’s legitimate interests where permitted by law.
We may use cookies, SDKs and similar technologies for essential service operation, security, support, performance monitoring and analytics. Where consent is required by applicable South African law for a particular processing activity, we will obtain it before that processing begins.
Google Analytics may be used for analytics where enabled. Zoho CRM and Zoho Desk may be used for contact management and customer support.
We do not sell personal information. Depending on the feature being used, information may be processed by or disclosed to:
| Provider | Purpose | Typical processing location |
|---|---|---|
| Microsoft Azure | Cloud and application infrastructure | Depends on the current Azure configuration and may involve processing outside South Africa |
| Google Analytics | Usage analytics, where enabled | May include processing outside South Africa |
| New Relic | Performance and error monitoring | May include processing outside South Africa |
| Zoho | CRM and customer support | May include processing outside South Africa |
Where a service provider acts as our operator under POPIA, we require it to process information with our knowledge or authorisation and to maintain appropriate confidentiality and security measures, including through a written agreement where required by section 21 of POPIA.
Your wish-list content is also disclosed to the people with whom you choose to share it, according to the sharing features and settings of the Service.
We may disclose information where required or authorised by law, to establish or defend legal rights, to prevent fraud or misuse, or in connection with a lawful corporate transaction.
Some providers process information outside South Africa. Where we transfer personal information to a recipient outside South Africa, we do so in accordance with section 72 of POPIA.
We retain personal information only for as long as needed for the purpose for which it was processed, or for a longer period where required or permitted by law.
Account and wish-list information is kept while the account or relevant content is active and for a limited period thereafter where necessary for backups, security, disputes or legal obligations. Technical, analytics and support records are retained only for as long as reasonably necessary. When information is no longer required, we delete, destroy or de-identify it as appropriate.
Subject to POPIA and PAIA, you may request confirmation of whether we hold personal information about you and request access to it; request correction, deletion or destruction where permitted; object to processing in circumstances provided by law; withdraw consent where consent is the basis for processing; object to direct marketing; and lodge a complaint with the Information Regulator.
To exercise a right, contact privacy@morzgroup.com. We may need to verify your identity before acting on a request.
Electronic direct marketing will be sent only in accordance with POPIA.
We use reasonable technical and organisational measures designed to protect personal information against loss, damage and unauthorised access, acquisition, destruction or processing. Measures include encrypted transmission, access controls and hashed password storage where applicable.
If there are reasonable grounds to believe that personal information under our control has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay required by law enforcement.
POPIA generally restricts the processing of personal information of children. If a person under 18 is not legally competent to consent independently, a competent person, usually a parent or guardian, must authorise the processing unless another statutory authorisation applies. The Service should not be used by a child in circumstances where the required authorisation has not been obtained.
The Service may link to independent third-party services. We are responsible for our own processing of personal information, but not for the privacy practices of unrelated third parties.
Requests for access to records under PAIA may be submitted to our Information Officer at privacy@morzgroup.com.
Our PAIA Manual is available at: https://morzgroup.com/paia-manual/.
You may lodge a POPIA complaint with the Information Regulator:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Toll free: 0800 017 160
Email: POPIAComplaints@inforegulator.org.za
We may update this Privacy Policy from time to time. The current version will be posted with its revision date. Where applicable law requires additional notice or consent for a material change, we will provide it.
Privacy, POPIA and PAIA enquiries: privacy@morzgroup.com
General enquiries: info@morzgroup.com