Privacy Policy

1.Who is responsible for your information

The responsible party, as POPIA uses that term, is:

2.What we collect

When you order

• Your name and surname.
• Email address and phone number.
• Delivery address, and billing address if it differs.
• What you ordered, when, and what you paid.

When you create an account

• Your email address and an encrypted password.
• Saved addresses and your order history.

When you pay

Payment is processed by Payfast. Your card number, expiry and CVV go directly to Payfast and never reach us. We only receive confirmation that a payment succeeded or failed, and a reference.

Automatically, when you browse

• IP address, browser and device type.
• Pages viewed and roughly how long for.
• Where you arrived from.

What we never ask for

We do not collect your ID number, medical history or health records. Please do not send us health information. If you have a medical question about an ingredient, speak to a doctor or pharmacist.

3.Why we use it, and our lawful basis

• To fulfil your order. Taking payment, picking, packing and delivering. Basis: necessary to perform our contract with you.
• To support you. Answering questions, handling returns and refunds. Basis: contract and our legitimate interest in running the business properly.
• To meet legal duties. Keeping tax and transaction records. Basis: compliance with a legal obligation.
• To prevent fraud. Checking suspicious orders. Basis: our legitimate interest in protecting the business and our customers.
• To market to you. Product news and offers. Basis: your consent. We only email marketing if you opted in, and every message has a one click unsubscribe.

We do not use your information to make automated decisions that have a legal effect on you.

4.Who we share it with

We share only what is needed, only with these kinds of operators:

• Payfast, to process your payment securely.
• Our courier, who needs your name, address and phone number to deliver.
• Our hosting and email providers, who keep the site running and send your order emails.
• Our accountants or auditors, where required.
• Law enforcement or a regulator, where the law requires it.

Everyone we use is required to protect your information and may only use it for the job we gave them. We do not sell, rent or trade your personal information.

5.Information sent outside South Africa

Our website hosting and some of our email tools run on servers outside South Africa. That means your information may be processed in another country.

As section 72 of POPIA requires, we only use providers bound by laws or contracts that give your information a level of protection substantially similar to POPIA.

6.Cookies

We use cookies and similar technology to:

• Keep you signed in and keep your cart filled while you browse.
• Remember your preferences.
• Understand, in aggregate, how the site is used so we can improve it.

You can block or delete cookies in your browser settings. If you block the essential ones, the cart and checkout will not work properly.

7.How we protect it

• The site is served over HTTPS, so traffic is encrypted in transit.
• Passwords are stored hashed, never in plain text.
• Card data never touches our systems.
• Access to customer information is limited to people who need it to do their job.

No system is perfectly secure. If a breach happens that puts your information at real risk, we will notify you and the Information Regulator as section 22 of POPIA requires.

8.How long we keep it

• Order and tax records: 5 years, as South African tax law requires.
• Account details: until you ask us to close the account.
• Marketing consent: until you unsubscribe.
• Support emails: up to 2 years.

After that we delete it, or anonymise it so it can no longer identify you.

9.Your rights under POPIA

You have the right to:

• Know what we hold about you, and get a copy.
• Correct anything wrong or incomplete.
• Delete information we no longer have a lawful reason to keep.
• Object to processing based on legitimate interest.
• Withdraw consent to marketing at any time.
• Complain to the Information Regulator.

To exercise any of these, email To be confirmed. We will respond within 30 days. There is no charge, unless a request is clearly excessive or repeated.

We may need to confirm who you are first, so that nobody else can request your information.

10.Complaining to the Regulator

Please come to us first so we can fix it. If you are still unhappy, you may complain to:

11.Children

Our products are not for anyone under 18, and this site is not aimed at children. We do not knowingly collect information about a child. If you believe a child has given us information, contact us and we will delete it.

12.Changes to this policy

We may update this policy. The current version always sits on this page with the date it was last changed at the top. If we make a significant change to how we use your information, we will tell account holders by email.

13.Contact us